4 ms·

Look up city on social media, buy a VPN. If you're on a mobile network the location is often off by a city or so anyway.

• eikenberry 5y ago
  It's about raising the bar, not making it impossible.
  • tialaramex 5y ago
    Why isn't it about making it functionally impossible? You can break WebAuthn if you can guess a 128-bit AES key. You won't, but it's not impossible it's just astronomically unlikely if everybody spends their lifetime trying. That's why Google gave all its employees Security Keys. Instead of "Well, we spend a little bit of money on some half-solution but we just raised the bar and so we'll have to spend more forever and always risk phishing attacks" they just solved the problem. This saves you extra money because your adversaries stop trying. Not only are remaining attacks unsuccessful, they become much rarer and the associated clean-up (even if it's just helpdesk reassuring employees that although they fell for that scam email claiming to be from HR their credentials are fine) cost is reduced. Think about SSH. People scan and attack every SSH server on the public IPv4 Internet. But not on IPv6. Why not? Because it's statistically useless to attempt with 128-bit addresses. You're just wasting your time and money.
    • eikenberry 5y ago
      Remote attacks are not the only attacks and nothing can make it impossible as long as people are involved. Security keys are easy to steal and people are easy to trick or coerce.