atanasi

5 ms·

1.
by atanasi 2mo ago
The service may require attestation and verify the actual authenticator metadata. If the passkey is not accepted by the service, it can use the signaling API to indicate that the passkey was not registered validly.
2.
by atanasi 3mo ago
Airpods use AAC-ELD for better microphone quality. While the codec is an open standard, activating it with Airpods is proprietary.
3.
by atanasi 5mo ago
My bank in Finland allows activating the bank's app remotely. They verify the NFC chip of the ID card in addition to photos and other factors.
4.
by atanasi 5mo ago
The app would be restricted to environments certified by Apple or Google. Then the app can apply features like trusted time to implement client-side rate limiting.
5.
by atanasi 5mo ago
If the app wants to take advantage of mandatory hardware attestation, it has to require Android 13 or later. This would undermine somewhat the promise that the app supports a wide range of devices. Even banks don't currently enforce An
6.
by atanasi 6mo ago
The current policy trend in the EU is definitely not based on the principle of each user evaluating their own risk. On the contrary, service providers like financial institutes and identity providers have the responsibility to keep users sa
7.
by atanasi 6mo ago
Bad money drives out good money only if there is a legal tender law such that both have to be accepted for the same nominal value. In this case, good money is hoarded because it cannot be traded for its true value.
8.
by atanasi 8mo ago
It's the security of the ecosystem, where the interests of app vendors are fundamental: content distributors can count on enforcing DRM, and banks are relying on the camera used for KYC actually being a camera and not a virtual device.
9.
by atanasi 1y ago
Reading comprehension problems can often be caught with some static analysis combined with AI.
10.
by atanasi 2y ago
FSF has published a commentary: https://www.gnu.org/licenses/gpl-faq.html#MereAggregation GPL licenses have allowed so-called "mere aggregation", where separate programs are distributed together. Such program
11.
by atanasi 5y ago
Server-side solutions don't catch all cheats. They can block actions that are impossible according to the game rules but they cannot prevent clients from disclosing too much information to the player about other players, or automating
12.
by atanasi 7y ago
I have heard that AES is very complicated to implement in software, if one intends to avoid side-channel leaks.
13.
by atanasi 7y ago
In the case of printing, the context provides some information. In particular, Erlang JAM file seems unlikely to be printed.
14.
by atanasi 7y ago
Are they even similar to JavaScript or PHP?
15.
by atanasi 7y ago
Certificates are precisely for authentication, but the simplest form employed by automatic systems like letsencrypt only tries to verify domain control. It does not bind the certificate to any legal identity, unlike stronger forms of certif