5 ms·
> Not sure what security experts they talked to https://www.eff.org/about/staff/cooper-quintin https://www.eff.org/about/staff/cooper-quintin
by Pfhreak 7y ago
> Not sure what security experts they talked to
https://www.eff.org/about/staff/cooper-quintin https://www.eff.org/about/staff/cooper-quintin
- qw3rty01 7y agoThe article implied he wasn't the only one they talked with. There isn't anything he said that was explicitly incorrect (unlike some of the other unnamed security researchers), but he must not have much experience with credential stuffing incidents given his responses.
- sp332 7y agoAnd here is his take on it. https://twitter.com/cooperq/status/1207780461834977281 https://twitter.com/cooperq/status/1207780461834977281
- qw3rty01 7y agoI really wish this was included in the article, his conclusion makes a lot more sense in that context (though I still disagree with it).
- 55555 7y agoHis take is a result of him trying not to completely let go of the story he's already decided is significant. There is no story. There isn't really a great way to defend against credential stuffing attacks when the adversary has access to a huge residential proxy network and you don't want to greatly inconvenience your users. All major US banks are pretty vulnerable to credential stuffing attacks. If banks aren't going to defend against it, Ring isn't.