41–50 of 52 posts
Earlier quoted context omitted.
I use Google Two-Factor authentication. I need my password, and my phone. If I root your box, and watch you type, I have the password to your password manager, and the password database.
Arguably, if you root someone's box you could install a modified TLS stack that would allow for a MITM attack to capture the 2FA login flow. (But this would be obviously a little more difficult)
Earlier quoted context omitted.
Yahoo has a good fantasy sports platform. They might be the leader there though espn may have passed them by now.
Under Marissa Mayer's watch, Yahoo has been investing tremendous effort in refining the UX on their web/mobile properties like Yahoo Weather [1], Flickr [2], and Yahoo Sports [3]. Seems like they're giving people a reason to use their products, and then making a play to have an OAuth-level relationship with the users. Maybe they want visibility into how a user authorizes third-party apps (FB gets an awful lot of insi…
Earlier quoted context omitted.
The user's single identity should be owned by the user and managed securely by the browser, not by Facebook or Google.
Why do you think users want to own their identities? Users, when you ask them, want a service that handles the backup and synchronization of their identity between all their devices. Users don't want losing the device their keys are on to mean losing their identity. Users want to be able to join a new device to their identity by just entering their username and password on it. Users want to be able to enter those cre…
It's up to those of us who actually care about such things to give users what they want in a way that gives us what we want.
Earlier quoted context omitted.
Under Marissa Mayer's watch, Yahoo has been investing tremendous effort in refining the UX on their web/mobile properties like Yahoo Weather [1], Flickr [2], and Yahoo Sports [3]. Seems like they're giving people a reason to use their products, and then making a play to have an OAuth-level relationship with the users. Maybe they want visibility into how a user authorizes third-party apps (FB gets an awful lot of insi…
Under Marissa Mayer's watch, Yahoo has been investing tremendous effort in refining the UX on their web/mobile properties like Yahoo Weather [1], Flickr [2], and Yahoo Sports [3]. Actually, the recent changes made me quit Flickr. It's now an ugly mixture of new and old (especially if you use the organiser, etc.) and when you are logged in (which is likely when you use Flickr) you get an unremovable, ugly, purple Yaho…
Unless I really, really, really want to use a service, I only use it if I can login with gmail or facebook. I don't have time for your shit registration form or strange password requirements. I'm always logged into gmail and facebook, so those are always one-click accounts for me. I understand wanting to become the identity provider, but the ship has sailed here.
I use Chrome for accessing gmail, facebook, twitter, and linkedin - always logged in. For everything else I use Firefox with strong privacy settings. No overhead for me to do this, and this seems like a reasonable middle-road for privacy.
But it seems they wanted me to sign up for an account first on recode. sigh
I thought LiveFyre was going to handle that. Hitting back also meant I lost my message.
Earlier quoted context omitted.
It's not popular but I think Yahoo Mail is way better than a lot of people give it credit for as well.
A brief bit of googling shows Yahoo mail has similar numbers of users as Hotmail and Gmail, somewhere between 200-400 millionish, hard numbers aren't often announced. So it's popular, though has lost it's top spot.
I wonder how many of the 10 remaining Yahoo users will be inconvenienced by this. Seriously though, this is a good thing - third party sign in is a horrible idea and should die.
Why is it a horrible idea? I worked on the Site Integrity team at Facebook and I can assure you that protecting people's accounts from attackers is a fundamentally hard problem that very few companies are actually equipped to handle.
I wonder how many of the 10 remaining Yahoo users will be inconvenienced by this. Seriously though, this is a good thing - third party sign in is a horrible idea and should die.
Third party sign in might not be ideal, but having to register for every crappy service and website is much much worse. And flickr or tumblr have quite a bit more users than you've guessed.
Having a different password for every service is more secure than one for everything.
Earlier quoted context omitted.
Third party sign in might not be ideal, but having to register for every crappy service and website is much much worse. And flickr or tumblr have quite a bit more users than you've guessed.
That's why people have KeePass, or even LastPass if they are overly trusting of third parties. Having a different password for every service is more secure than one for everything.