homakov

29 ms·

301.
by homakov 9y ago
It's not a requirement though: one may ping from the client side with setInterval.
302.
by homakov 9y ago
There are many differences, because your password used just once to create root hash. From root hash private key is generated, and no one is sharing password anymore
303.
by homakov 9y ago
Right now email is not changed, because it's not used as primary key, it's just a label like your fullname. After you changed you can get into the same account using your 2nd profile only. Ignore the email: site owners are free to
304.
by homakov 9y ago
There is no need for rate limiting against pubkey crypto, and bruteforce is simply too expensive for current derivation.
305.
by homakov 9y ago
>1. how this works So if you are a developer, your best bet is "How it works?" here: https://github.com/sakurity/securelogin If you don't speak Ruby, hit me up I will dedicate all my time to help you.
306.
by homakov 9y ago
https://news.ycombinator.com/item?id=14482166
307.
by homakov 9y ago
> Another thing I don't see is key-revocation There's a button "Change SecureLogin" which essentially replaces old pubkey with new one. One would have to do it with all services they every used, and do it before the a
308.
by homakov 9y ago
I never really tried to type my password and hit Send, so I never worried about this case. Hygiene has to be reshaped to understand how important master pw is compared to all pw we used to type, like 123456.
309.
by homakov 9y ago
It's mostly correct, but it really is not a password manager. Manager is a helper for some people, protocol is a requirement for all. So I want to draw a line between protocol and a manager. It's like https://getclef.c
310.
by homakov 9y ago
In my opinion SL does exactly that: another take on client side public key auth. It's not built in the browser on purpose for flexibility.
311.
by homakov 9y ago
The goal is similar, but not execution. I don't know all specs of Persona - learnt about it when it was being deprecated - but the key difference SecureLogin cannot be deprecated. "All user data stored on the persona.org services
312.
by homakov 9y ago
Exactly - everything can be derived from password. It's simplest backup strategy possible.
313.
by homakov 9y ago
It's not common, but the quickest way I could find to reduce # of roundtrip requests. Happy to hear why unacceptable.
314.
by homakov 9y ago
Thomas, many times I made a point that if auth solution is not enforceable it's not going to be popular. You like 1Password and it has reasons to be loved. But let's take it real and look at password reuse problem. Can you admit t
315.
by homakov 9y ago
Yes, sorry, that TOTP backup thing is great. Always hated that GAuth cannot back up. But what was meant is the SMS service they make money on.
316.
by homakov 9y ago
It's more about password hygiene. Do you have any advice how to prevent disclosing not making UX harder? I would happily implement it.
317.
by homakov 9y ago
No, it's decentralized as in "no central authority" not as in blockchain "many centers". It's a local client side app.
318.
by homakov 9y ago
So DoubleSign is pretty cool for financial apps because it signs `scope` on two devices. First prototype had that feature. But it was very unclear to the users. So it was removed, but will be added back if this 1.0 version gets used by well
319.
by homakov 9y ago
Authy service (one where they send you SMS) is centralized. It's not that it's safe or unsafe, but generally decentralized is better option.
320.
by homakov 9y ago
There's no established meaning of factor. I have trouble understanding UAF goals. We already have full disk encryption + pincodes on laptops and phones. Consider it "first factor" then? If laptop is stolen you cannot get in (
321.
by homakov 9y ago
> If you use a finger print sensor as a convenient first factor then you might as well still want a second factor. You keep talking about factors, which is just a word, not a technical term. I repeat: you do not need u2f with fixed first
322.
by homakov 9y ago
currently, gauth connect is best option for general public. It's a fact, they are popular and have no passwords
323.
by homakov 9y ago
because selling overpriced plastic sticks is a lucrative business which has nothing to do with security or threat models at all. It's just marketing
324.
by homakov 9y ago
> so they introduce UAF to replace passwords Oh, how is it going? Is there any UAF supporting app, ie no passwords? All I see is slides and presentations. > Are you arguing there is never a case for a second factor Correct, once fi
325.
by homakov 9y ago
"Factor" is a marketing word. There is security threat model, and there are no "factors". u2f introduces another layer instead of fixing first one. That's why they failed - all we needed is a password replacement, n
326.
by homakov 9y ago
I'd rather recommend people use google auth/facebook connect than go through u2f hassle. It's way too inconvenient and will never go mainstream. Did they figure out usable backups yet? Or they still recommend to just buy anot
327.
by homakov 9y ago
>Third, how is it not adoption when Facebook, Github, Dropbox, Google and many others have added it. adding != users are using it (they don't) 19 is price for yubikey, maybe some do for 5, it doesn't matter because it should be
328.
by homakov 9y ago
I don't know what kind of future you're talking about. U2F gained 0 adoption and are doomed. What did they expect with $19 sticks that require USB?
329.
by homakov 9y ago
Check this out - it actually has implementations - https://securelogin.pw/
330.
by homakov 9y ago
Hi, actually the DoubleSign feature will roll out in v2 version only to improve usability of v1. But it definitely will!

More ›