• 1 Post
  • 76 Comments
Joined 1 year ago
cake
Cake day: June 6th, 2023

help-circle






  • That was also my question. A broader question is how to access services on the local network that are announced through local DNS? Like your router’s web interface or any similar device.

    Can you have split routing? Most queries go to our preferred DNSoverTLS endpoint, but some go to DNS53 on the local network.

    This would also solve the captive portal if the host used to detect captive portals is always resolved locally.














  • You are not wrong, but you we should understand what class of attacks we are protecting against. Will biometrics stop your maid from using your device? Probably less. Will it stop the FBI? Not so sure.

    Now, you may say, an FBI raid is not what you worry about on a daily basis. Agree.

    If you are trying to keep the photos on your device safe from snooping, your good. Attacker needs the device and your fingerprint.

    When we talk online accounts, I’d count device+fingerprint as one factor. Sure, the maid from the example above can’t login into your gmail without your fingerprint, but most attacks are online. Your device sends a token to gmail, a cookie, a String; that’s like a password. One factor.

    Technically, it’s slightly better than a password, because this token can be short-lived (although often it’s not), could be cryptographic signature to be used exactly once (although…), you cannot brute-force guess the token… But IF the token leaks, the attacker has full access (or enough to cause damage).

    That’s why I would suggest an independent second factor, such as password. Yes, a password. Not for your daily routine (biometrics+device is much better), but maybe for high-risk operations.