psanford

15 ms·

181.
by psanford 4y ago
I've been using this on my m2 Air since July and I'm quite happy with it. If you are already comfortable with nixos then you'll find everything here quite straight forward.
182.
by psanford 4y ago
.sexy increased their price from $25 to $2500. For now, domains registered at the old price can continue to renew at the old price. But they could easily cut that off at any time.
183.
by psanford 4y ago
There are software only Fido implementations.
184.
by psanford 4y ago
Attestation is not a likely requirement. Apple doesn't support it for their implementation of passkeys so it won't see any mainstream adoption. This matches with how WebAuthn has been rolled out by early adopters. Virtually no pub
185.
by psanford 4y ago
Fortunately that feature isn't used outside of enterprise environments. Apple's passkeys don't support it so there will not be any mainstream adoption for requiring an attestation cert.
186.
by psanford 4y ago
TOTP/HOTP is phishable. Webauthn is not. > Until open source, free roaming, implementations of passkeys exist that expose the private key to the end user, it's effectively a locked-in ecosystem. As I said above, there already a
187.
by psanford 4y ago
Passwords have had a good run but on the modern internet they are a failure. 99% of the population uses the same bad passwords everywhere. We've tried to get people to behave securely with passwords but it just doesn't work. Its n
188.
by psanford 4y ago
You are not locked in. You can create a passkey in ios, on an android phone and on your desktop for the same website. This is going to accelerate the adoption of WebAuthn across sites on the internet. I consider that to be very good. You ca
189.
by psanford 4y ago
There are a number of opensource fido key implementations already. There will be opensource passkey implementations.
190.
by psanford 4y ago
You can use an opensource fido key implementation on linux though.
191.
by psanford 4y ago
Fido keys work just fine on linux. There's already a fido authenticator that protects your keys using the system's TPM[0]. [0]: https://github.com/psanford/tpm-fido
192.
by psanford 4y ago
No you do not need to use anything proprietary to use WebAuthn. There are open source software[0] and hardware keys[1]. [0]: https://github.com/psanford/tpm-fido [1]: https://solokeys.com/
193.
by psanford 4y ago
I'm surprised systemd hasn't solved this problem already.
194.
by psanford 4y ago
This is one of the main reasons I've switched from Ubuntu to NixOS.
195.
by psanford 4y ago
> We'll see how it plays out but I'm not optimistic this is going to end well. Why? Its all open standards. There are already a number of independent implementations in the works.
196.
by psanford 4y ago
Except the industry is moving away from attestation. The popular passkey implementations don't support it. You won't see attestation use outside of enterprise specific settings.
197.
by psanford 4y ago
Thats the point of passkeys. They can be backed up and sync'ed between devices. But even if you don't want to use the popular passkey implementations, you can still easily register multiple authenticators which mitigates the risk
198.
by psanford 4y ago
I built one myself. I've yet to find a site that doesn't support it. I'm sure there are some out there, but in practice attestation isn't a big problem.
199.
by psanford 4y ago
Yes certs expire (expiration is configurable). Large deployments will run an online CA that has some external means of verifying the identity of a host. Rotation is straight forward. Add the new cert and reload the process (no restart requi
200.
by psanford 4y ago
If you are using the yubico-authenticator app then you are using TOTP, just with the seeds stored on your yubikey. This is still vulnerable to phishing. I hope what you meant to say is that you are switching to using WebAuthn with your yubi
201.
by psanford 4y ago
Colm MacCárthaigh has a nice writeup on CVE−2022-3602 including steps to reproduce: https://github.com/colmmacc/CVE-2022-3602
202.
by psanford 4y ago
Try https://webauthn.me/debugger . It will show you all the gritty details.
203.
by psanford 4y ago
The specification is fully open and most of the components have already been implemented in various open source libraries. The nice thing about passkeys is that they are just a FIDO2 implementation with a few extensions. That means any site
204.
by psanford 4y ago
Entering a PIN is known as "user verification." The point is to prove not just that you posses the key but also that you know a secret about the key. This is better than passwords for a number of reasons. The pin doesn't need
205.
by psanford 4y ago
Part of the design is that every site will support multiple passkeys tied to an individual account. So it will be normal to use one browser to bootstrap registering another browser with a new passkey into your account. This video[1] by the
206.
by psanford 4y ago
The difference is that: 1) this is accessible and usable by anyone running a modern operating system+browser. mTLS client certs need to be provisioned which is one of the major reasons why it is only used in enterprise settings. And 2) pass
207.
by psanford 4y ago
Passkeys are an implementation of FIDO2 so yes, any sites that have implemented webauthn will support passkeys. It might be useful to think of passkeys as a usability extension to webauthn. You no longer need to buy dedicated security devic
208.
by psanford 4y ago
Firefox isn't the only thing that has been switched off .deb and to a snap. LXD, for example, has been shipping as a only a snap for years. But even if it were only firefox, telling people they should download tarballs instead of havin
209.
by psanford 4y ago
Because more and more things are only packaged as snaps.
210.
by psanford 4y ago
I love sqlite's FTS. I have a number of personal projects where I have an archive of data and want to occasionally be able to do ad-hoc searches over and get reasonable ranking and results. Throwing sqlite fts at the problem gets me th

More ›