Viewing profile — thekeyper

Actually, Session-Lock does offer some protection against some MITM attacks in the form of a timeout that would be triggered with most MITM attacks, but its purpose (and that of Ch…

httponly cookies are meant to prevent attacks like XSS by preventing access to them from client-side JS. However, they can still be stolen by malware on the device (there's a whole…

Glad to hear it. I feel the library could be improved, and if your server runs on something other than Node.js, you'll have to put together some straightforward crypto code, so fee…

If the browser loses the private key from IndexedDB, the session token will become invalid because it would no longer be able to be verified on the server. Basically, the user woul…

Google’s recent announcement of a proposed ‘Device Bound Session Credentials’ feature[1] for Chrome reminded me of a project we worked on last year at my company. We focus on fraud…

Hi! Very cool project. Just out of curiosity, what trips up Crawlee on CreepJS? I haven't heard of anyone actually using it in production (actually don't think it's meant for produ…

SIM swapping is relatively common in the US because it's not difficult to execute via social engineering. I'm not sure what the situation / protections against SIM swapping are in …

I think usage-based pricing is more fair than per-seat pricing, and it makes much more sense for SurveyMonkey than per-seat pricing. Usage-based pricing also eliminates account sha…

Our system does not support people without smartphones, which is why we are addressing companies that are mobile-first or generally have more tech-forward userbases with ~100% smar…

Thanks, will do! That's a clever platform.

Agreed that WebAuthn is valuable in mobile-only cases, but I don't think it can transition to desktop web for a large majority of people. The overlap in a Venn diagram of "people w…

The contention on account sharing is "robbing companies of revenue". It is not related to additional costs imposed on companies due to account sharing. A non-negligible number of p…

Thanks, this question touches on a very significant point. Backup and recovery currently are handled by iCloud and Google Drive through Keychain and KeyStore, respectively, both of…

Fair point. As you implied, security key adoption, particularly for the consumer-facing web, is very low, as is support for more secure security keys (FIDO2) by consumer-facing web…

> The way I use passwords is way safer than Keyri I don't see how that is possible. (1) Keyri private keys cannot be stolen other than through smartphone malware, which is exceedin…

Eliminating account sharing does not preclude offering the ability to share seats. Zendesk could very well offer their customers a way to provision users like you a limited account…

Correct, that's currently the case. Users can use QR code backup/restore functionality if enabled by the developer to switch between iOS and Android. That would have to be done app…

Yes, when developers enable passcode protection, the guess rate limiting is based on the OS default because it's accessing the same subsystem responsible for unlocking the phone it…

Understood, thanks. I think the concept is excellent - truly a digital ID card that you can present with a simple cryptographic token, thus a real "proof of identity". Keyri is "pr…

The similarities with VPA/Alero end at the concept of QR-based login. It is a system for provisioning enterprise vendors and requires a substantial onboarding process. It is not an…

We do not use Hyperledger Aries, but thanks for showing us. I have a blockchain background, and Keyri is somewhat inspired by blockchain concepts, but we've stayed away from blockc…

Login on desktop happens through scanning a QR code on the service's login page using the service's app. On a mobile device, logging in happens by tapping a button and being verifi…

Two options, each configurable by the developer implementing the SDK: (1) When a user sets up their new phone using an iCloud / Google Drive backup of their old phone, the private …

Sent you an email. Anyone else - please let me know if you're having trouble with the demo here or email me - zain@keyri.co