4 ms·

Except that your initial claim was actually: > phisher can and absolutely will catch up to this technically That's not you saying that "there might be future

by jsnell 3y ago

Except that your initial claim was actually: > phisher can and absolutely will catch up to this technically That's not you saying that "there might be future ways of breaching it". That's you saying that it will absolutely and permanently be breached. And that's not a tenable statement at all. I already went into some detail on the probability and impact of a zero-day in the technical implementation, and you engaged with none of it, so I don't think there's much point in going to those details again.

namaria 3y ago
Wow yeah I didn't write a bulletproof paper in a forum. You chose 2 tiny details of what I wrote and 100% ignored the fact that you are trying to argue that some technology will be safe against social engineering against the user (phishing) in perpetuity, which is illogical.
- jsnell 3y ago
  I replied to every point you made in the original message, it wasn't cherrypicking just couple of details. That's because everything in your initial post was wrong. (But I also explained why passkeys wouldn't solve all security problems, and why it's still useful to just make things incrementally better rather than solving everything at once). You then tried to argue zero-days. While zero-days are possible, I replied in detail why they would not be a scalable long-term threat, and your response was to start lying about your original claim. Note that you have provided absolutely nothing to back up your claims about how passkeys will eventually become phishable. Nor have you admitted that your theory about it happening is wrong, just complained that it's unfair to be called out on such a tiny detail. But it's not a tiny detail! Being unphishable is the entire core design goal of passkeys. You're just claiming that they don't actually have that property, while not being able to give any concrete details about why it would be so.

by jsnell 3y ago

namaria 3y ago

Wow yeah I didn't write a bulletproof paper in a forum. You chose 2 tiny details of what I wrote and 100% ignored the fact that you are trying to argue that some technology will be safe against social engineering against the user (phishing) in perpetuity, which is illogical.

jsnell 3y ago
I replied to every point you made in the original message, it wasn't cherrypicking just couple of details. That's because everything in your initial post was wrong. (But I also explained why passkeys wouldn't solve all security problems, and why it's still useful to just make things incrementally better rather than solving everything at once). You then tried to argue zero-days. While zero-days are possible, I replied in detail why they would not be a scalable long-term threat, and your response was to start lying about your original claim. Note that you have provided absolutely nothing to back up your claims about how passkeys will eventually become phishable. Nor have you admitted that your theory about it happening is wrong, just complained that it's unfair to be called out on such a tiny detail. But it's not a tiny detail! Being unphishable is the entire core design goal of passkeys. You're just claiming that they don't actually have that property, while not being able to give any concrete details about why it would be so.