homakov

28 ms·

271.
by homakov 9y ago
I did my best and answered these questions honestly. We could make some kind of poll and see how many people can gain access back?
272.
by homakov 9y ago
2. Not XSRF but phishing? Yes, https://github.com/sakurity/securelogin#anti-phishing-concer... - it only works for callback=ping and native apps 4. Have you tried? Because they seem to ask too hard questions like exact
273.
by homakov 9y ago
Not another... It's more flexible kdf(site data, consumer, scope, expiration, master pwd) protocol, allows to prevent many other attacks and replace OAuth all in one.
274.
by homakov 9y ago
https://github.com/sakurity/securelogin#7-how-do-i-change-ma...
275.
by homakov 9y ago
You're right, there's no custom passcode on purpose (short post why not https://medium.com/@homakov/against-passcodes-in-apps-a76b9a... ) If more people need it it will be added.
276.
by homakov 9y ago
> then that suggests that all current implementations Long story short entire concept of client certs is not as usable in terms of backups/enrollment as I want to, no matter how well dialogs are implemented.
277.
by homakov 9y ago
>I want to try your thing, so I press cancel? That doesn't seem terribly intuitive. I thought your main selling point was usability. To be precise that depends on client implementation, we will use a popup that doesn't even red
278.
by homakov 9y ago
Regards 1) why do I need statistics for such self-evident things? How on Earth writing down secret codes can be called convenient? No one said yet "wait a second, I actually love all this hassle" > You are underestimating the t
279.
by homakov 9y ago
Nevermind initial technical sync commits, not my fault Git requires -m.
280.
by homakov 9y ago
Please email homakov@gmail.com I can continue about extensions there
281.
by homakov 9y ago
I'm aware. It's the thing nobody uses. There's no need to compare with it. I'd rather add https://www.youtube.com/watch?v=VgC4b9K-gYU
282.
by homakov 9y ago
>to just use the public key as the identifier instead of the email. it's exactly how it is now. Email has no "weight", it's just a label. What are your systems? What about 24-word mnemonic as a second option? I person
283.
by homakov 9y ago
Thanks for a fresh look. Yes, first encounter can be putting off. Clicking "OK" makes it open local app which you don't have, but it would be silly to have "clear localStorage" button right? 3rd party software is ge
284.
by homakov 9y ago
Thanks! internal toQuery works with predefined a-z keys only so I think it is ok to be this way?
285.
by homakov 9y ago
Happy to hear back from like minded person. 1. I myself hate native apps, but the catch is web apps are 100% depended on the servers behind them. So I would be responsible for JS I serve any single request. Otherwise, Web version is fine. L
286.
by homakov 9y ago
> I'm very keen to see if we can add support for the OP's authentication protocol soon It doesn't sound plausible, it only works without a middlemen.
287.
by homakov 9y ago
You can use get it here too: first part is truly random (store it locally) second is memorable. It gives you freedom to do it your way, unlike traditional approach where you have to backup a wallet no matter what.
288.
by homakov 9y ago
He means how does your 2 part scheme scale (it is hard). With 1 password you simply enter it again on another device.
289.
by homakov 9y ago
MIT vs Apache 2.0? I don't want to have any rights or responsibility, just Do Whatever You Want license.
290.
by homakov 9y ago
It's number of downloads btw. Some might have downloaded it once and never used, some could have used for just one app, some removed and downloaded again.
291.
by homakov 9y ago
I couldn't find any working clients of SQRL/demo? Will happily add it to comparison table.
292.
by homakov 9y ago
Yes, you can only auth from current app installed on current device. No QR codes involved :)
293.
by homakov 9y ago
Yes, it's good one https://github.com/sakurity/securelogin/blob/master/LICENSE....
294.
by homakov 9y ago
>The "tech bubble" is not an insignificant number of people. Count # downloads of G Authenticator on Play Store - ~10M. To 4B of internet users. By anyone I meant platform support. U2F on iOS? U2F outside Chrome? etc.
295.
by homakov 9y ago
Backup with 3rd party == giving up access to 3rd party. #1 principle of this protocol is not giving up access, at least by default. You are free to email your password to yourself, write it on a note, but it will never offer to send your pa
296.
by homakov 9y ago
> Tried demo on chromebook Sorry never tested on that platform. But web app must be working, just press Cancel if app is not installed. Native app is not required but recommended. It's deterministic - enter same password, get same p
297.
by homakov 9y ago
(That comes with associated risks of bank stealing your money, i.e. don't own them. Just an analogy, not a bitcoin zealot.)
298.
by homakov 9y ago
Supporting != users are using it. Especially outside of tech bubble. I myself always cringe when forced to setup TOTP. Yes, I seriously would rather take the risk of my gmail reset compromise than dealing with TOTP again.
299.
by homakov 9y ago
If not this protocol, I would be happy if any passwordless auth wins. Really about time to make a switch!
300.
by homakov 9y ago
1. Will try. it would take 2x much text. 2. I'm not sure if that's what you meant but I just realized pretty bad bug in current callback=ping flow. When malicions page opens my.app for me and second later opens securelogin:/&

More ›