Who is responsible for preventing a child from running into a busy road and being hit by a car? And why, on the internet, does that responsibility seem to fall on everyone else?
Shouldn’t Windows just show a huge warning explaining the implications of such actions when a user who has never used the Windows Run function nor PowerShell suddenly attempts to run some suspicious code pasted form the clipboard?
Yes, WebAuthn is an open standard, but it seems that Passkeys can only be synced using Google password manager and I don't see any API that would allow the user to use a different password manager as is the case with the auto fill API.
Do you know if it's possible to see a list of stored passkeys in Android? I installed the Play Service beta, managed to create a passkey and sign in, but can't see the list of credentials anywhere in the UI.
I think that once users realize how difficult it is to transfer passkeys between their PC and mobile device, they will just ababdon them. The only risk I see is that passkeys will be synced between Android and Chrome.
I really hope that there will be an API for Passkeys like there is an API for password managers on Android.
DNS has known privacy issues, but this solution just (conviniently for them) shifts trust and data from the network operator to Google DNS or another central provider
Why is this an issue? Most websites support HTTPS. It should be required and impossible to disable. Other malicious actors could also be running such attacks even at a much smaller scale.
The pattern is that their reviewers are really bad and the appeal process is almost nonexistent. Improving the quality would probably be a huge cost and they have no real reason to do that.
The point is that if browsers block the cert it will make the MITM impossible without them releasing thieir own browser. It will be much more clear for normal uaers that the custom browser can intercept internet traffic than that "security certificate". Also good luck getting that browser into the AppStore and PlayStore or making users install the apk.