alpinefolk

lauren, 1 year ago to random

**** The Google passkeys threat model ****

So let's pull this together. Google says:

"When you create a passkey on a device, anyone with access to that device and the ability to unlock it, can sign in to your Google Account."

They then suggest keeping physical control of your devices is easier than watching for phishing attempts.

The reality is that every day many phones are stolen and successfully unlocked (or are already unlocked when stolen) by thieves. We've seen the reports lately of iPhone users being totally locked out of their Apple accounts when thieves reset security keys -- and Apple can't help.

But whether Android or iPhone, the bottom line is that as I understand this, stolen unlocked phones using passkeys for account security give the thieves complete access to those accounts, until such a time as the rightful owner manages to revoke them -- which could be hours in many situations out in public, far too late.

To me, this is putting too much faith in the physical security of the devices, when we KNOW that every day many are stolen, unlocked, and abused. Having passkeys in such situations could make even more accounts instantly vulnerable, given that the passkeys wouldn't need additional authentication to be used by the thief in these scenarios.

atomicpoet, 1 year ago to fediversenews

You like stats and graphs?

I like them quite a lot.

https://fedidb.org has recently left beta.

It helps you do a deep dive of Fediverse software and servers with good looking charts and tables!

This is another great project by @dansup.

@fediversenews

atomicpoet, 1 year ago to fediversenews

🎈🥳 https://calckey.org is LIVE! 🥳🎈

This is #Calckey's official landing site for the project now!

Not only does it have incredible eye candy, it really demonstrates what's so special about the project!

Use it for finding Calckey servers, compatible apps, the official app, documentation, merch, and source code!

What do you all think of this https://calckey.org?

@fediversenews

Mastodon, 1 year ago to random

You asked for it, and it’s coming. Quote posts, search, and groups are on their way. In the meantime, check out the new onboarding experience launching today. https://blog.joinmastodon.org/2023/05/a-new-onboarding-experience-on-mastodon/