summaryrefslogtreecommitdiff
path: root/content/entry/re-against-risk-based-authentication-or-why-i-wouldnt-trust-google-cloud.md
diff options
context:
space:
mode:
authorNicholas Johnson <nick@nicholasjohnson.ch>2023-10-27 00:00:00 +0000
committerNicholas Johnson <nick@nicholasjohnson.ch>2023-10-27 00:00:00 +0000
commitdb5d5026a914d47ff92830471c2581a9c106b3c342a0f337d46c16195b5d5ffd (patch)
tree5643e742460a4a4be9816ec278eee58f6d2cb0b55f3ea2dabd65304ea4e858ef /content/entry/re-against-risk-based-authentication-or-why-i-wouldnt-trust-google-cloud.md
parent4ab19e621545d16c1bfe08df4968f65457e37d7f2a1a1fcb237353dc09031bf4 (diff)
downloadjournal-db5d5026a914d47ff92830471c2581a9c106b3c342a0f337d46c16195b5d5ffd.tar.gz
journal-db5d5026a914d47ff92830471c2581a9c106b3c342a0f337d46c16195b5d5ffd.zip
Remove erroneous whitespace from Markdown files
Diffstat (limited to 'content/entry/re-against-risk-based-authentication-or-why-i-wouldnt-trust-google-cloud.md')
-rw-r--r--content/entry/re-against-risk-based-authentication-or-why-i-wouldnt-trust-google-cloud.md2
1 files changed, 1 insertions, 1 deletions
diff --git a/content/entry/re-against-risk-based-authentication-or-why-i-wouldnt-trust-google-cloud.md b/content/entry/re-against-risk-based-authentication-or-why-i-wouldnt-trust-google-cloud.md
index c7d52e3..1f02dfe 100644
--- a/content/entry/re-against-risk-based-authentication-or-why-i-wouldnt-trust-google-cloud.md
+++ b/content/entry/re-against-risk-based-authentication-or-why-i-wouldnt-trust-google-cloud.md
@@ -7,7 +7,7 @@ draft: false
I found another [article](https://www.devever.net/~hl/logindenial "Against risk-based authentication (or, why I wouldn't trust Google Cloud)") written by Hugo Landau which discusses the unavailability of risk-based authentication (non-deterministic login). For those who don't want to read the entire article, here's a short quote which captures the essence of Hugo's critique:
> "The problem is precisely this: The credentials you require to access a Google account are essentially indeterminate. Supposedly, for a simple Google account without 2FA enabled, knowledge of the account email and password should be sufficient to access an account; except sometimes, they aren't. Sometimes, Google might randomly decide your login attempt is suspicious, and demand you complete some additional verification step.
->
+>
> This sounds potentially innocuous until you then realise that there's no guarantee you can actually complete this additional verification step. There are to my recollection numerous stories of people being locked out of accounts which they have the passwords for because Google has decided that things are suspicious and having the password is not enough."
Apart from the availability issue that Hugo brought up, my problem with risk-based authentication is that it usually relies on collecting and indefinitely storing sensitive data about the user for later comparison, which violates their privacy and creates needless risk of sensitive data exposure.