4 ms·
I'm pretty sure that poor passwords ("password1!") and password reuse combined dwarf basically all other password-related security issues, thus getting users to
by cmeacham98 5y ago
I'm pretty sure that poor passwords ("password1!") and password reuse combined dwarf basically all other password-related security issues, thus getting users to use a randomly generated password on every website is a magnitude of order more secure.
On top of that, in cases of XSS or a MiTM you've probably already lost and no password alternative will help you.
- dotancohen 5y agoWebauthn is secure even in the case of XSS and Mitm, in the sense that the attackers still cannot access the credentials without user intervention. It tool a long time to convince me, too. https://webauthn.me/introduction https://webauthn.me/introduction
- cmeacham98 5y agoTrue but mostly meaningless. XSS and MiTM allow attackers to take over and pretend to be the user after a legit user logs in. The attacker cannot store the credentials and use them later, but they have full access in the moment.