181–190 of 392 posts
Earlier quoted context omitted.
At the very end, as possible alternatives to the hell they're describing.
Yeah and would passkeys themselves prevent the session from expiring? Notion et al can still have short lived sessions on their client apps.
When you say passwordless in this day and age my thoughts go straight to hw keys.
And speaking of hw keys I started using one alongside my gpg password for my personal password manager a year ago.
After 1 year I removed the hw key from the list of keys.
My experience is that it's more of a hassle to reach for a hw key every time I need to view a password, than it is to just enter a very long passphrase.
I'm of course special to be able to remember multiple very long passphrases, but as long as I do it's much more convenient.
Then it also got me thinking, what if I had gone 100% hw key and lost the key? Then my passwords are lost forever. It's much harder to lose the passphrase in my head.
We are going way over the top with 2FA. Why do I need to activate mandatory 2FA in services like GitHub repositories for hobby projects? It's a lot of extra effort for a questionable security improvement, and anyway, if someone impersonates me there, it's not the end of the world. If they care about end users (which my projects mostly don't even have) mark me as "unverified" or something, but let me avoid the hassle.…
Earlier quoted context omitted.
Payment gateways (paypal, apple, google), in general, do NOT let you cancel individual services and are linked to your CC. Vendors (I'm looking at you, Audible!) constantly hide their account termination under layers of dark patterns. For awhile, I had several ghost subscriptions that I a.) didn't want and b.) couldn't cancel. My credit card card [1] has fundamentally changed my online purchasing experience as it bri…
I've been using Privacy.com for this "create single use credit card" for years now. They make money via the interchange fees, afaik, and not by selling your data stream.
> Gileadite soldiers used the word "shibboleth" to detect their enemies, the Ephraimites. The Ephraimites spoke in a different dialect so that they would say "sibboleth" instead. Experience : you just had to say a word. Security : there's a single word to authenticate multiple users and it can be cracked by learning how to spell it. Although that's roughly how the Wikipedia entry[0] summarises it, the actual wording…
And, importantly, they would not even have realized that they were saying it wrong, because they would have been unable to hear the difference.
As a modern example: I have an acquaintance from Tonga. At some point she got very frustrated with the people around her who didn't understand what she meant by the "rittel bin". She finally pointed at the trash can.
"Oh, the litter bin!"
"That's what I said, the rittel bin!"
In Tongan, l and r are the same phoneme, and native speakers cannot distinguish them without practice.
> Gileadite soldiers used the word "shibboleth" to detect their enemies, the Ephraimites. The Ephraimites spoke in a different dialect so that they would say "sibboleth" instead. Experience : you just had to say a word. Security : there's a single word to authenticate multiple users and it can be cracked by learning how to spell it. Although that's roughly how the Wikipedia entry[0] summarises it, the actual wording…
So when a Bengali is reading the verse, what they’ll speak can be basically “they said, ‘Then say “Sibboleth”’, and he said ‘Sibboleth’ because he couldn’t pronounce it properly”.
I understand the frustration with login systems, but why is the title "Passwordless: A Different Kind of Hell" if it doesn't talk about passwordless authentication, like passkeys, magic links, and biometrics?
Biometrics are a convenience feature, not a security feature.
Fingerprints are trivial to lift and replicate. Face unlocks can be fooled by pictures, or in some cases, get false positives from people that just look enough like you (which is common in some Asian countries). Even if it requires you to blink, new AI tools will easily generate a video of you looking around and blinking.
But the worst part about it all, is that biometrics are a password you can't change without surgery.
I really REALLY wish "biometrics" would stop coming up as a solution to security.
Earlier quoted context omitted.
Amazon is probably the lowest and will stay so for a while I guess. They didn't cling to their one click patent for nothing.
Dominos has the best checkout experience I ever experienced online. Nothing can beat it IMO, at least nothing I came across. Now they only sell (arguable mid) pizza, but when I order there it’s delightful (to use an overused 2023 marketing buzzword)
We are going way over the top with 2FA. Why do I need to activate mandatory 2FA in services like GitHub repositories for hobby projects? It's a lot of extra effort for a questionable security improvement, and anyway, if someone impersonates me there, it's not the end of the world. If they care about end users (which my projects mostly don't even have) mark me as "unverified" or something, but let me avoid the hassle.…
Just turn on Passkeys on GitHub, then you don't need 2FA/TOTP. It's also faster.
Seems to me, and I may not understand it, but it seems to me that Passkeys are more of a way to eliminate having to constantly re-enter you password, but do not eliminate passwords.
For example, if I set up a Passkey, that's bound to a specific machine/browser/phones/whatever. But if I log in from another device, there are no Passkeys, so I just need to use my password. If my lose my machine/browser/phone, I'm in the same boat -- new device, and I need to login. Thus the password.
I don't use any syncing system, I'm not on iCloud, or use apps, or anything like that, so there's no mechanic for distribution of passkeys. Plus that wouldn't work if I wanted to log from my friends laptop, or something like that.
Am I mistaken in how this works? How does enabling Passkeys eliminate 2FA?
My issues with 2FA aren't so much the 2FA part (yea, it's a pain in the neck, "one more step", etc., but, it is what it is). My issue is that if my 2FA is lost, and my recovery codes are lost, I'm toast. There's no other way to recover. No other mechanic, at least for Github.
Earlier quoted context omitted.
With a yubikey everything is stored on the key and the phone is just a terminal, so it travels between phones. Now if you lose the key that's another issue :)
Sure, so same problem. Less likely your yubikey will be stolen I guess, but less convenient too (something else to carry)