51–60 of 71 posts
Right now, I am apprehensive about anything Google related. Even about anything big tech related. How is this going to be used to limit our rights and track all our movements?
Earlier quoted context omitted.
[flagged]
> You all don't understand how any of this tech works but you think you do. We do; and it is specifically called out in the spec that the certificate chain is not submitted, due to the potential for overpowered fingerprinting. As such, this battle, should they make a move to change that, needs to be fought a different day. Fighting against hypotheticals is pointless. Edit: For the pedantic, fighting against hypotheti…
The first sentence > HTTP cookies were never intended for session management Seems odd. IIRC that's exactly what they were meant for. State management for http which is stateless. Am I missing some history here?
I could be wrong, but I believe the author is referring to cookies being used for session authentication as opposed to general session management.
The "abstract idea" of a cookie is an identifier that it lets a server consider requests within a larger series of requests by the same person, but the fact that it can do that at all also meant that it solved the whole "how do we know whether this user is logged in without every page request after login needing to be a POST that includes the user's name and password again".
Unless you're paying me a lot of money (and even then) I WILL NOT MAINTAIN AN HSM FOR YOUR SERVICE. PLEASE FUCK OFF. If you cared about security you would let me authenticate with ssh key signatures. GitHub does this, if you can manage to talk to an HSM you can manage to talk to the openssh agent.
Unless you're paying me a lot of money (and even then) I WILL NOT MAINTAIN AN HSM FOR YOUR SERVICE. PLEASE FUCK OFF. If you cared about security you would let me authenticate with ssh key signatures. GitHub does this, if you can manage to talk to an HSM you can manage to talk to the openssh agent.
[flagged]
>If you want to write your friends a message
Then I will use email as I do today. It works, it's universal, and it's free of this kind of bullshit (which is why they push everyone to use other things.) I even went on a date last weekend I set up over email (and it's far from the first.)
Again, fuck off.
Earlier quoted context omitted.
[flagged]
No I just won't use your crap. The value proposition is already marginal almost all the time, this tips over to "absolutely not, fuck off" territory. >If you want to write your friends a message Then I will use email as I do today. It works, it's universal, and it's free of this kind of bullshit (which is why they push everyone to use other things.) I even went on a date last weekend I set up over email (and it's far…
Funny how we're going back to AOL times: fenced off network, pay-to-play. We've required ISPs to play fair though net neutrality only to have similar barriers put in place a decade later by upstream software incumbents.
This will break and fracture the web. Unfortunately many here have much to lose by criticizing google. I have just spent 8 hours today updating my apps on the google play store, answering business emails on my google email account and updating customer tracking data on google analytics and updating their google ads. If they decide to make an example out of me, to teach the rest of you how to behave, I am screwed. I g…
Earlier quoted context omitted.
> valuable security improvements Valuable to who, exactly?
To everyone who has ever had session creds stolen? Right now any malware which can read your disk has a gigantic backdoor around MFA, do you not find that a problem?
In other words - focus on solving the real issue (ability to give more fine-grained permissions to programs) rather than restricting the ability of users to do what they want with credentials they already have on hardware they control.
[flagged]