Hacker News new | past | comments | ask | show | jobs | submit login

Does this passwordless future still involve getting a cookie in your browser that can be stolen and used from an attackers machine? If so, we still have a problem to fix.



AFAIK Token binding was designed to solve this problem, but was removed from Google Chrome for being too complicated for the benefits it brought.

Not sure if there is anything else in the works.


How would you propose doing sessions instead?


This seemed promising but it doesn’t look like it had any traction https://www.rfc-editor.org/rfc/rfc8471




Consider applying for YC's Spring batch! Applications are open till Feb 11.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: