91–100 of 105 posts
I wish Facebook brings something similar to the Instagram. I recently got hacked and lost my account and my first name username for good[0]. They don't even allow 2 factor auth on accounts with low followers there. [0] https://medium.com/@batuhan/i-got-hacked-and-i-dont-think-in...
Earlier quoted context omitted.
You can use your Yubikey + Yubico Authenticater to replace Authy. It does not add that much security, but you add device switch ability without Cloud Sync.
I had a lot of problems with Yubico Authenticator. Wound up switching back to a generic app.
Earlier quoted context omitted.
I don't understand how it has taken them so long to add it natively... they just shipped FLAC audio support but still don't care about U2F?
FLAC audio support is simpler, it's just adding a self-contained FLAC decoding library, and wiring it to the already-existing audio code. For U2F, they have to write code to interact with the operating system USB API (for each operating system), plus the main U2F code, plus a Javascript API, all while taking care to not cause any new privacy leaks or worse. If you want to follow, the main bugzilla item seems to be th…
The real complexity is in exposing the interfaces through Javascript and orchestrating all the GUI components. In fact, U2F doesn't even require a hardware token. It was designed so browsers could implement everything in software to hasten adoption.
Earlier quoted context omitted.
Has someone else read this and understood the argument? Because I don't follow it.
I think he was saying something along the lines of: If you increase the strength of the authentication on an account, then you increase the expectation (in others) that anyone authenticated to the account was authenticated legitimately. So, for example, if you have weak authentication and illegitimate access is common, then others are accustomed to distrusting the service and will react accordingly (for instance, by…
Earlier quoted context omitted.
I think he was saying something along the lines of: If you increase the strength of the authentication on an account, then you increase the expectation (in others) that anyone authenticated to the account was authenticated legitimately. So, for example, if you have weak authentication and illegitimate access is common, then others are accustomed to distrusting the service and will react accordingly (for instance, by…
This is (part of) what I was trying to convey. Thanks for putting it into better words than I could!
But that assumes that your login methods are provided to your social network. No one necessarily knows I have 2FA/U2F, so if I am compromised, I still have the same general assumption in my social network of "oops plttn left his Facebook on his laptop unlocked".
Looks like a logistical nightmare to me. You think forgetting a password is a pain in the ass, just wait until you loose your security key. It won't be one service you have to reset through an alternate verification route, but every single one you ever used! I also foresee potential issues with data corruption on keys, and multiple-keys getting out of sync (e.g. work vs home). And I have no doubt that clever hackers…
Tangent comment: https://i.imgur.com/Xm1qRI4.png Does anybody know why the comments under this post are like that, at least for me? Is there a particular reason why people from Myanmar (some with latin name?) would comment this much more than any other?
Earlier quoted context omitted.
I don't think I follow your reasoning of how increased security increases the severity of a compromise. Can you elaborate on that?
If my network knows that I use PGP to login, they may well accept an (illegitimate) announcement that I'm changing my keys to {attacker-generated.asc}. Of course, really such a login key should only be able to authenticate, and my network should only accept a proper revocation certificate that would need to have been generated by a different key with the 'Certify' action enabled. How likely or damaging that is obviou…
I am slightly disappointed that this doesn't work in Firefox, despite the fact that I have an add-on[1] installed to add U2F support. Github for instance is able to detect U2F support and let me use it. That said, I understand the lack of support since I am an extremely small niche, and this did prompt me to finally add 2FA to facebook (U2F and code generation from my Yubikey Neo) [1] https://addons.mozilla.org/en-US…
Facebook engineers responded to this in the U2F issue on the Firefox issue tracker. It turns out that for this particular technology determining whether or not your browser supports U2F is not yet feasible, so they resort to user agent sniffing. You can use Firefox with the third party plugin if you spoof the user agent to Chrome.
"Doing feature-detection of a U2F API instead of User Agent sniffing would have required additional engineering effort due to how our system already works" (https://bugzilla.mozilla.org/show_bug.cgi?id=1065729#c264)
Tangent comment: https://i.imgur.com/Xm1qRI4.png Does anybody know why the comments under this post are like that, at least for me? Is there a particular reason why people from Myanmar (some with latin name?) would comment this much more than any other?
Probably this: https://www.youtube.com/watch?v=oVfHeWTKjag