News for hackers. Stuff that matters.

A comment on FTC Puts Hundreds of Businesses on Notice about Fake Reviews. Parent comment

Re:FTC Puts Hundreds of Businesses on Notice about Fake Reviews by cmeacham98 on Thursday October 14, 2021 @10:04AM (#28864354)
I'm pretty sure that poor passwords ("password1!") and password reuse combined dwarf basically all other password-related security issues, thus getting users to use a randomly generated password on every website is a magnitude of order more secure.

On top of that, in cases of XSS or a MiTM you've probably already lost and no password alternative will help you.

[ Parent | on HN ]
Re:FTC Puts Hundreds of Businesses on Notice about Fake Reviews by dotancohen on Thursday October 14, 2021 @10:19AM (#28864603)
Webauthn is secure even in the case of XSS and Mitm, in the sense that the attackers still cannot access the credentials without user intervention. It tool a long time to convince me, too.

https://webauthn.me/introduction

[ Parent | on HN ]
Re:FTC Puts Hundreds of Businesses on Notice about Fake Reviews by cmeacham98 on Thursday October 14, 2021 @10:36AM (#28864859)
True but mostly meaningless. XSS and MiTM allow attackers to take over and pretend to be the user after a legit user logs in. The attacker cannot store the credentials and use them later, but they have full access in the moment.
[ Parent | on HN ]