• 3 Posts
  • 1.16K Comments
Joined 4 years ago
cake
Cake day: January 17th, 2022

help-circle
  • utopiah@lemmy.mltoPrivacy@lemmy.mlPasskeys
    link
    fedilink
    arrow-up
    1
    ·
    14 hours ago

    Yep. To give you some example I login to my self-hosted forge this way. I also use PAM on my desktop to login this way. I also sudo this way. Unfortunately I don’t use this on my phone anymore as I switched to GrapheneOS which requires GooglePlay Services for this kind of auth mechanism (with possible work around https://codeberg.org/s1m/hw-fido2-provider that I didn’t try yet).

    Please note I’m no security expert but to clarify few things are important precisely when you are not a professional :

    • does it support standards? Basically acronyms like TOTP, FIDO, U2F, are what you should be looking for
    • is it supported without additional software by supporting standards? can you use e.g. PAM on Linux with it or does it need a companion “app” somehow?

    If the answer to either is “maybe” then I recommend before buying you search online and insure it does work with your specific setup. If the answer though is yes to standards and no to additional software then you are, unless there is a weird bug basically, pretty sure to be able to use it however you want, wherever you want.

    Sidenote that it’s the same heuristic for IoT. If you buy a “brandname smart thing” then you probably need their idiosyncratic stack whereas if you rely on standards, e.g. Zigbee or ZWave, then you are nearly guaranteed a smooth experience.

    Hope that helps. I know that navigating acronyms can be tricky but IMHO here it’s worth investing a tiny bit of time to recognize them.

    Finally as we are talking about open hardware and security I would also add 3rd party audits. I don’t have the competency to insure that the hardware and software implementation are cryptographically safe. I can test that it does in some case what it claim to do, e.g. lock after 3 failed attempt, but could some kind of weird collision hash or bad pseudorandomness be used to practically limit the pool of potential keys or passwords? I don’t have the knowledge for that. I also can’t trust that NitroKey did it right based on the claim of their website. So… audits help bridge that gap in trust. If I can’t trust the vendor and I don’t have the expertise despite being entirely open then I look for others who did verify on my behalf.





  • FWIW I think detecting VR with Meta Quest, Apple Vision Pro, Pico VR is quite funny. It’s like … hard NOT to detect such devices. You see a huge slab of plastic on the face of someone potentially looking in your direction and the cameras are numerous and visible.

    So… for Meta Ray-Ban and Oakley Meta definitely because they are designed to look like traditional glasses and that’s IMHO very wrong. For others like Snap Spectacles or TCL RayNeo it’s quite obvious but still, OK makes sense.

    Sadly as 404 media and others reported a lot of abuse came from wearing sneakingly such glasses then coercing people with the footage. I hope people who do abuse those tools do get prosecuted properly.



    • there is more content on PeerTube already that you can watch during your lifetime
    • monetization exists on PeerTube exists and is not based on advertising (which has terrible side effect on privacy)

    So I think if one is looking for PeerTube to be a copy of YouTube in terms of both content and monetization they will be disappointed… but also maybe that’s the problem in itself. YouTube monetization is damaging (forcing to be a popularity contest) and bring poor content in. Sure some very few content creator are still on it but a lot already moved away. The assumption though is that there is a link between popularity and quality. It’s time to reconsider.