PCI DSS from 4.0 actually have something called customized approach for everything. If you can prove and the QSA agrees that you fullfill the goal of a requirement, you can be quite flexible. Example i am doing things like not using passwords at all and only passkeys, or only ssh keys protected by hardware security key etc. Together with agents trying to verify the devices connected are company owned and hardened in different ways. Your milage might vary depending on how good your auditor is but PCI DSS standard do have quite a bit of flexibility in it.

Presumably at some point in your environment you are doing MFA? Just not at every step?

Ie If someone broke into your office, opened computer, inserted the hardware security key, would they get in? Or is there something else non-physical going on? Like the initial login is password + security key, and you can demonstrate the ssh keys never leave the secured PCs etc.

It is not about MFA or not but to demonstrate the process is secure for the purpose.

It can be complicated but a example. TOTP that is very common used with passwords is regarded as MFA (tho most of the time software based on phone) but have many problems regardless

- many time replayable - can be intercepted - implementations look different - recovery code reuse problems etc.

On the other hand, using only passkeys dont have those problems but with passkeys, many times you cannot decide on what device a user have registrated the passkeys in a enterprise setting. example they could be apple passkeys, chrome passkeys, windows, hardware key(yubikey) etc and all of them behave different when it comes how they ex can be copied/ synced between users devices. So from where they can be used.

So for any authentication flow, you need to look at the full picture. What is the process when credentials are lost? How do user onboard etc.

Is a good entry point to say. We should use MFA or similar but the details matter.

It’s always interesting to hear other people’s approaches- Thanks for the insights!

I like the way IR remotes work for your aircon. Sending the full state every key press. Think it many times is a lot better then supporting PATCH.

Working at Google (and similar companies) seems to be such a chore is what i got from this article.

I do managing, coding, design, governance and overall what i call "improve the company" within my areas of expertise and context switching and commitments are the most challenging things. Need to be very disciplined and know the other areas are currently very stable and under control to carve out time for the other things. It is not impossible but it have to be very focused and the problem domain need to be quite good understood before jumping in. Example, writing a internal tool that in worst case get delayed for later is easier to start working on then being part of customer facing product development as all of a sudden i would need to jump into some urgent management tasks or overall just let the governance and long term company quality go down.

As a Swede living abroad this creates a headache when going back. When combined with swish needs a phone number but to get a phone number you need to have a registered address, etc.

This is a real and important problem: lots of countries have a System, like Vipps or WeChat Pay, which works brilliantly for local residents but is inaccessible to non-residents. Even if (as it sounds like in your case) you're a national but not a resident.

When do you need to pay with Swish and can't instead use a normal credit/debit card?

One example is flee markets, or different type of second hand. Christmas markets etc. Some do accept debit / credit cards but a lot is swish only.

For cards, depends on the bank. I know my bank at-least do send the card abroad to my current home and as long as i keep my digital authenticator ID (bank ID) i am able to access that, renew cards. Do most banking services etc.

I also managed to get a new bank authenticator by going to the embassy and get signed papers etc, however it took about 5 months or so if you don't have any cash that might become a issue. :)

Lots of smaller cafes or people running various stall style businesses only accept Swish, especially out the in more rural areas. I've been to a couple of smaller festivals where the only way to pay for a ticket at the 'door' was with Swish.

Plus of course any time you need to give money to an actual person and not a business.

Good luck getting a debit card without an address.

If you're living abroad and visiting you'd probably already have a debit card, no need to open a new one for a visit. This is only relevant for Swish because it's not something someone living outside of Sweden would likely already have.

The rely was to a Swede who lives abroad and comes back to visit Sweden.

Presumably they have cards they can bring with them on the trip that work in Sweden even though their address is outside Sweden?

I know when I travel abroad I just take and use my normal cards without a problem.

I'm also a Swede living abroad. I have signed up with Swish using a non-Swedish phone number (but with Swedish bank account), it works fine in most cases. I do have an address though, but not in Sweden.

When sales people post that picture of a saleperson with a round wheel and the "customers" too busy on the side of the road to switch from the square wheel as too justify something for themselves.

on mobile phone. Just back up directly from the start to the door behind you so you dont get shoot then snipe them from a distance. captcha solved.

Worked 5 years as a contractor for a system made to be used for all of the healthcare in a country. Payed by tax payer money. Some serious money. I never understood what the system actually was supposed to do during those 5 years. Started as some custom authorization server for new healthcare laws and then ended up as some kind of desktop app that had a launcher to launch apps. No idea what the purpose really was and heard it got cancelled a couple of years after i left.

You basically just install steam from within your linux distributions package manager. I use and recommend some arch based distro but for Ubuntu it should be apt-get or some gui tool like synaptic.

After you installed steam it will probably just work. You might need to go into settings -> steam play and enable proton. that's it.

Play only on linux since the last year or so and got away from the dedicated windows machine i had to have for only gaming. I had some bugs in the beginning but with recent versions of proton it feels a lot more stable. I don't have any bugs anymore in any games and don't notice any slowdowns or degraded performance. It is quite amazing.