rene_mobile’s avatarrene_mobile’s Twitter Archive—№ 7,205

  1. My takeaway from this aspect: while @duosec MFA itself was not breached, login/identity/session tokens should really be signed with asymmetric (private) keys, and not symmetric (secret) ones. Even for 1:1 service connections, their trust relationship is usually not symmetric. @schneierblog/1338960156927774720
    On twitter.com Twitter logo rene_mobile’s avatar ❤️ 1 Favorite Mood +3 🙂