121–130 of 144 posts
Or you can just use https://krypt.co/ which uses the same FIDO standard, is open source, works on both android and iOS (where it actually uses the secure enclave) and both in Chrome and Firefox
Earlier quoted context omitted.
>If someone is an actual security expert, I'd like to know why (1) is an acceptable practice. So your issue here is that Google tells you whether it's a valid email address before you enter in a password? You could validate email addresses yourself by sending out a ton of emails to different permutations of *@gmail.com and seeing which ones come back as undeliverable. An email address on its own isn't inherently priv…
I interpreted the parent's complaint in (1) as the login form having the username/password entries split across two screens, not as a complaint that it tells you the account doesn't exist. AIUI, splitting the entry across two screens like that breaks a lot of password managers, as they can't handle it. This hampers the adoption of password managers, which would largely help the average Joe's security. Google supports…
I'm definitely dumb enough to not realize that email login might be a special case because you can check username validity another way (sending emails). And I didn't know that GSuite had external auth.
These split pages don't actually break lastpass, at least for me. One field is still called username and another is called password, so they fill properly.
Earlier quoted context omitted.
The problem isn't even Google, it's just lack of actual support for services that need it. You have to have the right client, the right device, and every website has to implement it. Government websites won't support it, nor most financial services, your gym, school, job, etc. Sensitive records like your SSN will be kept in walled gardens accessible by a simple user and password, and maybe a security question. Most p…
I'm not sure this is the right perspective. Is it really such a big deal if SSNs get leaked? On the other hand, insecure e-mail has been at the center of massive political upheavals. I think securing e-mail is way more important than even banking information.
For anyone who has or will have people interested in their particular accounts, not just bulk breakin of simple passwords that should be forbidden in most sites, it becomes a much worse risk profile, as you often can't turn off places letting you use that data point as one part of verification.
Earlier quoted context omitted.
Edit after trying: It is a little disappointing that it is Chrome only.
Implementing and maintaining the code in the browser that manages the local BLE channel to a FIDO authenticator is unfortunately a significant undertaking. We (the team behind this at Google) work actively with FIDO and the W3C on the open standards behind this so that other browsers can support this as well in the future.
> We (the team behind this at Google) work actively with FIDO and the W3C on the open standards behind this so that other browsers can support this as well in the future.
Super excited to hear this.
Or you can just use https://krypt.co/ which uses the same FIDO standard, is open source, works on both android and iOS (where it actually uses the secure enclave) and both in Chrome and Firefox
An important caveat with Krypton is that while it is open source, the published source is essentially useless because it is not licensed under a free license.
Earlier quoted context omitted.
Heh, Microsoft seems better than Google to support Linux in new products now. VS Vode is amazing, as is dotnet core. Who would have thought 5 years ago.
Of course they do. This is the “embrace” phase.
Earlier quoted context omitted.
> all you need is an Android 7.0+ phone and a Bluetooth-enabled Chrome OS, macOS X or Windows 10 computer with a Chrome browser
Heh, Microsoft seems better than Google to support Linux in new products now. VS Vode is amazing, as is dotnet core. Who would have thought 5 years ago.
Or you can just use https://krypt.co/ which uses the same FIDO standard, is open source, works on both android and iOS (where it actually uses the secure enclave) and both in Chrome and Firefox
An important caveat with Krypton is that while it is open source, the published source is essentially useless because it is not licensed under a free license.
Having a source publicly available is one of the prerequisites for something to be considered open source, but it's far from being the only prerequisite.
The whole thing (except the UI) is isolated from the phone's OS so that even if your phone gets lost or compromised nobody else can auth as you.