91–100 of 185 posts
2. it only hints at the UI being open to other apps, approved in the app store of course, using their new undocumented api
3. the sharing features will probably happens over their central control. not over the UI implementers.
so many misconceptions in these comments. specially mixing up passkeys with in device keys
Earlier quoted context omitted.
“Need” is a very strong word. Any potential fines will just be rolled into the costs of doing business, and if it’s found to still be worth it they’ll keep abusing user privacy as there is a net benefit profit-wise.
IIRC, the fines are some % of revenue. Basically enough to tap into margins.
From personal experience, businesses I've dealt with in the EU are eager to be compliant as long as it's applied across the board (ie, they aren't losing their competitive advantage).
https://support.google.com/accounts/answer/13548313?hl=en#zi...
Earlier quoted context omitted.
account recovery process
Just chiming in to ask -- the immediate need for account recovery is in cases with lost or forgotten passwords. Am I right in assuming that account recovery becomes a much smaller attack surface when using passkeys? Or are there scenarios I'm overlooking?
Originally seen via https://reddit.com/r/Bitwarden/comments/141uxz1/iosipados_17... This is big news as vendor lock in and inability to use our own sync was one of the biggest issues bought up whenever Passkeys are discussed. Apple are now allowing external sync fabrics such as password managers.
Earlier quoted context omitted.
> Safe from server leaks. Because servers only keep public keys, servers are less valuable targets for hackers. It's still an attack scenario to keep in mind. If a server can be tricked into storing the wrong public key, authentication is defeated.
By the same token, if the server can be tricked into storing the wrong password, authentication is defeated. However, with passkeys, even downloading the entire database doesn't give the attacker any useful credential information. This is in contrast to today, where a database download gives you salted & encrypted passwords that are (generally) knowable (given enough time). I'll take passkeys over passwords any day.
Many focus too much on the (potential) MFA use case rather than the idea that we can use effectively the same tech as in Yubikeys (etc) to make phishing resistant authenticators everywhere.
The (IMO) messy rollout by the major platforms really doesn’t help either. They absolutely could have spent a little more time baking the UX and designing edge case mitigations, but they didn’t.
Earlier quoted context omitted.
> Plaid also relies on entering bank passwords on neobank sites and is widely used. This is an anti-pattern, and is not worth supporting in new tech that's supposed to be "secure first". We already have tech for delegating authorization.
Plaid isn't a solution to a technical problem. It's a way to deal with the fact that banks don't want their customers to bypass their websites/apps and the cross-selling ads within.
One thing I don't understand about offering passkey login for your email is how you would go about recovering an account if you lost access to the device which holds your passkey? Google states: "When you create a passkey, you opt in to a passkey-first, password-less sign-in experience.". This seems to imply that you will not be able to use your old password if you ever lost your phone. Do Google still offer backup p…
Earlier quoted context omitted.
I may be wrong here, but since the yubikey and similar don't actually store anything site-specific, it means they just respond to a challenge, right? What they prove is that they own a specific private key. So if the website bundles its domain in the challenge, it can make sure that the client signed the challenge for itself, and the client can verify that it signs the challenge for the current domain. So now, if the…
FIDO2 allows for things like resident keys, which the Yubikey can only hold so many of. The Yubikey can act in HMAC challenge mode, though, but that's not the mode used on the web.
Earlier quoted context omitted.
I don’t think you are, plaid is a horrible and completely insecure work around banks not providing programmatic access. I’m not sure how it even works with second factors (I’ve never looked).
If you have 2 factor enabled for each login you get told your account settings are incompatible with Plaid and have to disable 2fah. If it's only enabled for first time logins on a new browser/client Plaid ask you for the code. https://support-my.plaid.com/hc/en-us/articles/9098915502999... I don't know for sure how they do it, but it must just be a thousand custom forms and browser automations for each bank they sup…
My credit union doesn’t give a flying fuck about Plaid and it’s a constant cat and mouse game that amuses me to watch. My credit union doesn’t have a path to online banking without per-session MFA.
I think banks should be required to provide a user-opt-in OAuth API for read-only access, but not so that companies like Plaid can pilfer your data.