homakov

25 ms·

241.
by homakov 9y ago
What stops phishing? The attacker triggers push request, victim accepts - everything is the same?
242.
by homakov 9y ago
> initially utilizing both irises as inputs) to create public/private keypairs, we can generate a unique ID for each person on the planet wait, what?
243.
by homakov 9y ago
Yeah it's a mess when you recommend duo/authy not clear TOTP or internal system. It's a second factor but not the one that's worth implementing: basic link to email has same security and costs $0
244.
by homakov 9y ago
Then it's separate feature from TOTP. It's not a real 2fa because it works like service>duo>user where duo can accept anything for you.
245.
by homakov 9y ago
What is push code?
246.
by homakov 9y ago
Usable? Scanning codes and plastic sticks? Not really
247.
by homakov 9y ago
Did anyone here NOT write their own pw manager?
248.
by homakov 9y ago
Yes, KDF->pubkey seems like only sane way forward. Any discussion over old school passwords is a waste of time.
249.
by homakov 9y ago
Because just reading a book or tutorial won't give you enough info to be comfortable with all terms there. For hobby or if you have spare time - yes go ahead, for practical business needs - waste of time. Good framework handles most
250.
by homakov 9y ago
Don't read it, always start with using a good framework. It will do everything for you
251.
by homakov 9y ago
If you can make it eat less memory, go make it 2x slower im fine with it.
252.
by homakov 9y ago
For sure Android can tunnel traffic over SSH, but iOS, not so sure. They expose some API for VPN?
253.
by homakov 9y ago
Why use algo over ssh tunneling? ssh -ND 8080 user@host
254.
by homakov 9y ago
What are security features of their VPN or email that are not in other VPNs or emails, that I can measure? I.e. I don't care how military grade is their server side encryption or I don't care that they decrypt in my JS, as long as
255.
by homakov 9y ago
It would be true, but someone like Brendan Eich mush be onto something, right? He can't risk all his reputation for just 33M?
256.
by homakov 9y ago
Just checked, indeed no origin on same site. It sucks, this makes origin barely reliable.
257.
by homakov 9y ago
Only VirtualBox is an option but whonix says support is experimental (they don't test it at all). So... stick with it.
258.
by homakov 9y ago
I always wondered why they need whonix gateway? Couldn't they just pass it through host's tor? Why do i need to run entire full blown debian just as a proxy?
259.
by homakov 9y ago
Worst because it is neither proven as tokens which are used for decades already nor as convenient as simply whitelisted Origin and you even offer an extra dependency. Are those scenarios without Origin important? Like ff for form request -
260.
by homakov 9y ago
If I were to drop CSRF tokens (which work reliably) I would go directly to Origin verification. No Referer. Something in the middle is worst of both worlds.
261.
by homakov 9y ago
Or just ask them all to implement decentralized SecureLogin.
262.
by homakov 9y ago
I really want more details on marketing side. 200k on G Adsense? Paid posts? Pitching? Maybe some short blog post on how to promote a product?
263.
by homakov 9y ago
That's what made me confused. There is no way to "change" password, only to create a new profile and migrate to it. And you can have many profiles at the same time (some with equal email). >For automation you also have to
264.
by homakov 9y ago
I can't understand first paragraph, especially "versioned" passwords. Every profile is result of generation, and you can change profile (manually or automatically) if you think it was compromised. With OAuth you add a lot of
265.
by homakov 9y ago
It's hard to just push your code into other browsers. Very slow process. We can't wait any longer
266.
by homakov 9y ago
Check "change password" section for rotation of one profile to another. It's quite simple Why replace OAuth? because it sucks. It's stateful on the server, and it's security surface is bad. With SL you could sign a
267.
by homakov 9y ago
Let me think of a solution. Usage origins could be tracked and stored server side, trivially, but not sure if worth the hassle.
268.
by homakov 9y ago
> What about offline generation of thousands/millions of combinations Definitely not millions. It takes 20 seconds on a modern chip, it's memory hard scrypt so yeah, even few thousands are too expensive to crack.
269.
by homakov 9y ago
I've looked closely after standards in auth area and left very disappointed. They are painfully slow. FIDO is founded on 2013, and they never tried to get rid of passwords, but only sell overpriced plastic sticks. I doubt webauthn will
270.
by homakov 9y ago
It's not a pain, can be 1 click if you're on the same device (with log of websites you used). https://github.com/sakurity/securelogin#7-how-do-i-change-ma... Harder if on a fresh device, but totally doable fo

More ›