A new European initiative dubbed UnifiedAttestation aims to build a free and open-source alternative to Google’s Play Integrity checks. The initiative is backed by smartphone maker Volla, while other partners include /e/OS maker Murena and the team behind iodé OS. The feature will be distributed under an Apache 2.0 license.

you are viewing a single comment's thread
view the rest of the comments
[+] -8 points 8 months ago (5 children)

Actually i have been thinking about it and i do believe that it should be done for computers, actually. Like, an attacker could super easily steal your login credentials when they get 10-15 minutes with your computer once. They could do that by booting a custom OS, modifying some of your operating system's system files to install a keyboard tracker or sth, and then just wait for you to enter your password.

I believe it's actually why some banks i know don't allow login anymore if you're not using their Android apps to verify the login.

  • source
  • parent
  • hideshow 5 child comments
  • [–] 4 points 8 months ago (4 children)

    Yea, i know no bank that allows login in browser with only basic auth. All use some proprietary 2FA app with fancy QR codes (colour pixel or similar). Funnily, many banks then offer SMS based 2FA in order to restore…

    Like make hard and secure login but reset option is old SMS thingy spoofable since… ever?

  • source
  • parent
  • hideshow 4 child comments
  • [–] 2 points 8 months ago (2 children)

    Ally, capital one, chase support browser login with basic auth, and sometimes SMS 2fa. I've never used a mobile bank app

  • source
  • parent
  • hideshow 2 child comments