You are a pavlovian dog, 2FA is just reporting to uncle Sam,
It binds the biologic to the transaction, no plausible denieability.
Great for securely buying Pizza but not so much for the future of humanity.
Passwordless: a different kind of hell?
201–210 of 392 posts
Re: Passwordless: a different kind of hell?
#202I have 743 login credentials (1984-present). Trusting 743 “randos on the internet” to safeguard “my” data, and give me access to use it. Insanity. Agent-Centric systems where I retain signing keys to authorize access to (and transactions using my) data are the way forward. A Key Fob (like you have for your car) is not onerous, and methods for recovery using trusted community members is practical. Holochain (and the H…
My main issue with Holochain and agent-based systems is that I am the agent, but the system is built around my singular device being the agent. Now the work on linking my devices and convincing other "agents" in the system that these collections of keys represents "me" is forced back onto me.
In other words, agent-device-based identity is a crappy experience for some mixture of end-users and/or devs. Either the user has to manage muiltiple identities, or the devs have to build an ad-hoc identity systems on top of the agent-device-based system.
I think PGP got about halfway there, but falls short in a lot of ways.
Re: Passwordless: a different kind of hell?
#203I recently ordered something on ebay. Nothing expensive, just a £60 item, and delivered to an address I've ordered many things to in the past. First I had to log into ebay - no problem, got my password manager right here, as soon as I unlock my phone with my fingerprint. Now I'll just key in my 12 character, randomly generated password with mixed case letters, numbers and symbols. Then ebay decided they wanted to sen…
Apple makes this experience as seamless as I think it possibly can be. (As long as you use Safari...). All my passwords synced across all devices all the time, instantly available with faceID or or my fingerprint. Apply pay makes checking out of most online retailers as fast as using my fingerprint or double-clicking the side button on my phone. Passkeys generally starting to replace passwords on many major sites, ma…
How does that work if you want to get an android phone or Samsung tablet or windows laptop at some point?
Re: Passwordless: a different kind of hell?
#204Earlier quoted context omitted.
TOTP backups from phones is a major issue, from what I can tell you simply can't do it.
It's the Google Authenticator app's fault. The most popular TOTP app probably, and for a long time, they were saying it's intentionally designed not to let you copy the codes. Now you can, but there are lots of pitfalls and vague documentation. I'm not convinced that TOTP is a user-friendly design to begin with, but it didn't have to be this bad. I don't fw TOTP now. There are other apps, but I'm done. I'll only use…
The iOS Keychain already supports TOTP.
Re: Passwordless: a different kind of hell?
#205anything other than username/email + password is stupid bullshit, i don't care what any cybersecurity nerd says.
Re: Passwordless: a different kind of hell?
#206We are going way over the top with 2FA. Why do I need to activate mandatory 2FA in services like GitHub repositories for hobby projects? It's a lot of extra effort for a questionable security improvement, and anyway, if someone impersonates me there, it's not the end of the world. If they care about end users (which my projects mostly don't even have) mark me as "unverified" or something, but let me avoid the hassle.…
Github 2FA is made extra fun because they only offer a single mechanic of replacing it (that I know of), and that's using the recovery codes. So, they forced me to use 2FA, and I dutifully printed out the recovery codes (don't write down your passwords, that's bad practice, but here's 20 recovery codes that stand between you and losing your account forever, so you know, manage that somehow). When I bought a new iPhon…
there are other methods for 2fa recovery. The main one involves an SSH key you've previously added to your account.
Re: Passwordless: a different kind of hell?
#207Earlier quoted context omitted.
You don’t have to give Apple your data. It uses information stored on device.
Seems like parsing semantics. "Pre-given them" - are you giving it directly to apple.com? No. You're putting in your hardware, true. And... somehow... it makes it to all your other apple devices.
It's just a credit card though? Seems like a weird distinction when those details are intended to be given out. I presume if you're using one-time cards you're not using Apple pay at all. Plus you need the CVC code and such to re-auth them on new devices.
Apple has issues with privacy, but I don't really see how this is one of them.
Re: Passwordless: a different kind of hell?
#208I understand the frustration with login systems, but why is the title "Passwordless: A Different Kind of Hell" if it doesn't talk about passwordless authentication, like passkeys, magic links, and biometrics?
> biometrics Biometrics are a convenience feature, not a security feature. Fingerprints are trivial to lift and replicate. Face unlocks can be fooled by pictures, or in some cases, get false positives from people that just look enough like you (which is common in some Asian countries). Even if it requires you to blink, new AI tools will easily generate a video of you looking around and blinking. But the worst part ab…
Low security is security too. Biometrics can useful when used for appropriate applications. They're very useful in applications where authentication would be otherwise be omitted or undermined due to usability concerns. They can also be used in conjunction with other authentication methods to complement the flaws of other authentication methods, like passphrase or token, which can be shared more easily.
Like with many things pertaining to security, there are no universal solutions without first defining the problem.
Say for instance, you have an access control system where you want to solve the issue of credentials being intentionally shared. Biometrics are a great solution for this; tokens and passphrases are not. You need different tools for different problems.
Re: Passwordless: a different kind of hell?
#209Earlier quoted context omitted.
Payment gateways (paypal, apple, google), in general, do NOT let you cancel individual services and are linked to your CC. Vendors (I'm looking at you, Audible!) constantly hide their account termination under layers of dark patterns. For awhile, I had several ghost subscriptions that I a.) didn't want and b.) couldn't cancel. My credit card card [1] has fundamentally changed my online purchasing experience as it bri…
>Payment gateways (paypal, apple, google), in general, do NOT let you cancel individual services and are linked to your CC. Paypal absolutely lets you stop recurring payments unilaterally on their side. I use Paypal for subscriptions wherever it's offered precisely for this reason. https://www.paypal.com/us/cshelp/article/what-is-an-automati...
Apple also lets you do this.
Re: Passwordless: a different kind of hell?
#210anything other than username/email + password is stupid bullshit, i don't care what any cybersecurity nerd says.
Freakin Chipotle has mandatory 2FA. Blows my mind how thoroughly I need to authenticate myself to order a dang burrito.