311–320 of 371 posts
Disclosure: I work for Pramati Technologies which developed and owns ThumbSignin.
Earlier quoted context omitted.
Not remotely. Users can buy Android phones. Having ~50% market share is not a monopoly. Even suggesting Apple has monopsony as I did above is a stretch and is only the case if you define the market based on paying users.
The monopoly/monopsony distinction is pedantry. The important point is that consumers and developers suffer because one company controls access to the lion’s share of a market. That point can be criticized and debated, but litigating semantics makes for boring reading and anyway it’s off topic.
Expecting people to be in the general ballpark of the definition of a thing isn't pedantry. It's kind of hard to have any sort of meeting of the minds when people ignore even the basic premise of a term.
So happy Apple decided to go with an open standard here rather than something proprietary. This is good news for the FIDO2 ecosystem and I hope this leads to far greater support for FIDO2 authenticators of all types. There is another world in which Apple just pushed 'Sign in with Apple' and created yet another federated identity provider rather than true, 'secure element'-based FIDO2 authentication.
"Sign in with Apple" requires a developer account with Apple. Having saw Epic's developer account terminated by Apple, I would definitely stay away from any "Sign in with Apple". (FWIW, the only 2fa with "Sign in with Apple", if you don't own any Apple hardware, is SMS.)
Earlier quoted context omitted.
> Since I have zero need to deliberately violate Apple's App Story policy, I don't worry about this overmuch. That may be true today, but their policies are a moving target. Who knows what they'll be like in a year's time?
> That may be true today, but their policies are a moving target. Who knows what they'll be like in a year's time? Likewise Google, Facebook, or any site/ API that a developer deals with on a daily basis. I wouldn’t bet my company on any sign in with _____ service. I just feel the trade-offs with Apple’s sign in versus Google/ Facebook to be less bad. With any of the services, I might do something that causes me issu…
With Google Sign-In, you get an email address. If push comes to shove, you rip out the Google code and email everyone a traditional password.
Earlier quoted context omitted.
I dunno. I mean, I do, it feels good. But it also is a very different kind of FIDO2 than what we've seen before. In a way that FIDO was designed for, that we hoped would happen. But it's still not entirely joy & mirth that we're here for me. It feels like a little like the first day we start to understand how "Big Tent" (in the OpenStack sense) FIDO2 ecosystem is. You can do whatever, make anything, and call it FIDO2…
So what exactly is the concrete downside here, apart from the icky word "platform", that, in this context, means "a security chip that's not removable", ie as opposed to a Yubikey or such.
Earlier quoted context omitted.
I really hate the "we're going to send a code to your email" approach because it so often breaks. Case in point, I tried to log into Patreon earlier today, they insisted on sending a code, and it never arrived. I tried several times, no email. I have a record of every email sent to my address for the past several years regardless of spam status so I can be 100% positive they simply never sent it. In the end I had to…
I'm curious -- do you host your own email, or use a lesser-known email provider? I am increasingly seeing failures where sites seem to be blackholing outgoing email, I suspect based on the destination domain, and unaware that they are even doing this / extremely insistent that they are not. I've gotten login-email failures like you describe from a couple of sites, and seemingly similar failures from those "email your…
Earlier quoted context omitted.
Removing is covered in the article: > Credentials can only be cleared for all via Safari > History > Clear History… on Mac Safari or Settings > Safari > Clear History and Website Data on iOS & iPadOS.
Thanks for the quick response. I thought I tried that and just made sure I did. The following did not work for me: Settings > Safari > Clear History and Website Data > Searching for "passwordless.dev" > Edit > Removing the "passwordless.dev" row. The two accounts are still there when reopening passwordless.dev and clicking on "Sign in". I'm probably missing something obvious. Edit: Oh. I guess the "for all" in the ar…
Cmon apple, just add NFC to macbooks already. Fido cards are the most obvious solution to this.
Earlier quoted context omitted.
Please please please be true. TouchID is objectively superior to FaceId, by a long shot. It is my soap box... but TouchID RARELY failed and could be activated BEFORE you had the phone in front of you. FaceID fails constantly and MUST be in view to start the unlock process. TouchID has a single failure mode (and a half) that isn't that common. Wet / dampness. Solution, dry your finger, try again. Gloves are the 'half'…
I live in a cold climate, so I was happy to be done with TouchID. Then coronavirus happened and now it doesn't recognize me with a mask on.
Earlier quoted context omitted.
Epic did say it was going to be terminated, presumably as part of the overall account termination. They then updated that it would continue to work. https://www.theverge.com/2020/9/10/21431396/epic-sign-in-wit... Apple commented they weren’t doing anything to stop Sign In with Apple working, but I have to wonder if there’s a lie of omission in there. Like “We aren’t doing anything deliberate to stop it, but it’s goin…
unnamed sources have said that Epic was outright lying https://daringfireball.net/linked/2020/09/29/epic-games-unre... > multiple sources at Apple told me Epic’s claims were simply false. There was never a September 11 deadline for their SIWA support to stop working, and in fact, Apple’s SIWA team performed work to make sure SIWA continued working for Fortnite users despite the fact that Epic Games’s developer accoun…