nickray

17 ms·

1.
by nickray 3y ago
Google's proposal for filtering: https://google.aip.dev/160 Specifically, https://google.aip.dev/assets/misc/ebnf-filtering.txt which is a modification of their common expression language ht
2.
by nickray 5y ago
How do you map KMU Konten to ledger accounts (can you rollup?), and do you automate VAT accounting?
3.
by nickray 5y ago
Nonnegative always includes zero, unless the author had muddled thinking themselves. Since positive is >0 and negative is <0, their negations are nonpositive for <=0 and nonnegative for >=0.
4.
by nickray 6y ago
I see your point too, and we're looking forward to a world in which low-power (to enable NFC) open source chips with security features exist. For instance, https://tropicsquare.com is a project that is working towards that.
5.
by nickray 6y ago
Website can distinguish via the optional attestation key. In terms of features, CTAP v2.1 ( https://fidoalliance.org/specs/fido2/ ) is still draft only, but yes both v1 and v2 keys support hmac-secret and credential
6.
by nickray 6y ago
No, they cannot. This is an explicit design goal of FIDO ( https://fidoalliance.org/specs/fido-security-requirements/fi... ). The actual public key used for logging in to a specific site is completely random. Option
7.
by nickray 6y ago
We hope and think that PIV can replace all the practical use cases for PGP. Specifically among those mentioned, `age` for file encryption, and either FIDO resident keys with hmac-secret for password managers, or something like `passage` (fo
8.
by nickray 6y ago
Anybody have an actual quote of Burnside's doubt? Article etc.
9.
by nickray 6y ago
Keybase's "Crypto tools" tab can do this, with "known destination" determined via social proof. https://keys.pub is a re-implementation of this use case without the messenger/cryptocurrency baggage
10.
by nickray 6y ago
First, that's a limitation of git. Second, it's easy to fake PGP: https://boats.gitlab.io/blog/post/signing-commits-without-gp... Third, we're adding support to SoloKeys to do this using a hardware
11.
by nickray 7y ago
As Stavros mentions, you can, and if you feel qualified, you should manage your own keys. Be that with some software authenticator you deem safe or write yourself, or with e.g. our keys that are open source, so you can modify anything to yo
12.
by nickray 7y ago
Yes, WebAuthn is about getting rid of passwords. They're a bad idea, for most people, in most situations.
13.
by nickray 7y ago
In FIDO-speak, "platform" authenticators are your laptop or phone, using their contained secure storage, vs "roaming" authnrs like our SoloKeys. Most people assume that the former will be the main way to use WebAuthn. Co
14.
by nickray 7y ago
The point is that ssh keys lying around on your laptop aren't the greatest idea either. Where is the root of trust? The password you type to terminal if you encrypt them? FIDO2 starts with the idea of safe defaults, where either client
15.
by nickray 7y ago
SoloKeys person here ;) You can implement software authenticators (listening on local USB port), I imagine some password manager people will do so eventually, or have a direct way to hook into requests. Krypton did this for U2F. Hardware ke
16.
by nickray 7y ago
There's an ascending signature counter that's intended to prevent cloned devices (replay attacks are prevented seperately with server generated challenge). One way around it is clone (backup key) having very high initial signature
17.
by nickray 7y ago
As I'm currently working on possible options to expose on-device keys and cryptography for our open source FIDO2 key (SoloKeys) beyond the FIDO use case, I'd be curious about opinions on just exposing and using the PKCS#11 API (Cr
18.
by nickray 8y ago
You register more than one key, and use your backup. If the site lets you in without one of the keys you registered, it's a security theater :)
19.
by nickray 8y ago
privacy.
20.
by nickray 8y ago
https://login.swissid.ch does this too: disallow password managers from filling out the login. Upon asking them to fix: "Autofill completion is not allowed by us for security reasons. First, if that's the case, if some
21.
by nickray 8y ago
Is there any English translation of the original? Would be curious to see the actual recipes!
22.
by nickray 8y ago
It implements FIDO2: https://www.yubico.com/2018/05/what-is-fido2/
23.
by nickray 8y ago
Should? That does mean: purchasing a bunch of tokens, each of which could be lost, and registering them all. I don't think online security has normative/prescriptive rules, just tradeoffs :)
24.
by nickray 8y ago
Yes :) Personally, I would just start replacing credentials upon loss in descending order of importance.
25.
by nickray 8y ago
I am considering adding this to my European distribution of U2F Zero, but the problem here is that as the vendor I then know your secret key. As mentioned in another comment, the uncloneability of Yubikeys is a feature (similar to Google Au
26.
by nickray 8y ago
Yes, the vast majority of users just worry about losing or breaking their U2F token. Such a user just wants to be able to log in and replace credentials. The proposed solution, which I find surprisingly elegant, in comparison to regular two
27.
by nickray 14y ago
I think Johnny Neumann said it best: "There's no sense in being precise when you don't even know what you're talking about."
28.
by nickray 14y ago
Regarding your second question, I suggest reading this classic article by Leslie Lamport: http://www.google.com/url?sa=t&rct=j&q=&esrc=s&#...