3 ms·

Everything boils down to some password or key (effectively a long password) access to some SQL instance. Anything on top of that is just fluff. The database ca

by dheera 2y ago

Everything boils down to some password or key (effectively a long password) access to some SQL instance. Anything on top of that is just fluff. The database can still be compromised directly.

growse 2y ago
There's a difference between fluffy that's phishable (passwords) and fluff that isn't (webauthn). Not all fluff is equal.
- dheera 2y ago
  How is Webauth'n Crunch not phishable? Most implementations throw about 20 "recovery codes" at you and at the absolute fucking worst possible moment while the user is trying to do something urgent, they say "save these in a secure place right now". It's not 1, but 20 passwords that ALL give access to your account. Where do you think those codes go? They are not only phishable, but they usually end up in a Google doc, screenshotted and pasted to Notion, or some other insecure place.
  - growse 2y ago
    We're talking about webauthn, not recovery codes.
hirsin 2y ago
Keys are _not_ just long passwords. They're asymmetric. Feel free to steal any and all of my webauthn public keys. Heck, here's one: "kty": "EC", "alg": "ECDSA_w_SHA256", "crv": "P-256", "x": "xYkEVgMClD28hXHn5JQjrgjRX3crmr0OhGiWKsLvxUY=", "y": "5lZZGFF6VrVubIHfRhGbvQBGpw6LcbP3/ZBVk7PqH0Y=" It's what you'd get if you somehow got into the db and decrypted it. Now, do feel free to give me your nice symmetric secret password, since it's the same, yeah?
- dheera 2y ago
  Keys can be symmetric or asymmetric depending on the algorithm. From the standpoint of a non-technical user, they're not any different in nature; a password and a private key are both just strings that give full access to your account. One is easier to remember (password), one is harder to remember (key). The one that is harder to remember usually ends up in a Google doc, iCloud, or saved as a text file.

3 ms·

Everything boils down to some password or key (effectively a long password) access to some SQL instance. Anything on top of that is just fluff. The database ca

by dheera 2y ago

Everything boils down to some password or key (effectively a long password) access to some SQL instance. Anything on top of that is just fluff. The database can still be compromised directly.

growse 2y ago
There's a difference between fluffy that's phishable (passwords) and fluff that isn't (webauthn). Not all fluff is equal.
- dheera 2y ago
  How is Webauth'n Crunch not phishable? Most implementations throw about 20 "recovery codes" at you and at the absolute fucking worst possible moment while the user is trying to do something urgent, they say "save these in a secure place right now". It's not 1, but 20 passwords that ALL give access to your account. Where do you think those codes go? They are not only phishable, but they usually end up in a Google doc, screenshotted and pasted to Notion, or some other insecure place.
  - growse 2y ago
    We're talking about webauthn, not recovery codes.
hirsin 2y ago
Keys are _not_ just long passwords. They're asymmetric. Feel free to steal any and all of my webauthn public keys. Heck, here's one: "kty": "EC", "alg": "ECDSA_w_SHA256", "crv": "P-256", "x": "xYkEVgMClD28hXHn5JQjrgjRX3crmr0OhGiWKsLvxUY=", "y": "5lZZGFF6VrVubIHfRhGbvQBGpw6LcbP3/ZBVk7PqH0Y=" It's what you'd get if you somehow got into the db and decrypted it. Now, do feel free to give me your nice symmetric secret password, since it's the same, yeah?
- dheera 2y ago
  Keys can be symmetric or asymmetric depending on the algorithm. From the standpoint of a non-technical user, they're not any different in nature; a password and a private key are both just strings that give full access to your account. One is easier to remember (password), one is harder to remember (key). The one that is harder to remember usually ends up in a Google doc, iCloud, or saved as a text file.