3 ms·

So what other options do we have available? We have tried client certificates, hardware tokens, biometrics and a tonne of heuristics. None of these could do muc

• UncleMeat 5y ago
  Webauthn works. You cannot sign a message for the wrong origin. The core problem here is that everybody needs access to some sort of hardware to do this and they need systems to handle the inevitable loss of that hardware.
  • withinboredom 5y ago
    Literally Windows and MacOS has this built-in. But you’re right, the hard part is losing the token or it breaking. I slammed one Yubikey in a door, breaking it in half. I’m on my backup but I still find services where I didn’t enroll the backup and have to go through a lengthy process to regain access to my account (or create a new one).
• jdavis703 5y ago
  Hardware tokens and biometrics are better because it makes it harder for the scammer to describe a plausible scenario to intercept the authentication. In one of the linked articles the scammers pretended to send a one-time token and asked the victim to read it back. This is the same process my top-10 US-based bank uses, so it wouldn’t necessarily raise any red flags.