psanford

31 ms·

241.
by psanford 4y ago
> the power to make unphishable systems is being arbitrarily tied to hardware keys and secure enclaves Its not though. First of all, windows, android, macos and ios all support being used as platform authenticators. No need to use an ext
242.
by psanford 4y ago
> we were able to thwart the attack through [...] physical security keys issued to every employee that are required to access all our applications I hope you are paying attention, Twilio. WebAuthN tokens are an effective phishing mitigat
243.
by psanford 4y ago
That is incorrect. Mandatory WebAuthN eliminates this risk. Stop wasting your time with inferior alternatives.
244.
by psanford 4y ago
Unless security training takes the click rate to zero it is ineffective in protecting your organization from phishing attacks.
245.
by psanford 4y ago
Hey Twilio, maybe now you'll implement webauthn for both your internal systems and for your customers? Its pretty frustrating that there's a well known technical solution that prevents this type of attack from being feasible and c
246.
by psanford 4y ago
ZDI-16-464
247.
by psanford 4y ago
Kind of annoying that the blog post links to pkg.go.dev but pkg.go.dev doesn't yet show 1.19 as the latest Go version so the links don't actually take you to the new documentation.
248.
by psanford 4y ago
Facebook will be able to test and handle a negative leap second better than most organizations in the world. Its everyone else they are worried about. If the rest of the internet breaks from a negative leap second, it doesn't really ma
249.
by psanford 4y ago
I just got mine a couple of days ago. I'm really impressed with how well its built and how polished the software is. It is much more polished than any other similar (useful!) hacking/debugging hobbyist devices I've bought. It
250.
by psanford 4y ago
Buy a Mac mini and install Linux on it? That feels like it is (or will soon be) the best option.
251.
by psanford 4y ago
Based on the progress Asahi Linux has made in the last year, I expect linux to be a reasonable option (for folks who are comfortable with a Linux installer) within the next 12 months.
252.
by psanford 4y ago
I don't believe that there is any comparable hardware to the M* macbooks right now, linux or not.
253.
by psanford 4y ago
Man I wish System76 or Framework or someone else could make hardware as nice as Apple. I just ordered an M2 Air which I will be primarily running Linux on. I'm replacing my Lenovo T480s (which was a great laptop) because I want _nice_
254.
by psanford 4y ago
> Macs are not comparable to a full Linux system. What does that mean? I've run Linux on all the MacBooks I've owned. I just ordered an M2 Air with the intention of using it primarily as a Linux laptop.
255.
by psanford 4y ago
Here's the relevant code. It sounds like your understanding doesn't match the current rules (consult a tax professional): https://www.law.cornell.edu/uscode/text/26/53
256.
by psanford 4y ago
You can claim the AMT credit in the future tax years.
257.
by psanford 4y ago
Do you still have to have a canonical sso account just to login to your own devices? EDIT: The answer appears to still be yes. I don't know who canonical is making this for, but no company is going to want to deploy IoT devices that ha
258.
by psanford 4y ago
Thanks for the heads up, it should be fixed now for android platform authenticators.
259.
by psanford 4y ago
Check out rust-u2f/softu2f[0]. [0]: https://github.com/danstiner/rust-u2f
260.
by psanford 4y ago
> there's a way to mock a fido2 key systemwide without uhid? On Linux, Chrome and Firefox interface directly with the USB and Bluetooth interfaces. There is no OS level abstraction for FIDO devices on Linux.
261.
by psanford 4y ago
I agree that the secure enclave with integrated touch id is more secure. However, if your threat model is an attacker has root on your system, the secure enclave isn't going to protect you from much.
262.
by psanford 4y ago
Most open source tools I've seen that implement FIDO use a shared Attestation cert[0]. [0]: https://github.com/github/SoftU2F/blob/master/SelfSignedCert...
263.
by psanford 4y ago
Chrome also allows you to say no to Attestation requests. The only place I've seen a 'legitimate' use for requesting an attestation cert is to ensure that only specialized FIPS hardware is allowed to be registered when that i
264.
by psanford 4y ago
Yes, having the verification done by the secure enclave itself is more secure. The TPM spec does allow for direct integration with biometric devices, but I'm not aware of any general purpose computers that ship in this configuration. &
265.
by psanford 4y ago
FIDO logins are not shared across relying parties (sites), each site gets its own (that's what makes FIDO phishing proof). If you want a single identity that multiple sites know about you'd, login using a third party identity prov
266.
by psanford 4y ago
FIDO usb devices just use the HID protocol so they work fine on linux. Chrome and Firefox both support them. I wrote a FIDO implementation that protects the signing key using the system's TPM specifically for linux: https://
267.
by psanford 4y ago
FIDO2 resident keys (the thing people are now calling passkeys) allow for multiple credentials for a single site. If you have a device that supports resident keys you can try this for yourself on https://webauthn.io . There is al
268.
by psanford 4y ago
There are a lot of resources in AWS that don't support tags.
269.
by psanford 4y ago
I'm the author of tpm-fido and I'm open to adding fido2/ctap2 support to it.
270.
by psanford 4y ago
The nice thing about the Null* type is they can reduce the number of allocations done on the heap and thus also reduce total GC your program needs to do.

More ›