g_p

18 ms·

181.
by g_p 4y ago
Passkeys are a little different - at heart, you can export or write down (on paper, if it comes to it) your passwords, and then import them into another password manager if you choose to. If you want to move from the built-in keychain to 1P
182.
by g_p 4y ago
I agree - I think password managers will (soon enough) implement passkeys. As you say though, the current implementations deliver lock-in "by-design" (but with legitimate reason - you don't want to have an API that shares the
183.
by g_p 4y ago
Certainly - WebAuthn is an open standard, and passkey appears to just be "passwordless FIDO2" (all open standards) with shiny branding around it. That means anyone can implement it, including a physical token (which can be entirel
184.
by g_p 4y ago
One of the next frontiers as a barrier to browser switching will be "software"-backed WebAuthn/FIDO2/"passkeys". If you look at the APIs available on MacOS/iOS at present [0], and how WebAuthn works, you n
185.
by g_p 4y ago
It seems like you shouldn't be able to use a PAT from another device (thus creating a PAT fountain), as attestations are used, which chain back to a trusted issuer (device maker). This should be possible to do, through a simple thought
186.
by g_p 4y ago
By only offering you it as a longer-term subscription, they can likely capture that recurring revenue from more people as a "just to be safe" type offering, perhaps off the back of something existing like another level of iCloud+.
187.
by g_p 4y ago
> I hope this supports location report to closed friends like how Garmin did. I believe they showed location reporting through FindMy to friends, so not only for emergency scenarios.
188.
by g_p 4y ago
This is loosely what Firefox's temporary containers [0] extension does. Each tab (with options to control whether a tab spawned from a parent tab should inherit the cookie-jar context of the parent) gets its own temporary context. I do
189.
by g_p 4y ago
Yes, 2FA/MFA is almost always just an access control measure over who can retrieve the (in this case encrypted) data from the server. TOTP is based on a shared secret that client and server both know (so inherently a compromised server
190.
by g_p 4y ago
IP theft might also be a distraction for an attempt (perhaps unsuccessful, perhaps undetected as of yet) to gain a foothold in the development environment for introduction of future changes to the client code. For something like a password
191.
by g_p 4y ago
And even if you run self-hosted, you're still needing to either audit every line of the web vault (and changes made each time it's updated), or the browser extensions or client applications. Self hosting can help insulate you from
192.
by g_p 4y ago
Yes, absolutely - a compromised development environment might be the first step towards getting implanted code into shipping software, or getting to a signing environment (hopefully highly isolated, but you never know!), with a view to carr
193.
by g_p 4y ago
This is probably the best thing you can do if they're using third party "hosted" sending infrastructure - the host will carefully monitor each tenant's spam rate, and terminate relationships with customers that have a hi
194.
by g_p 4y ago
In addition to the EAP-AKA' authentication, the strange and highly opaque ways through which VoWiFi support is signalled and enabled might be an issue here too. I've seen brand new Pixel devices (which fully support VoWifi) act li
195.
by g_p 4y ago
Keys tied to users -- during registration, an authenticator generated a new ECDSA key locally, and offloads it to the PC, to be sent to the server. The public component is exported in plaintext and is the verifier data. The private componen
196.
by g_p 4y ago
If you deploy and maintain your own fleet of cards then you could do this. There's an open source FIDO2 applet implementation at https://github.com/martinpaljak/FIDO2 You could also use PIV/PKCS11 client cert
197.
by g_p 4y ago
Something I was disappointed (but not surprised) to never see take off outside a few niche areas and closed systems like payment card terminals was personal smartcard readers. Even reasonably affordable ones commonly have a 16x2 or 16x4 LCD
198.
by g_p 4y ago
If you're looking for an alternative OSM app on Android or iOS that performs reasonably well, it might be worth checking out "Organic Maps" (a fork of the old maps.me), which is open source and based on OSM's mapping dat
199.
by g_p 4y ago
My understanding is that they can build the plane, but if they were to add the required EICAS system (which approval in 2023 or beyond would require), they would require a new type rating for the aircraft, meaning it wouldn't be able t
200.
by g_p 4y ago
Another good reason to avoid "passwordless" and magic links in email from https://news.ycombinator.com/item?id=31892299 is that some email clients or server stacks "click" on links, and perhaps even use
201.
by g_p 4y ago
Apple has their own custom conventions and ABI ( https://developer.apple.com/documentation/xcode/writing-arm6... ). I believe you are right that they have their own custom instructions too. The asahi Linux project h
202.
by g_p 4y ago
The other issue is sites break the law by ignoring the consent request anyway - many/most sites don't actually link the prompt to withholding delivery of cookies. This includes big name, big brand sites you've heard of as hou
203.
by g_p 4y ago
The closest I have seen to what you're describing is https://kagi.com , which seems to have just gone to open beta. A few commenters have mentioned it in this thread.
204.
by g_p 4y ago
There's guidance in the FAQ document at https://github.com/M66B/FairEmail/blob/master/FAQ.md#user-co... that seems to cover Oauth2. For the parent, they seem to be on a Huawei device without Google
205.
by g_p 4y ago
In this case, it seems like "recency" was a big issue - the change wasn't recent in any sense of the word, since it seems like the feature has been there since at least mid 2020. [0] The explanation in this case also seemed t
206.
by g_p 4y ago
I think transparency is always good, although one worry I do have is that forcing benign declarations (i.e. what amounts to disclosing that when you turn on X, it does X), creates something similar to "alert fatigue". People don&#
207.
by g_p 4y ago
Humans using template responses seems to be one of the biggest complaints the FairEmail dev had - repeated copy-pasting of the same response, despite asking for clarification and even citing European legislation (which Google needs to compl
208.
by g_p 4y ago
The problem was that this feature existed for many years without issue. There was plenty of disclosure in the app (it was even written in bold red text, I believe). The developer was guessing as to what was going on, since the feature wasn&
209.
by g_p 4y ago
You can see how the parsing works in the source code (with a specific high level explanation of how this part works), as the site is an open source project. https://github.com/idank/explainshell#how
210.
by g_p 4y ago
GDPR doesn't mandate cookie banners - that was actual other separate legislation (ePrivacy Directive). It provided a renewed focus and made more companies sit up and take note. Sites aren't required to have banners - the intention

More ›