konha
Joined 7 years ago
Joined 7 years ago
The number of revoked tokens compared to all active tokens should still be tiny in those systems, wouldn’t you agree?
> Everyone else wants immediate revocation of rights, not waiting for a token to expire.
With a revocation list you can still have that. Once you propagated your revocation to all relying parties the token effectively expires early.
You’d need to make sure the process is somewhat predictable, like running the vacuum on a set schedule so you know for sure what maximum amount of time a deletion request will take.
https://lets-go.alexedwards.net/ https://lets-go-further.alexedwards.net/
The merchant of record model.
There’s a balance between individuals rights to privacy and what makes law enforcement easier.
One argument against broad surveillance measures like this one is that surveillance infrastructure is easy to implement and hard to get rid of again. You might be fine with the laws that are enforced with it today, but you might not be with what it’s used for in the future.
> Emergency legislation to exonerate wrongfully convicted Post Office workers has completed its journey through Scottish Parliament and each will now receive initial compensation of £600,000, with the ability to claim more as financial redress for their suffering.
Passkeys can:
- Replace the whole login (including discovery of the user id)
- Just replace the password, after a user specified a user id
- Be used as a second factor just like TOTP
They are definitely more phishing resistant for what it’s worth, even if just used for MFA. TOTP codes can be copied manually by an unsuspecting user.