3 ms·

That’s why you use platform that already solved IP address and other client fingerprinting. If you are really paranoid - you setup alert policies when users are

That’s why you use platform that already solved IP address and other client fingerprinting. If you are really paranoid - you setup alert policies when users are exfiltrating suspicious amount of info.

mjg59 5y ago
IP fingerprinting is unhelpful - the user experience for mobile devices becomes terrible. Any other client fingerprinting is easily duplicated.
- dzhiurgis 5y ago
  > user experience for mobile devices becomes terrible Cant have Your cake and eat it too > client fingerprinting is easily duplicated. Far from it.
  - mjg59 5y ago
    > Cant have Your cake and eat it too Or we could just use credentials that can be tied to the hardware, and then we have stronger security assertions than tying to IP, and without any degraded user experience.
    - dzhiurgis 5y ago
      What is this protocol called and who supports it?
      - mjg59 5y ago
        The absence of support for a stronger solution is an argument for improving support for a stronger solution, not an argument against criticising the existing solution.
        dzhiurgis 5y ago
        Was genuinely serious AFAIK iOS provides hardware keys for fingerprinting
- dumpsterdiver 5y ago
  Seems like this could be bearable (badum-bum-psh) if it was only enforced during a token refresh (as opposed to every request), even on mobile.