51–60 of 107 posts
how do you type sign language
E.g. for one of the systems in the article:
> It is written left to right, and uses subscripts, superscripts and diacritics. Each sign is written in this order: handshape, orientation, location, actions.
Here's a question spurred by the post. Who administers and issues VINs? I assume VINs are the same throughout the world. Is there some sort of worldwide regulatory body, or is compliance by manufacturers simply a gentlemens' agreement?
Worst I've seen by far for getting into a desktop banking website recently, it felt like a parody: 1. On desktop: Enter username and answer to a random memorable question like "your first pet" (password manager will probably fail to autofill this). You're then prompted for a "mobile security code". 2. On mobile app: Enter username + different password. Need to scroll, tap 7 items and then enter a password to get a mo…
Sigh. We're working to normalize better UX around account security at https://clerk.dev It's a sordid affair, but we're making progress. We've reduced our average time to sign-in by about 20% since our launch 6 months ago. (There's nothing to say our starting point was very good, but we do think about this very consciously.) If you're working to improve your sign-in flow, our biggest wins so far have been: - OAuth bu…
So it's slower now, or did you mean to say you've reduced the time to sign-in?
Earlier quoted context omitted.
I personally use 1password for authenticator codes - highly recommend if you haven't seen it: https://support.1password.com/one-time-passwords/ Edit: Didn't answer the actual question - it's something we can look into. My instinct is that offering this wouldn't drastically change the security model, as long as we can be confident your password actually came from a secure password manager. Since some password managers…
But doesn't this completely defeat the purpose of the codes, since they're no longer a second factor? I'd rather just not have the codes, as they're still a significant annoyance with next to zero benefit.
Aside from that, though, I think it's reasonable to argue that the security of password+code in 1password is equivalent to just password in 1password.
Worst I've seen by far for getting into a desktop banking website recently, it felt like a parody: 1. On desktop: Enter username and answer to a random memorable question like "your first pet" (password manager will probably fail to autofill this). You're then prompted for a "mobile security code". 2. On mobile app: Enter username + different password. Need to scroll, tap 7 items and then enter a password to get a mo…
Sigh. We're working to normalize better UX around account security at https://clerk.dev It's a sordid affair, but we're making progress. We've reduced our average time to sign-in by about 20% since our launch 6 months ago. (There's nothing to say our starting point was very good, but we do think about this very consciously.) If you're working to improve your sign-in flow, our biggest wins so far have been: - OAuth bu…
> We've reduced our overall sign-in speed by about 20% So it's slower now, or did you mean to say you've reduced the time to sign-in?
Worst I've seen by far for getting into a desktop banking website recently, it felt like a parody: 1. On desktop: Enter username and answer to a random memorable question like "your first pet" (password manager will probably fail to autofill this). You're then prompted for a "mobile security code". 2. On mobile app: Enter username + different password. Need to scroll, tap 7 items and then enter a password to get a mo…
You know the type: "What's your favourite animal?", and other easily-guessed and easily obtained information hackers can use.
I always put in some gibberish by mashing the keyboard and make sure to record them somewhere safe just in case I need a password reset. I memorise my password and that should be fine, right?
Well, I was overseas with just my phone available to me, and one of the banking apps refused to let me use my valid password without also entering my password reset answers!
They misused the value I was only expecting to need for a reset for access.
I was totally locked out of my bank account with no recourse until I got back home and could look up the gibberish string used for the answers.
my bank insisted that i add a phone number to my account when i called them today. i declined and when pressed briefly explained sim swapping and declined again. a glaring and obvious flaw in the integrity of using a phone number for id verification was not even in the lexicon of this establishment that safeguards nothing less than all of my literal fucking money. they then went on to find that i actually did have a…
And even those of us with strong passwords, and a strong understanding of cyber security, are vulnerable to phishing and other attacks, that can be defended against by using MFA.
Obviously MFA can be taken to ridiculous "ten factor" extremes. But sticking with, or going back to, just passwords, isn't the solution.