5 ms·

This is why we're storing important user credentials on a user's phone instead of all on a central server! (https://clef.io https://clef.io)

chunsaker 14y ago
What happens if your phone gets stolen?
- kdude63 14y ago
  Then wouldn't that be the user's fault/problem?
  - chunsaker 14y ago
    Sure, but designing around the inherent riskiness of user behavior/forgetfulness is an important part of security systems. Users want to be protected, not for blame to be shifted to them.
- mistercow 14y ago
  Then one user's password gets stolen, as opposed to thousands.
  - chunsaker 14y ago
    Yes, it certainly mitigates the scale of a potential breach and I like that the reduced scale/potential value makes it a less attractive target to hackers (assuming the server side is also built in a secure way). I havent investigated, but it makes me nervous to think that if my phone is stolen, the thief gets my data too.
- dasil003 14y ago
  0.0000014286% of the damage that happens when Sony's database gets hacked (assuming equal payload).
  - dmix 14y ago
    As a consumer though, I could change my password on a server if it gets stolen. But how would I reset it after my phone was stolen if authentication is all stored client side?
- freehunter 14y ago
  Use a PIN, and if possible, encrypt your phone. It won't completely mitigate the risk, but it will reduce your surface area.
jlkinsel 14y ago
Hmm...that seems to have potential, but it requires custom integration and users to use your app. Is there an open protocol for this? Looks like you're doing something similar to the mutual auth that wikid does...a whitepaper or two with more depth would be useful on the site
ScottWhigham 14y ago
Is this just thinly veiled spam for that site? I can't tell if you work for them or not but, if you do, it's not in your profile. If so, I think it's pretty tacky when companies to take every possible opportunity to get their name out there...
- chunsaker 14y ago
  Profile updated. Thanks, didn't mean to be disingenuous. Its okay to call me tacky - I actually think this stuff matters.
  - scrumper 14y ago
    I think ScottWhigham was talking about brennanHN rather than you. Nothing tacky about your submission.
anExcitedBeast 14y ago
This is pointless. Solutions like keepass are just as good and don't require existing services to hook into new authentication API's. In fact, they're better because they don't run the risk of opening a whole new central attack surface.

chunsaker 14y ago

What happens if your phone gets stolen?

kdude63 14y ago
Then wouldn't that be the user's fault/problem?
- chunsaker 14y ago
  Sure, but designing around the inherent riskiness of user behavior/forgetfulness is an important part of security systems. Users want to be protected, not for blame to be shifted to them.
mistercow 14y ago
Then one user's password gets stolen, as opposed to thousands.
- chunsaker 14y ago
  Yes, it certainly mitigates the scale of a potential breach and I like that the reduced scale/potential value makes it a less attractive target to hackers (assuming the server side is also built in a secure way). I havent investigated, but it makes me nervous to think that if my phone is stolen, the thief gets my data too.
dasil003 14y ago
0.0000014286% of the damage that happens when Sony's database gets hacked (assuming equal payload).
- dmix 14y ago
  As a consumer though, I could change my password on a server if it gets stolen. But how would I reset it after my phone was stolen if authentication is all stored client side?
freehunter 14y ago
Use a PIN, and if possible, encrypt your phone. It won't completely mitigate the risk, but it will reduce your surface area.

jlkinsel 14y ago

Hmm...that seems to have potential, but it requires custom integration and users to use your app. Is there an open protocol for this? Looks like you're doing something similar to the mutual auth that wikid does...a whitepaper or two with more depth would be useful on the site

ScottWhigham 14y ago

Is this just thinly veiled spam for that site? I can't tell if you work for them or not but, if you do, it's not in your profile. If so, I think it's pretty tacky when companies to take every possible opportunity to get their name out there...

chunsaker 14y ago
Profile updated. Thanks, didn't mean to be disingenuous. Its okay to call me tacky - I actually think this stuff matters.
- scrumper 14y ago
  I think ScottWhigham was talking about brennanHN rather than you. Nothing tacky about your submission.

anExcitedBeast 14y ago

This is pointless. Solutions like keepass are just as good and don't require existing services to hook into new authentication API's. In fact, they're better because they don't run the risk of opening a whole new central attack surface.