6 ms·
Even using the client's keys it would be a good idea to give a disclaimer that their key may be stored (If that is the case) and can be accessible through nefar
by ozfive 2y ago
Even using the client's keys it would be a good idea to give a disclaimer that their key may be stored (If that is the case) and can be accessible through nefarious means. People are very susceptible to phishing attempts etc. and this sort of business model (where you have the client supply the key and store it through the browser is a slippery slope.
- skybrian 2y agoYes, it’s like storing passwords.
- TeMPOraL 2y agoYes. It's as bad as using password managers. Wait.
- skybrian 2y agoFrom an application developer's perspective, the nice thing about using a passkey with a browser cookie is that you don't have to store anything sensitive. You're only guarding access to your own app with meaningless numbers. If your app doesn't store other sensitive data, the blast radius is small. There are still denial of service attacks to worry about where an attacker can use network or compute to run up your bill. What are we guarding when building an app that uses a cloud API that costs money? Access to more compute resources. Probably a lot more than the app itself ever uses. It raises the stakes a bit. Still, in monetary terms, you're operating a vending machine that the user puts money into. Maybe there could be some kind of protocol and workflow to securely buy a dollar of compute time from an AI vendor? If they send some of the money to the app developer's account, it's starting to sound like an app store or micropayments system.
- panarky 2y agoLet's not train users to do things that are generally unsafe. "We detected fraud on your account. Click here to secure your account." "Copy and paste your secret into this box, you can trust us not to look at it."