Aachen

55 ms·

781.
by Aachen 1y ago
Because it requires access to the email system, that's a separate system even if it's being forwarded so long as you have a valid login to the email server But, yes, the exact boundary is definitely debatable. It's clearly le
782.
by Aachen 1y ago
> [...] then having the TOTPs in the same device does not really increase risk. ... and having TOTPs at all does not decrease any risk, either. There's no benefit to the situation where you store 2 good secrets in 1 place as compare
783.
by Aachen 1y ago
If you move the secret tokens onto the same device (like in that emulator that presumably runs where your password manager also runs), we're again back to the oathtool solution that is described in the OP, that doesn't have the sa
784.
by Aachen 1y ago
They can call the sky green but unless the wavelength changed, I don't see the benefit of taking over that terminology, no matter if you're a user or a nerd or both. That's the real-life situation: sky isn't green, idk w
785.
by Aachen 1y ago
Think about how the attacker gets there: - "an attacker still only requires a password (which may be brute forced" Brute force? Then it wasn't generated securely. Use Keepass' built-in generator or another one that is me
786.
by Aachen 1y ago
Yes, Microsoft tries to get you to use their proprietary mechanism by default. You need to click on the "use a different method" link when doing the setup to get a code that is compatible with e.g. Google Authenticator, FreeOTP, a
787.
by Aachen 1y ago
Keep in mind that perfect is the enemy of good! You don't have to switch all at once. Start adding new tokens to a better manager and see if/when you get around to migrating the ones that are currently locked into Microsoft. Tha
788.
by Aachen 1y ago
You're onto something even banks don't seem to understand! The industry standard for doing financial transactions calls for 2FA but then they make a mobile app that can self-approve transactions. Yes, using only one mobile device
789.
by Aachen 1y ago
> The second factor does not have to be a second device. Like everything security, it’s what you’re protecting against. It doesn't matter if you store your 2FA seed on a billboard or as a tattoo where the sun doesn't shine: 2FA
790.
by Aachen 1y ago
All of this is true without 2FA, just storing securely generated passwords in the manager. Whether it negates the benefits of 2FA (i.e. whether it's 1FA) doesn't depend on the threat model. The threat model is what makes an indivi
791.
by Aachen 1y ago
The password vault can't be copied? (In unlocked state I mean, same as how they could get the password) Either your laptop is compromised or the server. In either case, if they get access to the password, they also get access to the 2F
792.
by Aachen 1y ago
If you use a password manager, or another mechanism that makes each password unique and unguessable, the password and the "2FA" seed token are both the same type of secret string, and both are stored on the same disk. There is no
793.
by Aachen 1y ago
To be clear, the point of storing a secret token on your phone and then typing over some codes that prove you have access to the secret still, is to provide 2FA. If you use oathtool on your laptop, and the password is stored there as well,
794.
by Aachen 1y ago
That argument would only last as long as current Android devices are supported for. In seven years, the last devices will run out of support and we'd be back to square one Legislation, as you say, seems like it'll be necessary :&#
795.
by Aachen 1y ago
The OS they ship has Google services on it. They've previously chosen not to give you root access by default because Google wouldn't allow it: https://forum.fairphone.com/t/fairphone-s-approach-to-root-o... T
796.
by Aachen 1y ago
Nobody said that... You can keep your device enslaved to Apple all you want. You don't have to use the administrator permissions on Windows if you don't want them. Some of us do want freedom You've got it completely backwards
797.
by Aachen 1y ago
> There’s something in the reality that it’s the app developers not the user that are being restricted by Apple. Reading this comment as a user and developer in one person, it's so weird to see this disjointed picture of developer
798.
by Aachen 1y ago
Because I used to have a choice. Since dipping my toes in Android, I remember distinctly in 2012 or maybe 2013 the feeling when I got Xorg and Wireshark running on a Galaxy Note device within the first days. Dead simple! Heck, VirtualBox le
799.
by Aachen 1y ago
What worries me is that Google has a fairly legit argument to say "then Apple should as well". But we've accepted Apple's status for so long now, a lot of consumers are stockholmed into thinking giving away control is th
800.
by Aachen 1y ago
The author doesn't seem to understand that you don't need your PlayStation 5 to travel, pay your rent, or authenticate to government services. That's the fundamental difference and why it is valuable that Android is open I ag
801.
by Aachen 1y ago
Right, that makes sense. Did some looking up and nonfree press seems to be indeed the case for Indonesia: https://rsf.org/en/country/indonesia It's a mixed bag apparently, free press is technically legal sinc
802.
by Aachen 1y ago
Here's one: prosecuting the devs that currently spread malware, block (or warn users for) foreign sources that don't cooperate with law enforcement You don't need an ID to find the person behind an IP address + timestamp. The
803.
by Aachen 1y ago
Aren't there local (online or print) newspapers to get news from, as an alternative to Discord? Hope I'm not asking a dumb question
804.
by Aachen 1y ago
Yes, I do think the benefits of free speech outweigh risks from criminals who will publish bad software There's many ways to combat crime. Banning free distribution of software is one of the options but not the one I'd pick from t
805.
by Aachen 1y ago
Like Fairphone.nl, Shift.eco, Murena.com...? They're being sold and enough people are buying them to keep these companies alive. Fairphone said they're not delivering to USA because they don't have the manpower, not because t
806.
by Aachen 1y ago
Then is now. Projects like Anubis and OpenStreetMap explicitly don't support uncommon setups, you just don't get to use those parts of the internet. When talking to e.g. OpenStreetMap sysadmins, the reason given was that they see
807.
by Aachen 1y ago
Should this sort of submission be using an .onion link, considering how many readers it is blocked for? Assuming (& iirc) sci-hub has an official one
808.
by Aachen 1y ago
Just realised that's misleading: > a typical person in a rich country [...] uses about 1.5 MWh/year That's just electricity, not energy. The real figure is probably ballpark 50 to 100 percent higher (probably mainly depend
809.
by Aachen 1y ago
Idk why this is downvoted. People should look it up before you thinking someone isn't contributing to the conversation > The European Commission said in 2001 that at the current level of uranium consumption, known uranium resources
810.
by Aachen 1y ago
I find 100 kW a lot more tangible than some nonround number of thousands of kW times hours. People use kW for car charging, for heaters (toasters, microwaves, space heaters are all the same), etc. so you can directly say how many of those

More ›