4 ms·
You can scan an ecrypted barcode or through push login or other methods. There is more at the developer site.
by 1cvmask 5y ago
You can scan an ecrypted barcode or through push login or other methods. There is more at the developer site.
- TheMatten 5y agoIs this basically what Discord does with it's web/desktop client?
- tialaramex 5y agoNote that push login is vulnerable to one of the phishing attacks described. User goes to fakebank.example, attacker goes to realbank.example, user types in their username, it is pasted by attacker, the user gets a push login request, "Hey are you trying to log into Real Bank?". Yes, says the user, of course I am, and they let the attacker into their account. WebAuthn fixes this, by having the web browser take responsibility for the thing humans are bad at. Is this, in fact, realbank.example? No, it's fakebank.example. Attack failed.