• 0 Posts
  • 31 Comments
Joined 1 year ago
cake
Cake day: August 3rd, 2023

help-circle

  • I’m not saying it’s different. I’m saying that the current plan in no achieves the goal of keeping the fediverse open and out of the control of large corporations.

    If you want to know how to prevent them from taking control, you better start working out the specifics of how they will do that. Otherwise your actions may end up helping them.

    No one seems to have considered the possibility that Facebook are well aware of what people think of them. That they looked at the technology and thought “we don’t have to do anything, those idiots hate us so much they will do the job for us and give us the private marketplace we desire”














  • Which just had some leaks about how insecure it is.

    Windows Hello didn’t. The hardware wasn’t implemented correctly allowing the authentication to be bypassed. You misunderstood the issue here

    They sync shit using iCloud…

    They sync the public key with iCloud, not the private key. You misunderstood how it works.

    It doesn’t matter how many keys deep you have to go.

    There is no “keys deep” there is a public/private key pair that authenticates a single device with a single account. You have misunderstood how a local key store works.

    The compromised item is already obtained when you obtained the device.

    Which means someone trying to access my account requires physical access to my device. Passwords, no matter how strong leave you open to remote attack.

    Can you tell me the process to revoke the private key from your fingerprint reader on your phone?

    Open the authencator app and remove the account. Or uninstall the authenticator app. Or delete your local phone account. Or factory reset if you want to go nuclear.

    Alternatively if you lost your phone, go to the account online. Browse to the security section and delete the device from the list. Most services have the ability to sign out remotely. All that’s doing is revoking the key. The phone doesn’t have to do anything. The fact you think something needs change in the “blob” shows you do not understand how encryption works.

    If I were to bump into you, and lift your phone.

    Again physical access, not remote access. Much smaller attack vector than a password.

    It puts all the power into another companies hands… and takes ALL of it out of yours.

    You think passwords take power from the company that stores your passwords remotely? You have no idea how they are storing that password. You don’t have to trust the company, you just have to trust the open standard these companies are implementing and that public/private key encryption is the standard used to secure the entire Internet.

    Also, whats more likely… that you break a device or that a user CANNOT learn how to use a password manager?

    Virtually no one uses a password manager. It’s too much hassle.



  • No, wrong. Still two factor because your fingerprint plus your device.

    These authentication methods aren’t as simple as the two factor Google Authenticator 6 digit number. They are cryptographically secure keys. Even if someone finds out what the token is, they still cannot send a valid request because they cannot generate a digitally signed request using the private key locked in your device’s hardware, unlocked by your biometrics.

    Passwords are inherently insecure and relatively easy to break. Digital signatures and secure tokens are almost unbreakable



  • My point is that I’m not worried about the relatively few people who could steal my fingerprint. I’m worried about the millions of people around the world who will try to steal my passwords and access my online accounts.

    If everyone secured their accounts with a biometrically secured security key, they would be far more secure than if they continue to just use a password.

    Tgose who go around spreading misinformed FUD over biometrics ensure people who don’t know better continue to use weak passwords.

    Even if someone gets your fingerprints from the OPM breach still can’t use them because they also need your phone. You are still protected from all of the hackers around the world.