home.social

Search

1000 results for “erikjan”

  1. Erik-Jan @[email protected] ·

    I was about to propose our upcoming workshop on #clustercomputing for social scientists with #rstats but I just heard that it's fully booked!

    surf.nl/en/agenda/cluster-comp

    #clustercomputing #rstats
  2. Erik-Jan @erikjan ·

    We just had all the Applied Data Science master thesis students of the group at present their work in an informal session. They are doing wonderful stuff on Network Data analysis, LLM bias assessment, missing data methods, synthetic data generation, and more 💪

    #humandatascience #uniutrecht
  3. Erik-Jan @erikjan ·

    I'm really proud to announce that we released version 1.0 of our :python: package {metasyn} today!

    github.com/sodascience/metasyn

    Metasyn can generate in a transparent and privacy-friendly way. Sensitive data owners can use it to make their data more and research thereon more

    We put a lot of effort in the readme and documentation to make it (hopefully) super easy to get started!

    Supported by and

    #python #syntheticdata #accessible #reproducible #odissei_nl #uniutrecht
  4. Erik-Jan @erikjan ·

    After some nice collaboration, version 0.3.0 of the penalised package "pensynth" is now available on CRAN! :rstats:

    cran.r-project.org/package=pen

    Do you want to use the synthetic control method for with observational data? Try it out!

    (⚡ It's faster than vanilla synthetic controls even without penalty)

    #opensource #rstats #syntheticcontrol #causalinference
  5. Erik-Jan @erikjan ·

    New :rstats: package! For a project, I had to implement penalized synthetic control estimation, and I thought it would be nice to implement it "properly" so others could use it too.

    github.com/vankesteren/pensynth

    It also has a basic form of cross-validation to automatically determine the penalty parameter.

    Feel free to try out / comment / collaborate! :air_quotes_left:

    #rstats #statistics #economics #syntheticcontrol #policyevaluation #causalinference
  6. Erik-Jan @erikjan ·

    Was going through old repositories; found this nice document on estimating treatment effect of a medicine for a single patient with seizures :rstats:

    It goes from simple to complex:
    - & summary statistics
    - Poisson regression (glm) with a treatment dummy
    - Penalized poisson regression to deal with 0s
    - Correcting for autocorrelation
    - Poisson model with
    - Correcting for autocorrelation and

    github.com/vankesteren/single_

    #rstats #visualization #bayesian #stan #rstanarm #bayesfactors
  7. Erik-Jan @erikjan ·

    @avehtari @modrak_m

    I really want to believe you because this was my intuition as well. I double checked it with a structural equation model:

    - one model where residual covariance is constrained to be 0
    - one model where residual covariance is estimated freely

    Fit with , check the regression parameter estimates...

    they are the same.

    see here: gist.github.com/vankesteren/31

    Do you mean something else than this?

    #lavaan
  8. Erik-Jan @erikjan ·

    Today we're (odissei-soda.nl) teaching a workshop on causal inference for policy evaluation for social scientists in the Netherlands!

    There are some really nice discussions ☺️

    Full workshop materials with lectures and :rstats: practicals here (CC-BY):

    causalpolicy.nl

    #odissei
  9. Erik-Jan van Kesteren @[email protected] ·

    #introduction

    Hi everyone 👋

    I'm an Assistant Professor at Utrecht University's dept. of Methodology & Statistics, working in data science for the social sciences.

    I do not post a lot, but when I do it's likely about #statistics #datascience #probabilisticprogramming #syntheticdata #openscience #rstats or #teaching

    I'm also the (proud) team lead of the ODISSEI Social Data Science team: odissei-soda.nl. So I'll probably post about all the cool things our team does too!

    #introduction #statistics #datascience #probabilisticprogramming #syntheticdata #openscience
  10. Erik van Straten @[email protected] ·

    @roelgrif : en dit kabinet geeft ook niets om onze privacy.

    "Slimme oplossingen" - slim voor wie?

    todon.nl/@ErikvanStraten/11648

    #CE #ISO27001 #NEN7510 #BullShitCerts#Topicus #PGO #MedischeGegevens #EHDS #AVG #Mitz #MijnMitz #BigTechIsEvil #CloudflareIsEvil

    #ce #iso27001 #nen7510 #bullshitcerts #pgo #medischegegevens
  11. Erik van Straten @[email protected] ·

    @roelgrif : en dit kabinet geeft ook niets om onze privacy.

    "Slimme oplossingen" - slim voor wie?

    todon.nl/@ErikvanStraten/11648

    #CE #ISO27001 #NEN7510 #BullShitCerts#Topicus #PGO #MedischeGegevens #EHDS #AVG #Mitz #MijnMitz #BigTechIsEvil #CloudflareIsEvil

    #ce #iso27001 #nen7510 #bullshitcerts #pgo #medischegegevens
  12. Erik van Straten @[email protected] ·

    @roelgrif : en dit kabinet geeft ook niets om onze privacy.

    "Slimme oplossingen" - slim voor wie?

    todon.nl/@ErikvanStraten/11648

    #CE #ISO27001 #NEN7510 #BullShitCerts#Topicus #PGO #MedischeGegevens #EHDS #AVG #Mitz #MijnMitz #BigTechIsEvil #CloudflareIsEvil

    #ce #iso27001 #nen7510 #bullshitcerts #pgo #medischegegevens
  13. Erik van Straten @[email protected] ·

    @roelgrif : en dit kabinet geeft ook niets om onze privacy.

    "Slimme oplossingen" - slim voor wie?

    todon.nl/@ErikvanStraten/11648

    #CE #ISO27001 #NEN7510 #BullShitCerts#Topicus #PGO #MedischeGegevens #EHDS #AVG #Mitz #MijnMitz #BigTechIsEvil #CloudflareIsEvil

    #ce #iso27001 #nen7510 #bullshitcerts #pgo #medischegegevens
  14. Erik van Straten @[email protected] ·

    HET WEB IS EEN MIJNENVELD

    Terwijl:

    https:⧸⧸mijn.benu-apotheek2026.com/index.php
    https:⧸⧸www.benu-apotheek2026.com

    nog steeds live zijn - zonder phishingwaarschuwing (zie todon.nl/@ErikvanStraten/11653 van 14 dagen geleden) kreeg ik afgelopen nacht een SMS die verwijst naar een andere nepsite:

    https:⧸⧸benu-online.net

    Als u op de getoonde pagina op "Nu bijwerken" klikt, opent een formulier waarin om heel veel persoonsgegevens wordt gevraagd, nl. naam, geslacht, geboortedatum, IBAN, e-mailadres, telefoonnummer en woonadres.

    Als u die gegevens invult, wordt u waarschijnlijk binnenkort gebeld door een bankhelpdeskfraudeur, of door "de politie" die doorgeeft dat er inbrekers in uw buurt actief zijn - en dat er daarom een agent langskomt om uw waardevolle bezittingen op te komen halen (inclusief uw bankpas en pincode).

    Op dezelfde server (d.w.z. het IP-adres, aldus het RELATIONS tabblad van virustotal.com/gui/ip-address/) was ook de volgende nepsite actief (momenteel niet meer):

    https:⧸⧸mijnbenu.net

    Nb. ik vervang https:// steeds door https:⧸⧸ om onbedoeld openen te voorkomen.

    #InternetIsEenMijnenveld #Phishing #CloudflareIsEvil #BigTechIsEvil #GoogleIsEvil #LetsEncryptIsEvil #Cloudflare #Google #LetsEncrypt #BigTech #DV #DomainValidated #DVcertsSuck #DVcerts

    #internetiseenmijnenveld #phishing #cloudflareisevil #bigtechisevil #googleisevil #letsencryptisevil
  15. Erik van Straten @[email protected] ·

    HET WEB IS EEN MIJNENVELD

    Terwijl:

    https:⧸⧸mijn.benu-apotheek2026.com/index.php
    https:⧸⧸www.benu-apotheek2026.com

    nog steeds live zijn - zonder phishingwaarschuwing (zie todon.nl/@ErikvanStraten/11653 van 14 dagen geleden) kreeg ik afgelopen nacht een SMS die verwijst naar een andere nepsite:

    https:⧸⧸benu-online.net

    Als u op de getoonde pagina op "Nu bijwerken" klikt, opent een formulier waarin om heel veel persoonsgegevens wordt gevraagd, nl. naam, geslacht, geboortedatum, IBAN, e-mailadres, telefoonnummer en woonadres.

    Als u die gegevens invult, wordt u waarschijnlijk binnenkort gebeld door een bankhelpdeskfraudeur, of door "de politie" die doorgeeft dat er inbrekers in uw buurt actief zijn - en dat er daarom een agent langskomt om uw waardevolle bezittingen op te komen halen (inclusief uw bankpas en pincode).

    Op dezelfde server (d.w.z. het IP-adres, aldus het RELATIONS tabblad van virustotal.com/gui/ip-address/) was ook de volgende nepsite actief (momenteel niet meer):

    https:⧸⧸mijnbenu.net

    Nb. ik vervang https:// steeds door https:⧸⧸ om onbedoeld openen te voorkomen.

    #InternetIsEenMijnenveld #Phishing #CloudflareIsEvil #BigTechIsEvil #GoogleIsEvil #LetsEncryptIsEvil #Cloudflare #Google #LetsEncrypt #BigTech #DV #DomainValidated #DVcertsSuck #DVcerts

    #internetiseenmijnenveld #phishing #cloudflareisevil #bigtechisevil #googleisevil #letsencryptisevil
  16. Erik van Straten @[email protected] ·

    HET WEB IS EEN MIJNENVELD

    Terwijl:

    https:⧸⧸mijn.benu-apotheek2026.com/index.php
    https:⧸⧸www.benu-apotheek2026.com

    nog steeds live zijn - zonder phishingwaarschuwing (zie todon.nl/@ErikvanStraten/11653 van 14 dagen geleden) kreeg ik afgelopen nacht een SMS die verwijst naar een andere nepsite:

    https:⧸⧸benu-online.net

    Als u op de getoonde pagina op "Nu bijwerken" klikt, opent een formulier waarin om heel veel persoonsgegevens wordt gevraagd, nl. naam, geslacht, geboortedatum, IBAN, e-mailadres, telefoonnummer en woonadres.

    Als u die gegevens invult, wordt u waarschijnlijk binnenkort gebeld door een bankhelpdeskfraudeur, of door "de politie" die doorgeeft dat er inbrekers in uw buurt actief zijn - en dat er daarom een agent langskomt om uw waardevolle bezittingen op te komen halen (inclusief uw bankpas en pincode).

    Op dezelfde server (d.w.z. het IP-adres, aldus het RELATIONS tabblad van virustotal.com/gui/ip-address/) was ook de volgende nepsite actief (momenteel niet meer):

    https:⧸⧸mijnbenu.net

    Nb. ik vervang https:// steeds door https:⧸⧸ om onbedoeld openen te voorkomen.

    #InternetIsEenMijnenveld #Phishing #CloudflareIsEvil #BigTechIsEvil #GoogleIsEvil #LetsEncryptIsEvil #Cloudflare #Google #LetsEncrypt #BigTech #DV #DomainValidated #DVcertsSuck #DVcerts

    #internetiseenmijnenveld #phishing #cloudflareisevil #bigtechisevil #googleisevil #letsencryptisevil
  17. Erik van Straten @[email protected] ·

    HET WEB IS EEN MIJNENVELD

    Terwijl:

    https:⧸⧸mijn.benu-apotheek2026.com/index.php
    https:⧸⧸www.benu-apotheek2026.com

    nog steeds live zijn - zonder phishingwaarschuwing (zie todon.nl/@ErikvanStraten/11653 van 14 dagen geleden) kreeg ik afgelopen nacht een SMS die verwijst naar een andere nepsite:

    https:⧸⧸benu-online.net

    Als u op de getoonde pagina op "Nu bijwerken" klikt, opent een formulier waarin om heel veel persoonsgegevens wordt gevraagd, nl. naam, geslacht, geboortedatum, IBAN, e-mailadres, telefoonnummer en woonadres.

    Als u die gegevens invult, wordt u waarschijnlijk binnenkort gebeld door een bankhelpdeskfraudeur, of door "de politie" die doorgeeft dat er inbrekers in uw buurt actief zijn - en dat er daarom een agent langskomt om uw waardevolle bezittingen op te komen halen (inclusief uw bankpas en pincode).

    Op dezelfde server (d.w.z. het IP-adres, aldus het RELATIONS tabblad van virustotal.com/gui/ip-address/) was ook de volgende nepsite actief (momenteel niet meer):

    https:⧸⧸mijnbenu.net

    Nb. ik vervang https:// steeds door https:⧸⧸ om onbedoeld openen te voorkomen.

    #InternetIsEenMijnenveld #Phishing #CloudflareIsEvil #BigTechIsEvil #GoogleIsEvil #LetsEncryptIsEvil #Cloudflare #Google #LetsEncrypt #BigTech #DV #DomainValidated #DVcertsSuck #DVcerts

    #internetiseenmijnenveld #phishing #cloudflareisevil #bigtechisevil #googleisevil #letsencryptisevil
  18. Jan Vlug @[email protected] ·

    @ErikJonker Hoogste tijd om de staat #Palestina te erkennen.

    "As of September 2025, the State of Palestine is recognized as a sovereign state by 157 of the 193 member states of the United Nations (UN), or just over 81% of all UN members."

    en.wikipedia.org/wiki/Internat

    #palestina
  19. Erik van Straten @[email protected] ·

    @ScottHelme from scotthelme.co.uk/open-sourcing:

    "It now requires an exact match or a true subdomain."

    That is probably insufficient. Please read github.com/w3ctag/design-revie by Dirk Balfanz (Google, screenshot of part of the entry below).

    Google doesn't want potentially malicious (e.g. sites.google.com) or "forgotten" subdomains (developer.mozilla.org/en-US/do) to be able to handle passkeys.

    As shown in Google's example, it's best to explicitly whitelist ALL subdomains thay may interact with passkeys to prevent (future) oversight.

    PS this is exactly what I meant with "and in specific cases using subdomains and faulty server webauthn implementations" in todon.nl/@ErikvanStraten/11659.

    Edited to add: many commercial websites use subdomains where third parties have access to (such as track.example.com), for example used in mass mailings. You don't want a gone rogue third party to be able to handle WebAuthn registrations and logins on your subdomain used by them.

    According to the RELATIONS tab in virustotal.com/gui/domain/repo your domain has (at least) 3.2K subdomains. Do you trust each of them?

    #Passkeys #SubDomainTakeOver #Subdomains #SubDomainHijacking

    #passkeys #subdomaintakeover #subdomains #subdomainhijacking
  20. Erik van Straten @[email protected] ·

    @ScottHelme from scotthelme.co.uk/open-sourcing:

    "It now requires an exact match or a true subdomain."

    That is probably insufficient. Please read github.com/w3ctag/design-revie by Dirk Balfanz (Google, screenshot of part of the entry below).

    Google doesn't want potentially malicious (e.g. sites.google.com) or "forgotten" subdomains (developer.mozilla.org/en-US/do) to be able to handle passkeys.

    As shown in Google's example, it's best to explicitly whitelist ALL subdomains thay may interact with passkeys to prevent (future) oversight.

    PS this is exactly what I meant with "and in specific cases using subdomains and faulty server webauthn implementations" in todon.nl/@ErikvanStraten/11659.

    Edited to add: many commercial websites use subdomains where third parties have access to (such as track.example.com), for example used in mass mailings. You don't want a gone rogue third party to be able to handle WebAuthn registrations and logins on your subdomain used by them.

    According to the RELATIONS tab in virustotal.com/gui/domain/repo your domain has (at least) 3.2K subdomains. Do you trust each of them?

    #Passkeys #SubDomainTakeOver #Subdomains #SubDomainHijacking

    #passkeys #subdomaintakeover #subdomains #subdomainhijacking
  21. Erik van Straten @[email protected] ·

    @ScottHelme from scotthelme.co.uk/open-sourcing:

    "It now requires an exact match or a true subdomain."

    That is probably insufficient. Please read github.com/w3ctag/design-revie by Dirk Balfanz (Google, screenshot of part of the entry below).

    Google doesn't want potentially malicious (e.g. sites.google.com) or "forgotten" subdomains (developer.mozilla.org/en-US/do) to be able to handle passkeys.

    As shown in Google's example, it's best to explicitly whitelist ALL subdomains thay may interact with passkeys to prevent (future) oversight.

    PS this is exactly what I meant with "and in specific cases using subdomains and faulty server webauthn implementations" in todon.nl/@ErikvanStraten/11659.

    Edited to add: many commercial websites use subdomains where third parties have access to (such as track.example.com), for example used in mass mailings. You don't want a gone rogue third party to be able to handle WebAuthn registrations and logins on your subdomain used by them.

    According to the RELATIONS tab in virustotal.com/gui/domain/repo your domain has (at least) 3.2K subdomains. Do you trust each of them?

    #Passkeys #SubDomainTakeOver #Subdomains #SubDomainHijacking

    #passkeys #subdomaintakeover #subdomains #subdomainhijacking
  22. Erik van Straten @[email protected] ·

    @ScottHelme from scotthelme.co.uk/open-sourcing:

    "It now requires an exact match or a true subdomain."

    That is probably insufficient. Please read github.com/w3ctag/design-revie by Dirk Balfanz (Google, screenshot of part of the entry below).

    Google doesn't want potentially malicious (e.g. sites.google.com) or "forgotten" subdomains (developer.mozilla.org/en-US/do) to be able to handle passkeys.

    As shown in Google's example, it's best to explicitly whitelist ALL subdomains thay may interact with passkeys to prevent (future) oversight.

    PS this is exactly what I meant with "and in specific cases using subdomains and faulty server webauthn implementations" in todon.nl/@ErikvanStraten/11659.

    Edited to add: many commercial websites use subdomains where third parties have access to (such as track.example.com), for example used in mass mailings. You don't want a gone rogue third party to be able to handle WebAuthn registrations and logins on your subdomain used by them.

    According to the RELATIONS tab in virustotal.com/gui/domain/repo your domain has (at least) 3.2K subdomains. Do you trust each of them?

    #Passkeys #SubDomainTakeOver #Subdomains #SubDomainHijacking

    #passkeys #subdomaintakeover #subdomains #subdomainhijacking
  23. Erik van Straten @[email protected] ·

    @oatmeal : one day later I found jewishnews.co.uk/keir-starmer- (see todon.nl/@ErikvanStraten/11656 <- corrected 15:18 +0200) which is even more convincing.

    Politicians with Zionist relatives or friends in Israel, or those being sponsored or bribed by Zionist organisations, are a huge problem in the western world.

    For example, in NL the defence minister, Dilan Yesilgöz (she fled Turkey with her parents when she was young, and now she also hates asylum seekers) is maried to a Jew. He has two daughters from an earlier marriage, I would not be surprised is one or both of them live in Israel. She is an extreme Zionist.

    Also Kamala Harris is married to a Jew, Doug Emhoff, who fights "AntiSemitism" (i.e. AntiZionism): forward.com/news/antisemitism-.

    #ZionismIsFascism #AntiZionismIsNotAntiSemitism #StopIHRA #DefinitionOfAntiSemitism #DefinitionOfAntiSemitismHijackedByZionists #FrancescaAlbaneseIsRight #DaniDayanToICC

    #zionismisfascism #antizionismisnotantisemitism #stopihra #definitionofantisemitism #definitionofantisemitismhijackedbyzionists #francescaalbaneseisright
  24. Erik van Straten @[email protected] ·

    @pietkuip : uit cjo.nl/over-het-centraal-joods:
    ❝
    In het Centraal Joods Overleg (CJO) werken de voornaamste joodse organisaties samen.
    ❞
    Niet alle. Zij vertegenwoordigen beslist niet ALLE Joden in Nederland.

    ❝
    Het CJO houdt zich bezig met zaken in Nederland. Kwesties die Israël betreffen liggen op het terrein van organisaties als CIDI en FNZ.
    ❞
    De voorzitter (ultraZionist Chanan Hertzberger) "vergeet" dus wat er op hun website staat.

    In todon.nl/@ErikvanStraten/11652 verwijs ik naar een artikel (uit 2019) dat de splijting van de Joodse gemeenschap in NL toelicht a.d.h.v. twee gelijktijdige kristalnacht-herdenkingen. Uit dat artikel:
    ❝
    In het CJO participeren naast de drie joodse kerkgenootschappen: het Nederlands-Israëlitisch Kerkgenootschap (NIK), het Nederlands Verbond voor Progressief Jodendom (NVPI) en het Portugees-Israëlitisch Kerkgenootschap (PIK), ook de Federatie Nederlandse Zionisten (FNZ) en het Centrum Informatie en Documentatie Israël (CIDI).
    ❞

    Een grove leugen in nl.wikipedia.org/wiki/Centraal:
    ❝
    Het stelt zich daartoe tot doel een verbindende rol te spelen tussen de verschillende groepen binnen de Joodse gemeenschap.
    ❞
    Bedoeld wordt "de Zionistische gemeenschap".

    @ovb69

    #ZionismeIsFascisme #NietAlleJodenZijnZionisten #IsraelTerroristState #ZionistenZijnFascisten #FrancescaAlbaneseIsRight

    #zionismeisfascisme #nietallejodenzijnzionisten #israelterroriststate #zionistenzijnfascisten #francescaalbaneseisright
  25. Erik van Straten @[email protected] ·

    @pietkuip : uit cjo.nl/over-het-centraal-joods:
    ❝
    In het Centraal Joods Overleg (CJO) werken de voornaamste joodse organisaties samen.
    ❞
    Niet alle. Zij vertegenwoordigen beslist niet ALLE Joden in Nederland.

    ❝
    Het CJO houdt zich bezig met zaken in Nederland. Kwesties die Israël betreffen liggen op het terrein van organisaties als CIDI en FNZ.
    ❞
    De voorzitter (ultraZionist Chanan Hertzberger) "vergeet" dus wat er op hun website staat.

    In todon.nl/@ErikvanStraten/11652 verwijs ik naar een artikel (uit 2019) dat de splijting van de Joodse gemeenschap in NL toelicht a.d.h.v. twee gelijktijdige kristalnacht-herdenkingen. Uit dat artikel:
    ❝
    In het CJO participeren naast de drie joodse kerkgenootschappen: het Nederlands-Israëlitisch Kerkgenootschap (NIK), het Nederlands Verbond voor Progressief Jodendom (NVPI) en het Portugees-Israëlitisch Kerkgenootschap (PIK), ook de Federatie Nederlandse Zionisten (FNZ) en het Centrum Informatie en Documentatie Israël (CIDI).
    ❞

    Een grove leugen in nl.wikipedia.org/wiki/Centraal:
    ❝
    Het stelt zich daartoe tot doel een verbindende rol te spelen tussen de verschillende groepen binnen de Joodse gemeenschap.
    ❞
    Bedoeld wordt "de Zionistische gemeenschap".

    @ovb69

    #ZionismeIsFascisme #NietAlleJodenZijnZionisten #IsraelTerroristState #ZionistenZijnFascisten #FrancescaAlbaneseIsRight

    #zionismeisfascisme #nietallejodenzijnzionisten #israelterroriststate #zionistenzijnfascisten #francescaalbaneseisright
  26. Erik van Straten @[email protected] ·

    @ScottHelme : I am not advocating passwords per sé, and neither am I stating that private keys are sent to relying party servers.

    One of the controversies is whether the user has access to their own private keys. If they don't, malware cannot steal them, but vendor lock-in is the price they pay. However, with malware on their device, an AitM (in the device) can deceive them in lots of ways - including taking over their passkey protected accounts. Real victims do not care whether such attacks are "out of scope" for passkeys - according to tech-bro's.

    Passkeys do have advantages but most people are overwhelmed when every story they read mentions asymmetric cryptography - as if *that* makes passkeys strong: IMO that's a myth.

    Repeating (from todon.nl/@ErikvanStraten/11655) what makes passkeys stronger than the strongest unique passwords, even if AutoFill is used:

    1. Software checks the domain name, which makes phishing hard;

    2. Https is enforced, which helps prevent AitM attacks (unless Cloudflare et al. come into play);

    3. A unique, long, unguessible, randomly generated "password" (public key) per account: dumb password rules and broken human RNG's no longer apply.

    OTOH: passkeys also come with disadvantages and risks, partially depending on the provider.

    #Passkeys #AsymmetricCryptography

    #passkeys #asymmetriccryptography
  27. Erik van Straten @[email protected] ·

    @ScottHelme : I am not advocating passwords per sé, and neither am I stating that private keys are sent to relying party servers.

    One of the controversies is whether the user has access to their own private keys. If they don't, malware cannot steal them, but vendor lock-in is the price they pay. However, with malware on their device, an AitM (in the device) can deceive them in lots of ways - including taking over their passkey protected accounts. Real victims do not care whether such attacks are "out of scope" for passkeys - according to tech-bro's.

    Passkeys do have advantages but most people are overwhelmed when every story they read mentions asymmetric cryptography - as if *that* makes passkeys strong: IMO that's a myth.

    Repeating (from todon.nl/@ErikvanStraten/11655) what makes passkeys stronger than the strongest unique passwords, even if AutoFill is used:

    1. Software checks the domain name, which makes phishing hard;

    2. Https is enforced, which helps prevent AitM attacks (unless Cloudflare et al. come into play);

    3. A unique, long, unguessible, randomly generated "password" (public key) per account: dumb password rules and broken human RNG's no longer apply.

    OTOH: passkeys also come with disadvantages and risks, partially depending on the provider.

    #Passkeys #AsymmetricCryptography

    #passkeys #asymmetriccryptography
  28. Erik van Straten @[email protected] ·

    @ScottHelme : I am not advocating passwords per sé, and neither am I stating that private keys are sent to relying party servers.

    One of the controversies is whether the user has access to their own private keys. If they don't, malware cannot steal them, but vendor lock-in is the price they pay. However, with malware on their device, an AitM (in the device) can deceive them in lots of ways - including taking over their passkey protected accounts. Real victims do not care whether such attacks are "out of scope" for passkeys - according to tech-bro's.

    Passkeys do have advantages but most people are overwhelmed when every story they read mentions asymmetric cryptography - as if *that* makes passkeys strong: IMO that's a myth.

    Repeating (from todon.nl/@ErikvanStraten/11655) what makes passkeys stronger than the strongest unique passwords, even if AutoFill is used:

    1. Software checks the domain name, which makes phishing hard;

    2. Https is enforced, which helps prevent AitM attacks (unless Cloudflare et al. come into play);

    3. A unique, long, unguessible, randomly generated "password" (public key) per account: dumb password rules and broken human RNG's no longer apply.

    OTOH: passkeys also come with disadvantages and risks, partially depending on the provider.

    #Passkeys #AsymmetricCryptography

    #passkeys #asymmetriccryptography
  29. Erik van Straten @[email protected] ·

    @ScottHelme : I am not advocating passwords per sé, and neither am I stating that private keys are sent to relying party servers.

    One of the controversies is whether the user has access to their own private keys. If they don't, malware cannot steal them, but vendor lock-in is the price they pay. However, with malware on their device, an AitM (in the device) can deceive them in lots of ways - including taking over their passkey protected accounts. Real victims do not care whether such attacks are "out of scope" for passkeys - according to tech-bro's.

    Passkeys do have advantages but most people are overwhelmed when every story they read mentions asymmetric cryptography - as if *that* makes passkeys strong: IMO that's a myth.

    Repeating (from todon.nl/@ErikvanStraten/11655) what makes passkeys stronger than the strongest unique passwords, even if AutoFill is used:

    1. Software checks the domain name, which makes phishing hard;

    2. Https is enforced, which helps prevent AitM attacks (unless Cloudflare et al. come into play);

    3. A unique, long, unguessible, randomly generated "password" (public key) per account: dumb password rules and broken human RNG's no longer apply.

    OTOH: passkeys also come with disadvantages and risks, partially depending on the provider.

    #Passkeys #AsymmetricCryptography

    #passkeys #asymmetriccryptography
  30. Erik van Straten @[email protected] ·

    @ScottHelme "This is mostly a list of things passkeys were never claimed to solve":

    1. You skipped the "private key never leaves the device" lie. Note that this vuln: seclists.org/fulldisclosure/20 is unfixed (see todon.nl/@ErikvanStraten/11655).

    The alternative, having access to YOUR OWN private keys does not make #BigTech lock-in vendors (i.e. Google, Apple) happy: github.com/keepassxreboot/keep.

    Btw, also unfixed: iOS/iPadOS passkeys may be used without local auth under certain conditions: todon.nl/@ErikvanStraten/11565 (@timcappalli ).

    2. Nobody cares what is considered out of scope for ANY auth. solution, in particular if it they're not told about it. People want to know their risks w.r.t. account takeover and account lockout. We need a safer internet.

    3. "Passkeys are not magic": I don't see "what risks remain" in scotthelme.co.uk/passkeys-101- - which is why I objected.

    4. Passkeys "are a major improvement over passwords": that depends. If people use a password manager to create unique long random passwords (which they should), and use AutoFill, then the advantages and risks (attestation?) of using passkeys vs passwords are not clear and neither easily comparable.

    #Passkeys #AndroidPasskeysGone #ApplePasskeyRisks #Passkey #PasswordManager #AutoFill #Autonomy #BigTechIsEvil #MYprivateKeys #DumbPasswordRules

    #bigtech #passkeys #androidpasskeysgone #applepasskeyrisks #passkey #passwordmanager
Next page