hirsin

21 ms·

271.
by hirsin 6y ago
So called "first party apps", those that are first party to the IDP, can often be considered as pre-consented. So the consent can be skipped - it's why you don't need to consent to use Excel or Gmail.
272.
by hirsin 6y ago
Yeah, we (Azure AD) got a couple of "login is broken" escalations when Chrome made this change. A couple vendors use it to validate a request is coming from the upstream IDP, to block drive by attacks I assume.
273.
by hirsin 6y ago
Yup, that's precisely it. We documented the login breaks from Samesite and 3p cookies, but logout was both not particularly a concern for folks (I've gotten about three inquiries in two years), and pointless to document tombstonin
274.
by hirsin 6y ago
Ah, the dates of the comments at the bottom helped explain the lack of modern day issues we now hit - 3p cookie depreciation and the Chrome Samesite change. Both of these break logout, but certainly weren't a concern in 2008.
275.
by hirsin 6y ago
Oh no, I hadn't even thought of that. Yes, likely many bots locked for this.
276.
Tweeting “Memphis” autolocks your Twitter account(twitter.com)
536 points by hirsin 6y ago|334 comments
277.
by hirsin 6y ago
CaBLE may be of interest to you. It's better than 2fa codes, since it's effectively FIDO/web AuthN (unphishable). https://github.com/w3c/webauthn/pull/909
278.
by hirsin 6y ago
Teams relies on iframe auth to fetch the Nth token from AAD (multiple resources to call, multiple tokens required). The iframe calls are partitioned and lose cookies, even under Firefox's helpful "redirect exemption" setup, i
279.
by hirsin 6y ago
"Reduce the number of people in poverty by 50%" is a different goal than "Reduce the net poverty gap by 50%". A real headline can be that fewer people are in poverty than last year but the dollar sum of poverty is higher
280.
by hirsin 6y ago
https://www.nejm.org/doi/full/10.1056/NEJMc2025179?query=fea... https://www.nbcnews.com/health/health-news/cdc-suggests-reco...
281.
by hirsin 6y ago
I was very skeptical of it as well, and had the same reaction to the medical professionals saying this. Their off the cuff "oh, yeah, ninety days, makes sense" led to me believe them. Note as well I'm referring only to catchi
282.
by hirsin 6y ago
Every medical professional I know /am related to has indicated that getting covid only grants 90 days immunity. Across state lines, they all have said that herd immunity visa infection is impossible as it requires everyone to be infect
283.
by hirsin 6y ago
To add to this - by splitting and moving domains you've hurt your search rank, eliminated the chance to share cookies (auth, eg) between these domains, and are now subject to new cross-domain security dings in other tooling. Lose-lose.
284.
by hirsin 6y ago
Your first option has an additional threat vector - the UA token is repayable against the first service. In case of compromise, as you say, the toke is too powerful and can do too much. The second option is indeed bad. The third option is u
285.
by hirsin 6y ago
Because it's really simple to do? It sucks to be sick, and there's a usually free, probably effective means of avoiding it. Plus, if you're around people for whom it's not "just" the flu it helps protect them.
286.
by hirsin 6y ago
As others have pointed out, the explanations have existed but perhaps not in your view. From where I stand (Seattle, know multiple Defund folks), the reaction has been "So, the one true thing we think cops should do - prevent significa
287.
by hirsin 6y ago
Adding bodies of water (great lakes, gulf, 2 oceans) may help fix the Rhode island issue and this one. Or perhaps make it worse (my expectation is they'd act as anchors of a sort)
288.
by hirsin 6y ago
Are they at a sufficient point to be worth enrolling in? I've reviewed the foundation list but beyond some promising phase 3 items it was short on what's next.
289.
by hirsin 6y ago
You're making the implicit assumption that more of those people exist than the rural and suburban types, in which case... Yes? Your comment cuts both ways - one of those groups is going to be the dominant culture and if your argument
290.
by hirsin 6y ago
"Secured by hard crypto" is item fifteen on someone's priority list after usability, cost, reliability, speed and the font used on the marketing page. Note that none of the questions you raise are answered by protecting a jpe
291.
by hirsin 6y ago
Same deal here (half), but my last name is noticeably associated (apparently - took me 27 years to learn that). I get someone bringing it up about twice a year I'd say.
292.
by hirsin 6y ago
As others have mentioned - USPS is extremely interested in mail fraud and other crimes, arresting over 5k people a year. They handle reports like this all the time.
293.
by hirsin 6y ago
I brushed up against SAT solvers in school, but never quite got a grasp on them. The "proof" at the end is 200 GB - is that size related to SAT solvers in general, this particular problem, the dimensionality here? A billion-sized
294.
by hirsin 6y ago
They did that because they were unfamiliar with a system that requires such a check. Every time I've been to Europe and used an American card it's been explained to me that because American cards are so far behind the times they n
295.
by hirsin 6y ago
CAEP provides this to some extent https://openid.net/wg/sse/ - but now you're asking for a whole bunch of systems to be able to talk about you in back channels which other people will find fault with.
296.
by hirsin 6y ago
https://docs.microsoft.com/en-us/azure/active-directory/user... It's still not well supported for "external" takeover but it's disappointing that your support queue didn't point you t
297.
by hirsin 6y ago
Give or take every international organization (and most parts of the US) will have the same reaction if you pressure them to acknowledge Taiwanese independence in that fashion. Excepting the cases where they are not required to interact wit
298.
by hirsin 6y ago
A/B testing auth methods is tricky. It's fine for "can we get better sign up rates" but it wreaks havoc on "can my previous users still sign in". At best you can AU/NA test - show different pre-auth treatm
299.
by hirsin 6y ago
I can! And previously could not. The process isn't bad, and isn't terribly invasive. I had a sore nose for a few days, took Tylenol to recover, and was back at work 4 days later (sat, sun, Monday off, Tuesday half capacity, Wednes
300.
by hirsin 6y ago
I suffered the same thing (deviated septum runs in the family it seems). I just got the septoplasty and a turbinate reduction done (3 weeks ago) and even though I'm not fully recovered I can already breathe better than ever before. The

More ›