jesseendahl

15 ms·

91.
by jesseendahl 3y ago
The alternative is passkeys, which are strongly phishing-resistant and don't require an annoying "second factor" step for the user at all.
92.
by jesseendahl 3y ago
>However it is only a matter of time before the radio cannot be fully disabled for some reason or another (oh we just turn on the radio to get guaranteed network time as part of our Trusted Cloud Experience that we secure you with!). Onc
93.
by jesseendahl 3y ago
>This doesn't seem materially different from "please go to your emails and find the six-digit code we just sent you". Exactly, that's the problem lxgr is pointing out. Those six-digit codes can (and often are) phished
94.
by jesseendahl 3y ago
Genuine question: have you actually used a modern Mac? OS X was renamed macOS 7 years ago in 2016.
95.
by jesseendahl 3y ago
>Finally, we demonstrate the recovery of passwords, in case these are autofilled by credential managers. Can't wait for passkeys to replace passwords everywhere.
96.
by jesseendahl 3y ago
They are not being pushed for vendor lock in purposes. They are being pushed because passwords are a completely terrible user experience and terrible security story for 99.99% of users on the internet.
97.
by jesseendahl 3y ago
You should watch the Apple WWDC developer talk from 2022. It explains very clearly the problems that passkeys set out to address. https://developer.apple.com/videos/play/wwdc2022/10092/ Most (not all, bu
98.
by jesseendahl 3y ago
>But you left out the huge one, losing access to the account. Losing access to your passkey/password manager is a separate concern from the strength of the credential itself. Passkeys and passwords are just credentials. What you use
99.
by jesseendahl 3y ago
You can use whatever passkey/password manager you want to though. You don’t need to use Google or Apple’s password/passkey manager apps if you don’t want to. Passkeys are WebAuthn credentials, which is an open standard, and it’s b
100.
by jesseendahl 3y ago
I'm not sure why you didn't include the rest of the sentence, which made it clear that I was making a very specific comparison to password + phishable forms of 2FA. I was very clearly not making a blanket statement. Here's th
101.
by jesseendahl 3y ago
What are the pros to using phishable passwords and 2FA?
102.
by jesseendahl 3y ago
Threat #1: Credential theft from server breaches Threat #2: User creates a weak credential Threat #3: User reuses a credential (uses same credential across multiple services) Threat #4: Phishing Attackers use huge password dumps compiled fr
103.
by jesseendahl 3y ago
I’m not cherry-picking, I’m comparing the actual real-world experience of using password autofill vs. using a passkey. The significantly better passkey sign-in UX that I’m talking about exists on all major platforms. And the UX is handled b
104.
by jesseendahl 3y ago
This provides significantly weaker account security than using a passkey. 2FA codes delivered over SMS can be phished.
105.
by jesseendahl 3y ago
>Password and regular 2fa/totp are fine This might feel true, but it's factually not true. Both passwords and TOTP can be phished. In addition, passwords can be weak, reused, and password hashes can (and are frequently) stolen
106.
by jesseendahl 3y ago
You can recover access to your iCloud Keychain even if you've lost 100% of your devices. See the section titled "Recovery security" in this article: https://support.apple.com/en-us/102195 Relevant excerp
107.
by jesseendahl 3y ago
> made even worse by it being treated as equivalent to password+2FA. passkeys are significantly more secure than the most widely-used/most popular forms of 2FA, because the most popular forms of 2FA are TOTP and SMS, and both are
108.
by jesseendahl 3y ago
You don't know what you're talking about. Biometric data is only stored on your device. Logging into an app or website with a passkey just uses bog standard asymmetric crypto (public/private keypair). Also a lot of thought wa
109.
by jesseendahl 3y ago
>So they aren't considering at all how easy is the autofill password feature with a password manager Passwords are a nightmare for both users and service providers for a variety of reasons. And password autofill is a bandaid at bes
110.
by jesseendahl 3y ago
It seems like everyone thinks that wearing masks is only to protect themselves from other people, and completely forgot (or never learned in the first place) that it's actually arguably even more important to wear a mask to protect oth
111.
by jesseendahl 3y ago
I could care less if people wear masks to protect themselves, but I do wish that people who are in public spaces coughing extremely aggressively and loudly, would think about the others around them and wear a mask. It comes across as extrem
112.
by jesseendahl 3y ago
Don’t use SMS instead of iMessage though. Then all your texts will be sent across the network without any kind of decent encryption. And WhatsApp is almost unusable unless you consent to uploading all your contacts to Facebook. (IIRC this w
113.
by jesseendahl 3y ago
>So I don't really understand how this can be said to be a hardware security token. No one claimed it's a hardware security token, but the private keys are stored in iCloud Keychain, which is end-to-end encrypted. Apple cannot
114.
by jesseendahl 4y ago
If you Google “passive solar vs. passivhaus” you will find a lot of results. This one is the first result which explains the difference in terms: https://www.whitepebbleinteriors.com.au/the-difference-betwe... I believe pas
115.
Meet passkeys(developer.apple.com)
1 points by jesseendahl 4y ago|0 comments
116.
Early Security for Startups(devd.me)
3 points by jesseendahl 5y ago|0 comments
117.
by jesseendahl 5y ago
I agree. FWIW this is a much better article on the same topic by someone who actually has earned scars. It also contains much more concrete advice: https://review.firstround.com/dont-serve-burnt-pizza-and-oth...
118.
by jesseendahl 5y ago
I think you are conflating “unreasonable” with “unhappy”. It’s absolutely possible to have unreasonably high standards/expectations for “how things should be” and fight super hard for change/progress, while still being a happy per
119.
by jesseendahl 6y ago
4th this recommendation -- I highly recommend April Dunford's "Obviously Awesome".
120.
by jesseendahl 6y ago
The ballet world has similar levels of competition and harmful psychological effects as women’s gymnastics. There are a huge number of girls and women competing for an extremely small number of available jobs as a full time professional dan

More ›