News for hackers. Stuff that matters.

A comment on Safari tries to fill username. Parent comment

Re:Safari tries to fill username by tremon on Friday May 28, 2021 @07:36AM (#27314136)
Yes, it starts its life as a password. After that, it is never communicated ever again, and therefore, after the initial exchange, it's something you have.

It seems to me you are ascribing properties to "something you have" that aren't warranted. The "something you have" needs to prove you were party to the initial exchange, not necessarily that you were the only one present -- that's why we use two factors, and not only TOTP.

[ Parent | on HN ]
Re:Safari tries to fill username by thaumasiotes on Friday May 28, 2021 @07:47AM (#27314204)
I can't follow what you're trying to say.

> The "something you have" needs to prove you were party to the initial exchange

This is not something that can be proven at all. Accordingly, proving it is not a goal. Anything that can be had can also be transferred. Your delegated agent's login attempt is just as valid as yours is.

[ Parent | on HN ]