pwlb

Many neurodivergent people are simply overwhelmed by the sound on the streets

The documentation actually reveals why this will most likely not work, given you are on expert on mobile security

The documentation clearly outlines that there are multiple signals being analysed. Relying on play integrity alone is definitely not sufficient as you state.

EIDAS 2 motivation is implicitly that eID failed in eIDAS 1. It simply either didn't take off or didn't work at all

This is necessary because the wallets contain an identity proofing functionality called PID(Person Identification Data). Showing these credentials basically approves you are you. There are high requirements for identity proofing that even pre-date wallets and that makes sense, because the potentially blast radius of identity theft is huge. Historically, these have been secured in smartcards, like eID cards or passports and are not shifting to the smartphone. Verifying the security posture of your device and app is therefore crucial.

Banks actually have high fraud rates today because of weak security mechanisms. If attackers steal your money, the bank will reimburse you. If attackers steal your identity, you are really screwed. Security requirements for banking and identity are simply different.

Preventing credential duplication is a requirement to achieve high level of assurance. One of its purpose is to limit the potential damage that can be done by attacks. If credentials are bound to hardware-bound keys, attackers will always need access to this key store to make any miss-use. If you don't prevent duplication, attackers may extract credentials and miss-use them at a 1000 places simultaneously.

This is due to many parts of the system being spread across multiple IETF RFCs, which happens as OAuth was improved and made more secure over time. Efforts are underway by combining all important parts into OAuth 2.1, otherwise have a look at FAPI 2.0 security profile for high assuance use cases.

You may have a look at this (still a Draft): https://datatracker.ietf.org/doc/draft-ietf-oauth-status-lis...

Where exactly do people move if they only chose between Firefox and Chrome, there is not enough competition in the browser market

First,which DID methods will be successful is a question of time, additional your wallet app could support multiple of these DID methods. Second, DID and the corresponding keys are supposed to be owned by the user or managed by a platform, any indivdual can make the choice whteher he wants convience of managed keys or full privacy under his own control Third, you can have a seperate DID for every service and they issue you an login credential for that particular service.

Not necessarily is DID connected to publishing something on a blockchain. First: DID does not make any statements to the underlying infrastructure, this can be a completely decentralized public, permissionless blockchain but also public, permissoned ledger(also decentral but a little less) or the did Methods using a central server as referenced in the w3c mozilla response. DID for example solves/enables some aspects of the 10 principles of SSI, e.g. portability

not yet, but identity giants like okta and ping are already looking at SSI very carefully. digital identity will be key in the next years

Self-Sovereign Identity and DIDs are a very fast moving train. People argue that in the early internet days there was a similar competition between new protocols(compare with DID methods) before we arrive in our todays HTTP(S)-only world. Similarly DID methods will probably consolidate to a handful within few years and DID Core is only a first step to get a minimal common denominator. Also its questionable if Microsoft&Google and the others are fearing a rapidly evolving ecosystem that they can not jump on as fast and therefore remain sceptic in any case

That sounds like a view from last century. FAANG multinational, sovereign companys and they are interested in money and are not interested in losing their userbase. moreover a lot of these companys have offices in europe as well, so part of these solutions are developed in europe as well. having the HQ in one country is only one aspect of a company

Core mechanisms to prevent Man-in-the-Middle are missing in the article: PublicKey/certificate-Pinning or PKIs. Cryptography is best left to the experts, most of todays javascript developers are probably missing the knowledge to implement or use it in a correct way

Self-Sovereign Identity might replace major parts of the federated identity market within 5 years i expect. even Okta CEO admitted that self-sovereign identity will be the future. the major problem is that the decentralized nature of SSI, will remove the most part and profit of 3rd party tools, as it is easier and cheaper to have direct relations between services and users

Is there any country in history that prevented its downfall because its civilians are armed to the teeth?

Anybody who wants to this with Linux: scrcpy uses adb(turn on usb debug) und works like a charm

comparing all the stocks, seeing that only tesla is in a stable curve near the end, leads me to the following conclusion: Both Tesla and Bitcoin are heavily overpriced!

encryption is only and-to-end, and searching on your device is easily doable

I chose a dangerous sport on my own. The car speeding with 200km/h into your car, will have an impact on your life even if you stick to 120km/h

This sounds like a Law&Order mindset. No, its generally not a great idea to get fingerprints of everything.

This is also a question of tradition and choices. Speaking for eastern Germany, it was very common for women to work and this is also a choice of living, maybe encouraged by independency/emancipation

I'm rock climbing as well and I devleoped a similar biometric token for my company, my experience is that the thumb works best, as you usually don't use your thumb a lot for rock climbing compared to the other 4 fingertips

Firefox Sync let's you syncronize Bookmarks, Open tabs, Logins, History, Add-ons and Preferences across devices by logging in once with username password

intresting article about the phenomenom: http://www.ep.sci.hokudai.ac.jp/~heki/pdf/Scientific_America...

It's gonna be hard if you really want security. Card developers put a lot of effort into securing operations against sidechannel pertuberation, sidechannel and many more attacks, that opensource developers will hardly be able to handle on theeir own.