Darth Oslerautolycos@beige.party
Oct 14, 2026, 11:45 PM@argv_minus_one @maxpool @ScottHelme fuckin hitech act
Replies
argv[-1]argv_minus_one@mastodon.sdf.orgOct 15, 2026, 12:01 AMI mean, if you want security then you want it to be battle-tested, and it doesn't get much more battle-tested than PKCS#11. That s**t works.
It also doesn't require any nonsense about remote attestation, because the company's IT department controls which devices the private keys go onto in the first place. Hardware token? Secure enclave on a phone? Doesn't matter, as long as there's a PKCS#11 driver for it.
CyberFlâneurjohn380@infosec.exchangeOct 16, 2026, 7:11 AM@argv_minus_one @autolycos @maxpool @ScottHelme agreed for corporate identity mgmt you can’t beat certificates; 90% of users love the idea of letting AppleID handle it all, but #lock-in is undeniable. When their phone dies, they will not buy a google or other type of phone, even if technically possible the #FRICTION is increased by passkeys.