Ah, OK. This is just another term for passkey (in this case one that's resident on my Windows laptop).

So even when I already have a passkey synced through 1Password, eBay is going to suggest I create a separate passkey that's native to the OS I happen to be using at the moment. This is only going to confuse people and discourage the adoption of passkeys.

I love the technology behind passkeys, but they're not (yet) anywhere close to qualifying as usable security.

A separate question regarding logging in with biometrics. WTF is this sign in with your PIN, face, or fingerprint option that eBay wants me to choose? Is this separate from a passkey? I can't find any documentation on this.

Multifaceted, high-precision campaign targets malicious and benevolent hackers alike.

Yearlong supply-chain attack targeting security pros steals 390K credentials

Multifaceted, high-precision campaign targets malicious and benevolent hackers alike.

Ars Technica (arstechnica.com)

Apple's Passwords app for macOS and iOS has been out for 3 months and is only now adding HTTPS when downloading icons for password entries? Is there any technical reason why someone chose HTTP over HTTPS, or was this just a boneheaded oversight?

@briankrebs

Yeah, I plan to hold onto my 2015 Honda Fit for the indefinite future. I see replies in this thread suggesting we disable the modem. I'll bet money that doing so will void multiple warranties so ‍️

On Tuesday, researchers unveiled BadRAM, an attack that completely undermines security assurances that chipmaker AMD makes to users of one of its most expensive and well-fortified microprocessor product lines. Starting with the AMD Epyc 7003 processor, a feature known as SEV-SNP has provided the cryptographic means AMD says proves that a VM hasn’t been compromised.

BadRAM is an attack that a server admin can carry out in minutes, using either about $10 of hardware, or in some cases, software only, to cause DDR4 or DDR5 memory modules to misreport during bootup the amount of memory capacity they have. From then on, SEV-SNP will be permanently made to suppress the cryptographic hash attesting its integrity even when the VM has been badly compromised.

AMD’s trusted execution environment blown wide open by new BadRAM attack

Attack bypasses AMD protection promising security, even when a server is compromised.

Ars Technica (arstechnica.com)

Do you have experience implementing passkey authentication on your organization’s website or network? Have you supported the use of passkeys for end users? Have you spent time testing the way passkeys sync/work across platforms (Apple, Windows, etc.) or on different sites that have rolled out this new authentication paradigm? If so, I’m eager to speak with for an article I’m working on. Please DM me on Signal (DanArs.82) or (if you must) DM me here. Please boost for reach.

@threatresearch @briankrebs

I've been doing it a fair amount over the past 6 months. Highly recommended.

@briankrebs

Do it!

It’s not every day that a security researcher acquires the ability to generate counterfeit HTTPS certificates, track email activity, and execute code of his choice on thousands of servers—all in a single blow that cost only $20 and a few minutes to land. But that’s exactly what happened recently to Benjamin Harris.

Rogue WHOIS server gives researcher superpowers no one should ever have

mobi top-level-domain managers changed the location of its WHOIS server. No one got the memo.

Ars Technica (arstechnica.com)