3 ms·
I think the problem here is that it's training end-users to step outside of the normal security practices and normalizing that behavior. In the same way that mo
by ddtaylor 6y ago
I think the problem here is that it's training end-users to step outside of the normal security practices and normalizing that behavior. In the same way that most reputable companies would tell you "We'll never ask you for your password" and over time that has been well relegated to scammer-only territory. What if one day a company said "Hey, we're just gonna ask for your password this one time, but it's okay" - it mostly defeats the entire purpose of the protection scheme if users can easily be duped into not following it.
- fastball 6y agoRight, but what is the solution if this "normal security practice" relies on having a 3rd party sign your stuff but they refuse to do so, for non-security reasons?
- cheaprentalyeti 6y agoOnce again, it's demonstrated for us, trusted third parties are security holes.
- Animats 6y agoThat's my point. This is just a slow migration to a new version, not something urgent. There's no reason to bypass normal procedures.
- nullc 6y agoThe old releases on the site are broken even worse, because they're signed with a revoked certificate. Getting something unsigned up was a strict improvement, particularly because there is no ETA for getting this fixed.