Matthew Miller :donor: / is on Nostr

Full Stack dev, WebAuthn expert. Creator of SimpleWebAuthn, maintainer of py_webauthn, steward of webauthn.io. Duonaut.

My toots are my own.

Last Notes

2024-03-22 02:44:15

You know what's amazing? How well the big AI players have tamped down on the sustainability/energy consumption narrative compared to Bitcoin. When bitcoin miners consumed the entire output of small hydro-electric dams there were dozens of featured articles condemning it. But who's writing the articles these days about big cloud providers consuming ever-increasing amounts of energy and cooling to power the infrastructure capable of running LLM stuff? Hardly anyone! 🫠

2024-01-22 18:03:04

I'm trying to manage my Microsoft Account protections, with an ultimate goal of protecting it with a passkey and maybe dropping my password to make the account truly paswordless, but I'm running into some weird idiosyncracies on https://account.live.com/proofs/manage/additional:
I couldn't actually see the WebAuthn option at all in the latest macOS Safari - I had to switch to macOS Chrome before the "Windows Hello" option appeared that let me then register an iCloud Keychain-synced passkey.
I removed my phone number as a second factor because SIM jacking is a thing. However the next time I tried to log in I was prompted to add my phone number to "never lose access to your Microsoft account"...but I have other BETTER second-factors configured, so why would I want to continue to allow use of weak SMS OTP? At least I could cancel out and continue on without giving them my phone number again...
Attempting to turn on "Passwordless account" forces you down a path that wants you to set up the Microsoft authenticator app. But I already have a synced passkey in the mix, so why are you bothering with app-based push? Push bombing is also an easy way to get past 2FA protections.
Another example of how the left hand doesn't know what the right hand is doing...
#microsoft #passkeys #passwordless