xnorswap

68 ms·

1201.
by xnorswap 5y ago
I don't think a user should be able to tell the difference. The initial handshake would still use something like passwords or API keys to authenticate the user. The difference is post-login, where authentication can return for example
1202.
by xnorswap 5y ago
But then there's no third party in that scenario, that's down to whoever was issuing those tokens and is part of securing their service.
1203.
by xnorswap 5y ago
No, it's owned by the government but doesn't take any government funding.
1204.
by xnorswap 5y ago
That's correct. There are scenarios where it still makes sense. It's plausible that it would more efficient for some high traffic services to push (the somewhat rare) revocation notices out to endpoints as still being more efficie
1205.
by xnorswap 5y ago
So you're worried that a very short lived compromise of a SSI / federated auth layer can lead to long-lived compromises of everything it grants access to because a short time can be used to generate long-lived auth to third partie
1206.
by xnorswap 5y ago
A big limitation is forced early expiration. If you need to do that then you end up needing to share expiration information and therefore need to share something that might as well be a password hash. So for example it's not great to u
1207.
by xnorswap 5y ago
I don't understand the argument here, if you're not issuing the tokens then they're not your responsibility. Can you give a more fleshed out example, why should you audit third party services?
1208.
by xnorswap 5y ago
Isn't the fundamental difference that a password needs checking against a stored per-user value such as password hash and therefore needs a database lookup, while a token can be validated through just the cryptographic signature and th
1209.
by xnorswap 5y ago
You gain a cheaper car. Even if features have zero marginal cost, they are important for market segmentation, which is important for reducing the cost for most people by allowing less price-discriminating purchasers to pay more. Imagine ins
1210.
by xnorswap 5y ago
Cookie warnings have got worse and worse. There are sites now that list 200+ checkboxes with a handy "reject all", but if you don't click through to the list of "legitimate interest" sites you miss out on rejecting
1211.
by xnorswap 5y ago
I think he should have considered talking to a lawyer before posting this tweet. This doesn't feel wise to double-down on without first checking with a lawyer the following: 1. What are his employment rights 2. What is the legal standi
1212.
by xnorswap 5y ago
Sometimes it's the details and specifics that are more interesting than the outline.
1213.
by xnorswap 5y ago
Indeed, their example is terrible, because it's also the kind of 'toy' problem that just doesn't have good real world uses too. How often do you want to reverse a string. I think your solution is fine and isn't &quo
1214.
by xnorswap 5y ago
I'd like to try this as an option in firefox's reader mode as that's the format in which I read most long texts. This did on the surface feel like it is a help for me, in particular not so much the reading speed but the &#x27