3 ms·
> An adversary with network access (looking at you, corporate firewalls) Well, if you use corporate device, you implicitly trust them, don't you? Some even sig
by jve 5y ago
> An adversary with network access (looking at you, corporate firewalls)
Well, if you use corporate device, you implicitly trust them, don't you? Some even sign put signature on a paper agreeing what the corporate body can do to you. Perhaps MITM your encrypted traffic with corporate installed root cert or whatever.
Otherwise if you use your own device, in the age of encrypted HTTP and other stuff - No, an adversary or corporate firewall cannot simply read your password.
- blitzar 5y ago> Well, if you use corporate device, you implicitly trust them, don't you Well, if you use microsoft, you implicitly trust them, don't you Well, if you use <insert ISP>, you implicitly trust them, don't you Well, if you use the internet, you implicitly trust them, don't you
- SilverRed 5y agoYes. If you don't trust microsoft and you use windows, than it doesn't matter what authentication system you use. If you used rsa keys for auth then you would still have a problem because microsoft could steal those keys.
- Xylakant 5y ago> Well, if you use corporate device, you implicitly trust them, don't you? Some even sign put signature on a paper agreeing what the corporate body can do to you. Perhaps MITM your encrypted traffic with corporate installed root cert or whatever. I may have to submit to the inspection of traffic whether I trust them or not and even if I trust them to have the best intentions, things go wrong and firewalls get hacked - and all of a sudden that nice capability is in the hands of an attacker. So even if I do trust them, I prefer mechanisms that work asymmetric.