4 ms·
In the end what you say is really "I trust more my device and vendor then myself". Not really a concept I accept... Of course too many lusers use IT devices ev
by xte 8y ago
In the end what you say is really "I trust more my device and vendor then myself". Not really a concept I accept...
Of course too many lusers use IT devices even for serious work but consider their "luser" characteristic as a natural fact and instead of education prefer trusting a vendor for me is like preferring a dictatorship hoping that "it will be a good one" because people are not adult enough to be in a democracy.
A small classic example we all know "ok, you are authenticated because you have entered the correct username & password, now prove it a bit more typing an OTP I send to your mobile via SMS" can be easily read as: "I do not trust enough you because someone may have steal user & password BUT I consider enough unlikely that he/she/it steal also your mobile" and as a consequence it means that carriers/phones are considered more trusted than humans being. Not a good thing for me, not a thing I can accept despite, in limited case have some points.
Also I do not want my carrier know all the service I use and when I use them, it's a significant metadata leak that may be irrelevant in single case but may became relevant in other cases.
- ubercow13 8y agoSo write down the secret OTP key, do the crypto yourself with a pen and paper, or failing that with any device (laptop, hardware TOTP device) you own, using open source software, or build your own using the standard. It's nothing to do with your phone or carrier.
- xte 8y agoI simply do not need such kind of authentication for myself, at least I do the best to avoid such need. Try to think of a Plan9-like world, which means user-centered not "modern mainframe centered". We still need services, but there is no need to have them like today.
- hirsin 8y agoSo don't do SMS OTP and use an authenticator app instead, which is more secure. And inflammatory comments aside, yes, any good IT org should believe that it's more likely for a user to be phished and give away their super secure xkcd based password than it is for a nation-state attacker to target their phone OS with a 0day.
- xte 8y agoTry to think about different scenarios: first not a nation vs nation attack but a simple dictatorship attack against some opponent, something like "hey see! This bad guy have done many criminal thing". Also think about what kind of situation we have today with anything based on few proprietary hardware and software commonly used anywhere. After think about ancient Plan9 model which put your personal workstation at the center of the world and "services" only as "addition" to it. In this scenario need of auth, risk of phishing etc substantially vanish.