News for hackers. Stuff that matters.

A comment on FTC Puts Hundreds of Businesses on Notice about Fake Reviews. Parent comment

Re:FTC Puts Hundreds of Businesses on Notice about Fake Reviews by threeseed on Thursday October 14, 2021 @07:03AM (#28862726)
It sort of has happened for Apple users.

For all sites whenever you signup for a website a random password is generated. And then when you re-visit the site you use FaceID/TouchID to automatically pre-populate the password. At that point it really isn't a password in the traditional sense.

And for an increasing number of sites it bypasses this step entirely and just lets me use FaceID/TouchID.

[ Parent | on HN ]
Re:FTC Puts Hundreds of Businesses on Notice about Fake Reviews by netizen-936824 on Thursday October 14, 2021 @07:34AM (#28862939)
Why single out apple? This is the experience for anyone who uses a modern password manager
[ Parent | on HN ]
Re:FTC Puts Hundreds of Businesses on Notice about Fake Reviews by daedalus_f on Thursday October 14, 2021 @08:02AM (#28863157)
Most people don’t and won’t change if change requires effort. In contrast by making a password manager functionality the default on Mac/iOS, Apple carries the average user into better security.
[ Parent | on HN ]
Re:FTC Puts Hundreds of Businesses on Notice about Fake Reviews by dotancohen on Thursday October 14, 2021 @09:56AM (#28864224) 

  > really isn't a password in the traditional sense.
Can it be sniffed out with XSS? Can it be sniffed out over the wire on the university Mitm'd network? Can it be stored on the server in plain text?

The user experience might have changed, but many of the security aspects have not.

[ Parent | on HN ]
Re:FTC Puts Hundreds of Businesses on Notice about Fake Reviews by cmeacham98 on Thursday October 14, 2021 @10:04AM (#28864354)
I'm pretty sure that poor passwords ("password1!") and password reuse combined dwarf basically all other password-related security issues, thus getting users to use a randomly generated password on every website is a magnitude of order more secure.

On top of that, in cases of XSS or a MiTM you've probably already lost and no password alternative will help you.

[ Parent | on HN ]
Re:FTC Puts Hundreds of Businesses on Notice about Fake Reviews by dotancohen on Thursday October 14, 2021 @10:19AM (#28864603)
Webauthn is secure even in the case of XSS and Mitm, in the sense that the attackers still cannot access the credentials without user intervention. It tool a long time to convince me, too.

https://webauthn.me/introduction

[ Parent | on HN ]
Re:FTC Puts Hundreds of Businesses on Notice about Fake Reviews by cmeacham98 on Thursday October 14, 2021 @10:36AM (#28864859)
True but mostly meaningless. XSS and MiTM allow attackers to take over and pretend to be the user after a legit user logs in. The attacker cannot store the credentials and use them later, but they have full access in the moment.
[ Parent | on HN ]