Micro.blog

manton
manton

I continue to think that my devices are now too secure. Face ID shouldn’t freak out multiple times a day, requiring a pin. Safari shouldn’t scrap cookies every week, requiring needless extra web sign-ins. Any security beyond unlocking my Mac is usually unnecessary friction.

ayjay
ayjay

@manton I feel that the tech companies are overdoing device-level security in order to deflect attention from cloud-level security, which is where the real problems are.

In reply to
odd
odd

@manton As one that have been attempted and successfully hacked along with social engineering of myself and family members, I can certainly say that no device is ever going to be secure enough, but maybe the security ought to be better spent behind the scenes, and not so much in our face. Well, apart from that horrible Deny/Allow dialogue with the map. While my device was actively being listened to, my father allowed the request on his iPad on my go ahead, because he had another iPad in the shop being worked on. Pegasus scandal, and many 0-days later, I wish for a doubling down on security, while at the same time they can make it easier for us to use our devices. I’m all for the Touch-ID to be an alternative to the Face ID on the Pro models.

manton
manton

@odd Ugh, sorry to hear you've been hacked. The worst "hack" for me so far has been someone getting my SSN from a data breach and racking up debt in my name. Not fun but also unrelated to any device security.

manton
manton

@ayjay That rings true to me. Cloud security can impact so many more people all at once.

GlennF
GlennF

@manton I wonder if this is a usage/use case thing. My Face ID works, even when I’m wearing a mask, for days on end. I typically only have to re-enter the password after the 6-day timeout or after restarting following an upgrade. I don't have Safari set to erase cookies weekly.

mcg
mcg

@manton Everyone has different threat levels. As my phone is a gateway into my personal life and finances, I appreciate the security.

pimoore
pimoore

@mcg @manton Same here, I like the comfort knowing there are layers of security, even if it means sometimes having to re-enter a passcode. I agree with others in the thread that cloud security is a sometimes bigger factor.

pimoore
pimoore

@GlennF @manton I always just pulled my mask down if unlocking my phone. I believe the mask option of FaceID reduces the security, by how much I don’t know.

manton
manton

@GlennF That's interesting, maybe I need to re-train my Face ID... For Safari, I heard that if you don't visit a web site often, Safari will clear the cookies for it even if the expiration is months out. I might be wrong, but that's how I've explained web sites needing to sign in so often.

manton
manton

Good blog post replies on my security mini-rant from Michael Tsai and Nick Heer.

lmika
lmika

@manton Wow, he moves fast.

lmika
lmika

@manton I get annoyed by Safari doing that to cookies as well, and wish they had a setting to turn this off. Part of me wonders if the Safari team thinks it's fair game, since "everyone" is letting Safari store passwords and 2FA. Even if that's true (which is isn't), signing in is still a bit of a hassle.

odd
odd

@manton Thanks! Uff, what happened to you is bad enough. Hope you could prove it wasn’t you. Can you set a voluntary credit block with the credit information companies in the US? (Like Dun & Bradstreet).

rom
rom

@odd YIKES! I guess the password-less route is really the key to reducing the effects of social engineering. @manton

rom
rom

@manton I agree with you to some extent, but I still wish there is a way to add another factor to authenticate us on the device -- as it is, it uses only one.

Unfortunately, there are other services, third-party apps and cloud-based services, that are less secure.

pimoore
pimoore

@rom @odd @manton All the more reason passkeys can’t come soon enough.

braker1nine
braker1nine

@manton I’ve recently cranked up the lock time on 1Password. Partly because the unlock process on Mac seems to have become significantly slower

manton
manton

@braker1nine I’ve cranked it up too, to the longest setting.

rom
rom

@braker1nine if you have TouchID on your Mac, unlocking 1Password is super fast. :)

braker1nine
braker1nine

@rom I have Touch ID. But that only works if you keep your laptop open. I don’t. So Touch ID is useless to me

rom
rom

@braker1nine ah, maybe it is time to get the TouchID keyboard then (or disassemble it into a stand-alone TouchID). wink

braker1nine
braker1nine

@rom haha I do love people’s creativity. I’d love a stand-alone piece of Touch ID hardware. Or even Touch ID on the outside of the case

odd
odd

@braker1nine Doesn’t the newest Apple Smart Keyboard (or what they’re called) have Touch ID? Doesn’t help if you’re going to use another keyboard of course… @rom

braker1nine
braker1nine

@odd yeah I use a different keyboard. The apple keyboards just aren’t for me 😅

rom
rom

@odd Yes, it comes with TouchID. I agree that if you have mechanical keyboard - but someone hacked it already - made a stand-alone TouchID from that Magic keyboard. LOL

mejh
mejh

@manton I'm afraid my use of FaceID seems to mirror @GlennF, in that I use it all day every day with and without a mask; it's almost flawless.

odd
odd

@rom Hehe, yeah, I saw that! Apple might just as well make an official, external one.

renevanbelzen
renevanbelzen

@manton That amount of discomfort seems neglible compared to some kinds of employment, like in a coal mine, an oil rigg, scrapping ships for reusable materials, or worse. But I get your point, being under the thumb of a trillion dollar company is no fun.

manton
manton

@renevanbelzen For sure, it's a minor annoyance.