3 ms·
What? Wow, that sounds really dangerous. The same fingerprint is available to any site out there, so anyone could just capture it and try to replay it on a "Sec
by 0x0 13y ago
What? Wow, that sounds really dangerous. The same fingerprint is available to any site out there, so anyone could just capture it and try to replay it on a "SecureAuth" service, no?
- deleted 13y ago[deleted]
- samweinberg 13y agoHopefully that isn't the only mean of authentication.
- 0x0 13y agoWhat is it then? What if I upgrade the browser, will it accept whatever other auth factor I present (a password?) anyways? What's left then?
- chayesfss 13y agoHere's how it works. As a user I want to connect to a web resource, I am redirected to my idp (SecureAuth) where we ask you your name, then I look at your account and ask you to enroll, then I ask you your password. Now before I generate a claim/token or what ever I take your fingerprint so for the next day/30 days/90 days or what ever your fingerprint is checked between your username/password and the strong authentication is transparent to the user. The variables can all be weighted differently and the fingerprints can easily be revoked but it is very cool technology.