Re:Microsoft ruined passwords, now aims for a passwordless f...
by blitzar on Tuesday September 21, 2021 @04:36AM
(#28603109)
> Well, if you use corporate device, you implicitly trust them, don't you
Well, if you use microsoft, you implicitly trust them, don't you
Well, if you use <insert ISP>, you implicitly trust them, don't you
Well, if you use the internet, you implicitly trust them, don't you
Re:Microsoft ruined passwords, now aims for a passwordless f...
by SilverRed on Tuesday September 21, 2021 @06:59PM
(#28611081)
Yes. If you don't trust microsoft and you use windows, than it doesn't matter what authentication system you use. If you used rsa keys for auth then you would still have a problem because microsoft could steal those keys.
Re:Microsoft ruined passwords, now aims for a passwordless f...
by Xylakant on Tuesday September 21, 2021 @04:55AM
(#28603191)
> Well, if you use corporate device, you implicitly trust them, don't you? Some even sign put signature on a paper agreeing what the corporate body can do to you. Perhaps MITM your encrypted traffic with corporate installed root cert or whatever.
I may have to submit to the inspection of traffic whether I trust them or not and even if I trust them to have the best intentions, things go wrong and firewalls get hacked - and all of a sudden that nice capability is in the hands of an attacker. So even if I do trust them, I prefer mechanisms that work asymmetric.
Well, if you use corporate device, you implicitly trust them, don't you? Some even sign put signature on a paper agreeing what the corporate body can do to you. Perhaps MITM your encrypted traffic with corporate installed root cert or whatever.
Otherwise if you use your own device, in the age of encrypted HTTP and other stuff - No, an adversary or corporate firewall cannot simply read your password.