• 1 Post
  • 148 Comments
Joined 5 years ago
cake
Cake day: January 21st, 2021

help-circle





  • kevincox@lemmy.mltoPrivacy@lemmy.mlPasskeys
    link
    fedilink
    arrow-up
    17
    ·
    9 days ago

    There are a few main benefits.

    1. For hardware-backed keys they can’t be stolen aside from physically stealing the hardware. So unless your machine has malware there is no way for an attacker to authenticate using them.
    2. Even for software keys the site you authenticate to doesn’t learn enough to impersonate you. For example if for some reason your bank leaked some logs with PW + MFA someone could use that to log in as you (although admittedly short timeouts on MFA validity makes that window very small).
    3. The browser ensures that you only authenticate to the correct domain. So it prevents phishing. (Although a password manager that only fills into the correct domain also accomplishes this.)

    So I think if you are using unique passwords with an automated password manager the effective benefit is quite small. However for the “average computer user” who likely has less than 5 passwords that they use for everything it forces a pretty high base level of security.


  • I doubt Gaussian blur is an accurate model of real-world situations.

    At the end of the day if you are worried about the codes being painted over print a few out and paint over them. Then scan with a variety of scanners.

    If I had to come up with some more digital tests I would guess that a few of these are more representative of real-world situations:

    1. Lower contrast. For example lighten or darken the whole code. This would simulate things like scanning in low light or with glare.
    2. Block out sections of the code. This will test error correction levels and simulate partial damage or pockets of extreme glare.
    3. Skew the code in various ways. This simulates the perspective shift of people scanning the code from an angle.

    Ideally combine them in a bunch of scenarios then try to scan with a variety of scanner implementations.






  • You seem to be making this very complex. But it really isn’t. Yes, git doesn’t track renames. So you are working around it by splitting your operation into 2 commits.

    1. A pure rename.
    2. A file change.

    This way 1 is always considered a rename and 2 is just a regular file change with the same path. You may also consider tweaking the default rename detection threshold with flags like --find-renames or options like diff.renameLimit.

    Would it be nice if Git tracked renames? Probably. But that isn’t how the data model works so it is unlikely to happen soon. But maybe they could add some metadata.



  • I feel like this is getting at something interesting and revealing but I am not convinced by what it says.

    “There is no limit to the type of WhatsApp message that can be viewed by Meta,” the agent wrote in the email. He added that “Meta can and does view and store all the text messages, photographs, audio and video recordings” in an unencrypted format.

    I highly doubt this is true. This is because there are third party clients such as https://github.com/mautrix/whatsapp that send E2EE encrypted messages on WhatsApp. If literally all messages where available in an unencrypted format it would mean one of the following things.

    • The E2EE protocol is broken and Meta knows the “crack”.
    • That official client does a completely different protocol which uploads all messages in addition to doing the E2EE protocol.

    Security are also reverse-engineering the official client. So if it was regularly doing this I would assume someone has noticed.

    What I suspect is happening is that some features in the client (like Meta AI) are very easy to frequently activate and upload a large amount of messages when Facebook then archives. It would be quite likely that the average user is using these frequently. This could reasonably result in the vast majority of messages being available to Facebook.

    But I think if the reports are exaggerated it doesn’t help sell the case.


  • Of course, but because the law is so protective you won’t need to 99.9% of the time. Canada also isn’t a very litigious place and even if it does get raised it will probably get thrown out quickly. To most doctors it is also a huge stressors to watch someone that they can help die. So overall the balance is well worth trying to help out.