4 ms·
(Edited and removed) Let's start with the basics, many applications do not support webauthn, full stop. Even shops who roll it out are forced to keep holes open
by beardedwizard 4y ago
(Edited and removed) Let's start with the basics, many applications do not support webauthn, full stop. Even shops who roll it out are forced to keep holes open for business critical applications that don't support it. Security is not easy, and the entire field is not negligent - the problem is massively asymmetrically stacked against security practitioners, enhanced by poisonous attitudes like the ones expressed here.
- sullivanmatt 4y ago[removed by author]
- beardedwizard 4y agoFair play.
- dogecoinbase 4y ago> Security is not easy, and the entire field is not negligent - the problem is massively asymmetrically stacked against security practitioners, enhanced by poisonous attitudes like the ones expressed here. Is remaining in a role in which it's not possible to be effective negligent?
- beardedwizard 4y agoWhat is your alternative? Should we do nothing instead? Should all SWEs quit because they can't stop writing security bugs?
- dogecoinbase 4y agoI don't have a specific alternative, but I think that if it's not possible to be effective in a role, one should decline it. It's possible to be an effective SWE while still writing (and hopefully also sometimes fixing) bugs.
- beardedwizard 4y agoOne could argue the security industry exists because of the failings of computer science. Maybe swes should start facing legal liability for thier failings like most other engineering disciplines. We would see this problem change overnight.
- Tostino 4y agoBy productivity going completely down the drain.
- beardedwizard 4y agothat is not happening in commercial engineering though is it?
- lamontcg 4y agoShould doctors quit and find another field because people keep on breaking their legs?
- mango7283 4y agoIf doctors not only had to treat broken legs but also somehow prevent people breaking them in the first place...
- allset_ 4y ago> many applications do not support webauthn, full stop You don't need the application to, only your IDP. Everything should be SSO from there.
- fjfbsufhdvfy 4y agoWhat if that application doesn't support that setup either? So many services online barely manage to let you setup TOTP, nothing like this...
- Tostino 4y agoStick it behind something like authentik before exposing it
- technion 4y agoAn underlying issue is that Microsoft Active Directory does not support MFA of any kind at all. That's why third party PAM vendors exist, but they don't really change the fact that you the most widely deployed authentication service in business is effectively run by password hashes. That's the whole reason we so commonly see the "mimikatz scraped a hash from RAM and it was all over" write up in incidents. Smartcards exist, but their use is clunky in practice (I'm aware Yubikeys may now function this way). For everything else, Microsoft's current MFA solution is "just use the cloud".