3 ms·

> Tried demo on chromebook Sorry never tested on that platform. But web app must be working, just press Cancel if app is not installed. Native app is not requi

> Tried demo on chromebook Sorry never tested on that platform. But web app must be working, just press Cancel if app is not installed. Native app is not required but recommended. It's deterministic - enter same password, get same profile. No sync needed. > That's insulting. Stop that Wait, you seriously feel all these "your password must have x, y and z, confirm it, scan QR, enter digits" as convenient? Don't listen to me: watch any password manager promo video. Everyone in the world knows auth is broken. >That by itself is easy to solve. Generate the password for the user. Yes, but there is goal #2 and others. >Requiring a native app is a disaster. Necessary evil? All password managers are native apps too. >You're confusing out of band authentication with centralization. Verification through central authority API or gateway is also out-of-band, i.e. user<->authority<->server. These terms are not mutually exclusive. >"SecureLogin can't guarantee their native app won't be pulled from Apple's app store." There's no reason for this to happen, it's not an uber :) In App Store soon. >LICENSE.txt not found. Will be fixed. Which one is your favorite?

dismantlethesun 9y ago
MIT license please.
- homakov 9y ago
  Yes, it's good one https://github.com/sakurity/securelogin/blob/master/LICENSE.txt https://github.com/sakurity/securelogin/blob/master/LICENSE....
mankash666 9y ago
Please use the Apache 2.0 license. It's the most practical, unencumbered one, if you truly want wide adoption
- homakov 9y ago
  MIT vs Apache 2.0? I don't want to have any rights or responsibility, just Do Whatever You Want license.
  - hermanradtke 9y ago
    You can license it as both. See https://github.com/hjr3/weldr/blob/master/README.md#license https://github.com/hjr3/weldr/blob/master/README.md#license for reference.
  - espadrine 9y ago
    For this particular situation, I too would recommend Apache 2.0 over MIT. In other words, please do claim that you won't sue over patents, and that you won't be sued over patents.
danjoc 9y ago
>But web app must be working, just press Cancel if app is not installed. I want to try your thing, so I press cancel? That doesn't seem terribly intuitive. I thought your main selling point was usability. >Everyone in the world knows auth is broken. Auth is broken when you have a HIPAA breach. Try explaining how convenience fits in there to someone deciding if you've been negligent. It can mean the difference between prison and no prison. >Necessary evil? The current onboard process hurts conversion, so that's a disaster. Instead, we ask users to download an app, which they don't[1], it hurts conversion, and that's a necessary evil. A rose by any other name... >There's no reason for this to happen Maybe not today. Apple has the power to put any developer on their platform out of business, overnight. Apple could decide to amend their "Application may not download or install executable code" clause to include JS apps that it didn't before. They've wiped out huge swathes of apps in the past. If auth is down, the app/service is down. I'd hate to have a large portion of my customer base wiped out permanently by a policy change at Apple. [1] https://www.recode.net/2016/6/8/11883518/app-boom-over-snapchat-uber https://www.recode.net/2016/6/8/11883518/app-boom-over-snapc...
- homakov 9y ago
  >I want to try your thing, so I press cancel? That doesn't seem terribly intuitive. I thought your main selling point was usability. To be precise that depends on client implementation, we will use a popup that doesn't even redirect anywhere. [1] - exactly my thoughts. Web is a good way to go, but the apps are what many security-minded folks require, so it's both. > Apple could decide to amend their "Application may not download or install executable code" clause to include JS apps that it didn't before I kind of support that anti Unrollme policy. They could outlaw all Cordova apps, but that would be a disaster. It makes me think to make going back to web app easier, will look for a way.
  - danjoc 9y ago
    >will look for a way It's definitely not an easy problem. I hope I haven't come off as too harsh. Client certificates would be great. I think you write off the value of hardware tokens too quickly, but by all means, look at other ways. Auth is one of the first things any of us have to do when putting together a service. This is something a lot of us have studied for a long time. Welcome to the party :)
stephenr 9y ago
> Wait, you seriously feel all these "your password must have x, y and z, confirm it, scan QR, enter digits" as convenient? Requiring certain character classes is not mandatory for a password. The 2FA initial setup could be improved slightly, but it's not that much worse than your entire login flow, and it has actual security benefits. > Everyone in the world knows auth is broken. Well apparently not. > There's no reason for this to happen There's no reason for you to dismiss valid statements about external risks as "There's no reason for this to happen", and yet that happened, didn't it? > Which one is your favorite? I'm sorry, are you analysing the best open source license to use for your code, or taking a lunch order?

dismantlethesun 9y ago

MIT license please.

homakov 9y ago
Yes, it's good one https://github.com/sakurity/securelogin/blob/master/LICENSE.txt https://github.com/sakurity/securelogin/blob/master/LICENSE....

mankash666 9y ago

Please use the Apache 2.0 license. It's the most practical, unencumbered one, if you truly want wide adoption

homakov 9y ago
MIT vs Apache 2.0? I don't want to have any rights or responsibility, just Do Whatever You Want license.
- hermanradtke 9y ago
  You can license it as both. See https://github.com/hjr3/weldr/blob/master/README.md#license https://github.com/hjr3/weldr/blob/master/README.md#license for reference.
- espadrine 9y ago
  For this particular situation, I too would recommend Apache 2.0 over MIT. In other words, please do claim that you won't sue over patents, and that you won't be sued over patents.

danjoc 9y ago

>But web app must be working, just press Cancel if app is not installed. I want to try your thing, so I press cancel? That doesn't seem terribly intuitive. I thought your main selling point was usability. >Everyone in the world knows auth is broken. Auth is broken when you have a HIPAA breach. Try explaining how convenience fits in there to someone deciding if you've been negligent. It can mean the difference between prison and no prison. >Necessary evil? The current onboard process hurts conversion, so that's a disaster. Instead, we ask users to download an app, which they don't[1], it hurts conversion, and that's a necessary evil. A rose by any other name... >There's no reason for this to happen Maybe not today. Apple has the power to put any developer on their platform out of business, overnight. Apple could decide to amend their "Application may not download or install executable code" clause to include JS apps that it didn't before. They've wiped out huge swathes of apps in the past. If auth is down, the app/service is down. I'd hate to have a large portion of my customer base wiped out permanently by a policy change at Apple. [1] https://www.recode.net/2016/6/8/11883518/app-boom-over-snapchat-uber https://www.recode.net/2016/6/8/11883518/app-boom-over-snapc...

homakov 9y ago
>I want to try your thing, so I press cancel? That doesn't seem terribly intuitive. I thought your main selling point was usability. To be precise that depends on client implementation, we will use a popup that doesn't even redirect anywhere. [1] - exactly my thoughts. Web is a good way to go, but the apps are what many security-minded folks require, so it's both. > Apple could decide to amend their "Application may not download or install executable code" clause to include JS apps that it didn't before I kind of support that anti Unrollme policy. They could outlaw all Cordova apps, but that would be a disaster. It makes me think to make going back to web app easier, will look for a way.
- danjoc 9y ago
  >will look for a way It's definitely not an easy problem. I hope I haven't come off as too harsh. Client certificates would be great. I think you write off the value of hardware tokens too quickly, but by all means, look at other ways. Auth is one of the first things any of us have to do when putting together a service. This is something a lot of us have studied for a long time. Welcome to the party :)

stephenr 9y ago

> Wait, you seriously feel all these "your password must have x, y and z, confirm it, scan QR, enter digits" as convenient? Requiring certain character classes is not mandatory for a password. The 2FA initial setup could be improved slightly, but it's not that much worse than your entire login flow, and it has actual security benefits. > Everyone in the world knows auth is broken. Well apparently not. > There's no reason for this to happen There's no reason for you to dismiss valid statements about external risks as "There's no reason for this to happen", and yet that happened, didn't it? > Which one is your favorite? I'm sorry, are you analysing the best open source license to use for your code, or taking a lunch order?