md_

25 ms·

241.
by md_ 5y ago
> The point is that it takes that choice out of the users' hands. Unclear to me why you think the user--and not the IdP--should have the final say here. > You shouldn't. That's like expecting to be able to use your work
242.
by md_ 5y ago
I'm not sure what you're replying to--this scheme is much closer to self-signed X509 client certs, not FIDO. But regarding FIDO, it does not prevent user-controlled hardware; it's up to RPs to choose if they require specific
243.
by md_ 5y ago
WebAuthn is "too complex" the way a catalytic convert is "too complex." If you don't know what it's for, it certainly seems like you can remove it with no downsides. ;) > Because it was in reply to my earlie
244.
by md_ 5y ago
FIDO keys are also unlinkable across origins (or identities!), but unlike in this scheme, that property doesn't rely on the user knowing to not reuse keys. Anyway, unclear to me how this is better than x509 client certs, except that th
245.
by md_ 5y ago
I read the github readme. It doesn't explain the problem or threat model in any detail. My comment has nothing to do with federation or SSO, so I'm not sure why you mentioned those?
246.
by md_ 5y ago
It might help if you described a bit more explicitly your problem statement, threat model, and goals.
247.
by md_ 5y ago
It’s worse. It encourages the use of the same strong “password” on every website?
248.
by md_ 5y ago
This flow is also insecure. Ideally, we make WebAuthn easier to use (via libraries, identity providers, etc), rather than, you know, replacing it with something less secure than passwords. Just sayin’. ;)
249.
by md_ 5y ago
As the other commenter said, this has nothing to do with hardware tokens. This has to do with the user agent (the browser) passing the (browser-verified) origin to the authenticator (which can be hardware or software). But, critically, the
250.
by md_ 5y ago
One way to look at this is a way for employers and employees to cope with uncertainty. The employee is likely to underperform for the first few comp cycles after being hired, due to the new role, new context, etc. So the employer is willing
251.
by md_ 5y ago
Xbox et al is ~$17b/year in revenue. Meta's VR was ~$2bn last year. I'm shocked it's that high, but, honestly, for an early effort, that's pretty competitive. If I'm reading Microsoft's 2005 annual report
252.
by md_ 5y ago
> Then there are other AR product forms, like contact lenses. This seems far-fetched to me. Mojo ( https://spectrum.ieee.org/ar-in-a-contact-lens-its-the-real-... ) claims to be on track for this, but: - their "workin
253.
by md_ 5y ago
Doesn’t Telegram not even support e2ee for group chats?
254.
by md_ 5y ago
“Project” or “product?”
255.
by md_ 5y ago
> A counterpoint would be that what some call the intrinsic value is the expected future share price based on expected future revenues. Sure, but plenty of tech companies have never paid dividends and never will. FB's shareholders w
256.
by md_ 5y ago
Agreed, though I think the causality is a little more nuanced than that: political disorder tends to be a necessary component of bad central banking policy, and thus is a cause as well as an effect of hyperinflation.
257.
by md_ 5y ago
No, I was (of course?) being sarcastic. But the confused replies leave me more than a little worried that people genuinely agree with the sentiment!
258.
by md_ 5y ago
What's amusing to me is: a. Replies don't know if I'm being sarcastic or not. b. I don't know if people who upvoted this comment thought I was being sarcastic or not.
259.
by md_ 5y ago
I agree, but surely money is not the only kind of reward our society can imagine. Actually, what am I saying. Of course it's the only kind of reward most of us imagine.
260.
by md_ 5y ago
Surely the real idiots are the open source developers who give away code for free. Suckers.
261.
by md_ 5y ago
> If Signal-the-app did a WhatsApp and started blocking forwarded messages, or blocking messages that contained a blacklisted domain etc, I think very little would happen and it might take a while for people to even notice. Why would it
262.
by md_ 5y ago
Wow. Where to begin. :) > …there’s only one client…It’s encryption that lasts as long as the owner thinks it should last… I think this is a big leap. It’s a open source client with verifiable builds. If a future version removes encryptio
263.
by md_ 5y ago
> Well, I might like an auditable Gmail Who proposed binary transparency for Gmail (the server)? The whole premise of tools like Signal is that enough happens in the client--which is amenable to binary transparency--that the server is
264.
by md_ 5y ago
> Apparently there aren't any groups reverse engineering every WhatsApp update to figure out if it's still encrypting everything. If that were true--in the case of WhatsApp, I'm pretty sure it's not, as another poster
265.
by md_ 5y ago
Mike's point seems to apply, practically speaking, to any software, including Bitcoin: - Most users of Bitcoin Wallet download it from the Play Store - Even if it's open source (as is the Signal client), "nobody's"
266.
by md_ 5y ago
“Pay it back”? To whom? QE and national debt aren’t the same thing.
267.
by md_ 5y ago
Education and health care are both subject to Baumol’s cost disease. “Our incredible supply chains and manufacturing automation have lowered most consumer prices such that we don't really notice inflation…” What’s your definition of “i
268.
by md_ 5y ago
It’s a fair point, but it’s unclear to me to what extent these hybrid solutions retain the advantages of blockchain and to what extent they give them up. I’m not at all an expert, but I’ve been wondering if a world where we all regularly us
269.
by md_ 5y ago
The author seems to miss that one of Moxie's central criticisms is that, all else being equal, distributed solutions tend to lag centralized ones. The reason for OpenSea et al. providing centralized services isn't accidental--it&#
270.
by md_ 5y ago
It seems like you're defining "central banking" in relation to the independence (or maybe ownership of) the central bank. That doesn't seem correct to me. China has a central bank, but it's fully publicly owned and

More ›