Hacker News Reader

1. Client-side certificates usage has privacy implications - https://github.com/tumi8/cca-privacy

2. Is biometric really necessary? U2F tokens already exist and are standardized (maybe not officially, I'm not sure). Chrome and Opera already support it, Mozilla's support must be coming soon (meanwhile you can use an add-on).

View on HN

I am sick of the actual motions of authenticating, and many of the 2-factor implementations out there today are terrible. (SMS, really? What happens when your phone is stolen? How do you protect against an angry lover? What a joke)

U2F dongles aren't much better.

Also, a quick glance at that link seems to indicate attacker needs some sort of MITM access? Is it anything more than a replay attack?

Reply on news.ycombinator.com