4 ms·

Having my phone shouldn’t be game over. This mindset can be pushed too far. In general "game over devices" tend to be a bad idea. I’ve seen people type in thei

Having my phone shouldn’t be game over. This mindset can be pushed too far. In general "game over devices" tend to be a bad idea. I’ve seen people type in their passcodes. People may have seen me type in mine when FaceID gives me trouble on my iPad. I’m not at all comfortable with the idea that someone jacking my iPad will have root access to my life.

krupan 3y ago
So we should stick to game over passwords, that don't even require device access, just a clever phishing email or hacking a weak website that has a copy of your password that, oops, you reused on 10 other websites?
- sillysaurusx 3y ago
  Passwords aren’t game over though. Access from a different region usually triggers a verification email. I don’t think we should stick with them, but there’s a difference between sticking with something and forcing everyone to use something else. Is it true that you won’t be able to use passwords at all in the new scheme? If so, this seems… risky. Question. Suppose I have a passkey on my device. Obviously it gets synced to some sort of cloud, so that if I lose my device, I don’t lose my account. But does everyone who has access to any device get all my passkeys? I hope not, but part of the blog post was to raise awareness. This is a nice reminder it’s time to look into passkeys deeply.
panarky 3y ago
>> guaranteed access to pretty much everything that matters > "game over devices" tend to be a bad idea If you have something worth stealing, don't put it on your phone. If you have $1000 in Robinhood or Coinbase along with passwords for TikTok and Instagram in your password manager, sure, put it all on your phone for convenience. It wouldn't be a catastrophe if they were stolen. But if you have anything that's worth protecting, trade convenience for security. Keep banking, brokerage and crypto apps off the phone. Don't use your phone for password managers and 2FA. Use a Chromebook with no extensions for sensitive stuff. It's less convenient, but there's no chance of life-changing theft if someone takes your phone at the club.

krupan 3y ago

So we should stick to game over passwords, that don't even require device access, just a clever phishing email or hacking a weak website that has a copy of your password that, oops, you reused on 10 other websites?

sillysaurusx 3y ago
Passwords aren’t game over though. Access from a different region usually triggers a verification email. I don’t think we should stick with them, but there’s a difference between sticking with something and forcing everyone to use something else. Is it true that you won’t be able to use passwords at all in the new scheme? If so, this seems… risky. Question. Suppose I have a passkey on my device. Obviously it gets synced to some sort of cloud, so that if I lose my device, I don’t lose my account. But does everyone who has access to any device get all my passkeys? I hope not, but part of the blog post was to raise awareness. This is a nice reminder it’s time to look into passkeys deeply.

panarky 3y ago

>> guaranteed access to pretty much everything that matters > "game over devices" tend to be a bad idea If you have something worth stealing, don't put it on your phone. If you have $1000 in Robinhood or Coinbase along with passwords for TikTok and Instagram in your password manager, sure, put it all on your phone for convenience. It wouldn't be a catastrophe if they were stolen. But if you have anything that's worth protecting, trade convenience for security. Keep banking, brokerage and crypto apps off the phone. Don't use your phone for password managers and 2FA. Use a Chromebook with no extensions for sensitive stuff. It's less convenient, but there's no chance of life-changing theft if someone takes your phone at the club.