151–154 of 154 posts
Earlier quoted context omitted.
> There are plenty of us who have legitimate use cases for web push Such as? The only use case for notifications and PWAs I'm coming across are clickbait news sites creating a sense of urgency with "homepage was updated" modals obscuring content and capturing click events. Web user agents have freedoms in rendering pages to users, and Safari siding with users and power efficiency is a good thing. In line with other c…
I run a premium retreat in rural India for which I built a web based portal to act as an “app” for the event. I don’t have the resources to build native and web applications for each platform. Right now we make announcements for the next schedule item. I’d like to notify attendees via the web app I wrote and have it display schedule information offline.
You can notify them by email, SMS or using any other messenger. There's no need to force another on your customers.
> and have it display schedule information offline.
Your customers already have a calendar application, there's no need to make them visit a web page for that. At least there wouldn't if Google supported Webcal so everyone can use their favorite native applications instead. But that wouldn't push people towards Google's services and garbage web apps.
Earlier quoted context omitted.
FIDO2 is working, but I wouldn't call it "golden" at all. Tying authentication to a single device you can lose, especially one controlled by the device vendor not by yourself, sounds highly risk prone to me. As far as I'm aware, this is not yet a solved problem with WebauthN or FIDO2 standards - they simply recommend that you provide another authentication method or backup device for recovery, and leave it to you to…
It’s been a solved problem from the time it launched: you should never have one FIDO device since that leaves no room for failure. Every service I use except Amazon implemented this correctly[1] and the significant security improvements over TOTP or SSH keys are worth it, especially since phishing operations commonly bypass the easier schemes now. 1. You’ll need to find a notary if you lose your AWS MFA device
So that means keeping two or more devices in regular use. Somehow, without carrying them both around or keeping them in the same places. Tricky.
Earlier quoted context omitted.
It’s been a solved problem from the time it launched: you should never have one FIDO device since that leaves no room for failure. Every service I use except Amazon implemented this correctly[1] and the significant security improvements over TOTP or SSH keys are worth it, especially since phishing operations commonly bypass the easier schemes now. 1. You’ll need to find a notary if you lose your AWS MFA device
I wouldn't be comfortable with one backup device kept in secure storage somewhere. If it fails you won't know, and you'll be operating without redundancy without knowing. So that means keeping two or more devices in regular use. Somehow, without carrying them both around or keeping them in the same places. Tricky.