Viewing profile — ptoomey3

https://tenderlovemaking.com/2016/02/05/i-am-a-puts-debugger... is ruby gold for this kind of stuff. As a Ruby developer, probably one of the most impactful "quick tips" I've ever …

I think the zero-knowledge proof bit is how some password managers authenticate the users to their system. 1Password for example, uses the secure remote password protocol: https://…

Yeah, to match the dot pitch apple is designing for, the 4K monitor would have to be more like 22 inches instead of 27. We know this since the 4K iMac is a 21.5 inch screen.

For me the option key was always the one that threw everything else off..since failure to recognize it made me doubt all the others :-). One "pneumonic" that helps for the option k…

The verified device flow isn’t meant to be as strong as 2FA, but is a very strong mitigation against mass credential stuffing attacks for all users. In terms of client certs, see m…

One issue with HTTPS client cert auth is that it can be non-trivial to support at the application level when you have a multi-tier architecture where TLS termination happens at the…

What isn’t stated in that post is that we are sending monthly email notifications to any user found using password authentication during the deprecation. As a result, we expect the…

GitHub Actions tokens are actually based off our newer “GitHub apps” system and not “OAuth apps”. GitHub app tokens support much more granular controls (both in terms of abilities …

Think of this deprecation as step one of a multi-step plan/roadmap .

It’s not at all about the security of delivering credentials over https, but more about the the complexity of trying to defend against weak passwords/credential stuffing with an ap…

Rails actually did turn the HEAD into a GET back when this code was written - https://github.com/rails/rails/blob/e17e25cd23e8abd45b170646...

My experience with password managers is that they work great for me, because I understand every sharp edge and can work around them. My experience when advising family to use them …

100% true. I personally wish the hardware-focused U2F bit didn't predate the WebAuthn spec. I feel, because of that, way too much focus is placed on the "hardware security" bit. I …

Yet another batteries included downside...a blackbox http implementation that is hard to debug.

This isn’t to say it happened on every response..it was a relatively small fraction. But, it was enough to tell _something_ was going on. Who knows, it could be something quirky on…

One that we encountered in several services were gRPC ruby clients that semi-regularly blocked on responses for an indeterminate amount of time. We added lots of tracing data on th…

Need or not need...a bigger issue is simply the technical reality of what you have now. If your non-trivial infrastructure doesn’t have great http2 support, it might be a pretty bi…

We were mostly using ruby (which uses their C bindings) and golang (which are native to golang).

Our main hinderance with gRPC was that several disparate teams had strange issues with the fairly opaque runtime. The “batteries included” approach made attempts to debug the root …

While the tools themselves might not use the same key for both operations, I think the question was asking about whether it is problematic that a user’s SSH keys, used in SSH for s…

The bit being referred to is how signing and encryption can be inverse operations of each other in some schemes. The canonical example is textbook RSA. Signing is the same operatio…

I mostly agree, though I still think adding 2fa to whatever password manager you do use is vaguely worthwhile. Long term creds can get checked into repos, accidentally pasted somew…

SMS does still help to mitigate a common attack...folks trying out password dumps on other sites. But, I don’t disagree we need to move on when we have more options to choose from.…

I think the trick is to push the trust up a level to the platform owner (you have to trust someone at some point) via webauthn or something. If you do that, then the browser itself…

As noted elsewhere in this thread, I’m not advocating this homegrown solution. But, I will play devil’s advocate a bit. Yeah, sure, a Secure Enclave key per device is more secure t…