381–390 of 399 posts
Earlier quoted context omitted.
It’s cool but until Apple lets Firefox use said keychain I’m not going to use it.
Firefox should have a platform entitlement that lets them just delegate to Apple's implementation when available. This is I believe what they do on Windows.
Earlier quoted context omitted.
It’s cool but until Apple lets Firefox use said keychain I’m not going to use it.
Most people will though, because they’re either in the Android or Apple ecosystems.
Earlier quoted context omitted.
Doesn't work that way. Passwords are inferior but still a strong layer of defense. You are putting all your eggs in one basket again. The lesson from passwords is that a single factor of authentication is inherently inferior to multiple factors of authentication. From a threat actor's perspective, even a yubikey is a matter of one well planned attack (physical, compromised host,etc) and by nature newer factors of aut…
Passwordless is MFA -- something you are and something you have. I'm not a yubikey expert, but I don't believe that losing your Yubikey will open up your company to a breach. For a typical passwordless solution, losing your phone isn't a risk, given that no one can reproduce your face or thumbprint.
Earlier quoted context omitted.
Passwordless is MFA -- something you are and something you have. I'm not a yubikey expert, but I don't believe that losing your Yubikey will open up your company to a breach. For a typical passwordless solution, losing your phone isn't a risk, given that no one can reproduce your face or thumbprint.
Your face and thumbprint can easily be reproduced. There is even a guy that took a photo of a politicians' finger from a mile away and used that to forge their fingerprint. Even without going technical your dopplegangers can bypass face auth lol. You can guess spray pins and push notification codes. The one thing you can count on is someone will find a way around any good passwordless solution. For example, there is…
Earlier quoted context omitted.
Passwordless is MFA -- something you are and something you have. I'm not a yubikey expert, but I don't believe that losing your Yubikey will open up your company to a breach. For a typical passwordless solution, losing your phone isn't a risk, given that no one can reproduce your face or thumbprint.
Your face and thumbprint can easily be reproduced. There is even a guy that took a photo of a politicians' finger from a mile away and used that to forge their fingerprint. Even without going technical your dopplegangers can bypass face auth lol. You can guess spray pins and push notification codes. The one thing you can count on is someone will find a way around any good passwordless solution. For example, there is…
Earlier quoted context omitted.
Cooperative Customers are members/owners. Examples: Tessitura, NISC
Someone posted this list of such co-ops recently: https://tech-coops.xyz/ Is it true that they couldn't sell out though? I imagine if the buyer offered a pile of money then the majority of the owner-workers would go for it, even at the expense of the users.
I think that a worker-owned cooperative is not really in line with what I would consider to be the traditional cooperative spirit.
Customer-owned has a clear mission to deliver value to its owners. That value would be to provide various services essentially at cost. Workers are paid market rate to get the work done. Profits are given back to the owners (customers).
Worker-owned also has the mission to deliver value to the owners. The workers are going to value making as much money as possible, though being careful to not go past the point where they would find themselves without a job. So this type of co-op will be trying to extract maximum value out of the customer. This is a significantly different proposition. This type of co-op seems more like a company with an ESOP.
I could see either type choosing to sell out. I guess either the workers or customers would think they have better places to invest the capital. So I guess co-ops too have up and down lifecycles like a standard company. As the co-op becomes ineffective or no longer needed, the capital invested in it would be re-deployed.
Could someone clarify what the relationship between passkeys and WebAuthn is? Is it that Passkey is the Apple, Google, Microsoft implementation (commercialization?) of WebAuthn? If so, does it add anything on top of WebAuthn that makes it differ in some fundamental way? Also, are passkeys how WebAuthn is most commonly actually used in practice? Apologies for the noob questions.
We wrote a long post on Passkeys, in particular how they are implemented by Apple[0] that might be interesting. Technically a Passkey is just a multi-device FIDO credential that is compatible with WebAuthn (which is an official W3C and FIDO spec). However, vendors implementations of Passkeys/FIDO credentials differ quite widely. The Apple implementation of Passkeys, as an example, doesn't provide attestation informat…
Apple's changes do degrade security, but I think it is important to note that even with those degradations, Apple passkeys are still many orders of magnitude more secure than passwords.
Earlier quoted context omitted.
We wrote a long post on Passkeys, in particular how they are implemented by Apple[0] that might be interesting. Technically a Passkey is just a multi-device FIDO credential that is compatible with WebAuthn (which is an official W3C and FIDO spec). However, vendors implementations of Passkeys/FIDO credentials differ quite widely. The Apple implementation of Passkeys, as an example, doesn't provide attestation informat…
That's a great article, thanks. In fact, it's a fantastic article. I read it a couple of weeks ago, and learned a lot. Thanks. Apple's changes do degrade security, but I think it is important to note that even with those degradations, Apple passkeys are still many orders of magnitude more secure than passwords.
Earlier quoted context omitted.
Yes, according to what 1Password is telling us. But as we've seen, what these companies say and what they actually do in practice are not always aligned. And oftentimes customers are inserting a lot of their own assumptions into the mix, not only with respect to vault encryption but vault storage and operational security.
> Yes, according to what 1Password is telling us With their very comprehensive whitepaper and Charles Proxy you can verify all their claims. Their whitepaper is one of the best resources I have found on E2EE in general. With that, you should be able to write your own 1P vault parser. Then you can verify that traffic to their server is exactly what they claim it to be. In another comment you are criticizing that their…
Earlier quoted context omitted.
Yes. And no, because it depends on how users setup and use their AppleID and its passwords/security/devices. My only point is, if 1Passwords decides to share the private key with [whichever cloud service] the user should at least be notified, or get a choice.
> And no, because it depends on how users setup and use their AppleID and its passwords/security/devices. Can you elaborate what the issue would be? I see that the AppleID password could be a weak link, but that's mostly mitigated by 2FA. > if 1Passwords decides to share the private key I'm not aware that they could do that. Their servers have no knowledge of either the password or secret key. Authentication happens…