The Devil Is in the Details of Project Verify’s Goal to Eliminate Passwords

Re:The Devil Is in the Details of Project Verify’s Goal to E... by hirsin on Thursday October 04, 2018 @08:00PM (#18144653)

So don't do SMS OTP and use an authenticator app instead, which is more secure.

And inflammatory comments aside, yes, any good IT org should believe that it's more likely for a user to be phished and give away their super secure xkcd based password than it is for a nation-state attacker to target their phone OS with a 0day.

[ Parent | on HN ]

Re:The Devil Is in the Details of Project Verify’s Goal to E... by xte on Thursday October 04, 2018 @09:22PM (#18145010)

Try to think about different scenarios: first not a nation vs nation attack but a simple dictatorship attack against some opponent, something like "hey see! This bad guy have done many criminal thing". Also think about what kind of situation we have today with anything based on few proprietary hardware and software commonly used anywhere.

After think about ancient Plan9 model which put your personal workstation at the center of the world and "services" only as "addition" to it. In this scenario need of auth, risk of phishing etc substantially vanish.

[ Parent | on HN ]