dchest

28 ms·

361.
by dchest 5y ago
I initially wanted to do the same (needed a drill and a jigsaw for my project, never used them before), but then decided to go with the cheapest Makita which was ~2.5 times more expensive than the cheapest brand, for one reason: safety. For
362.
by dchest 5y ago
Sinopharm's vaccine doesn't use adenovirus vector, it's inactivated SARS‑CoV‑2.
363.
by dchest 5y ago
Years of education about phishing are canceled with these fancy *.new domains.
364.
by dchest 6y ago
Pretty sure you’ll have to rename it or license the trademark. USPTO database has “Hercule Poirot” trademark registered by Agatha Christie Limited for lots of categories, including computer software.
365.
by dchest 6y ago
Right, the verifier can't be used to impersonate the user, but can be used to verify password guesses offline.
366.
by dchest 6y ago
(Not my service, I'm just a random commenter) The same happens with PAKE during registration, where the user will need to provide the verifier. Since everything happens over TLS anyway, and hopefully, with pinning (in apps), this is no
367.
by dchest 6y ago
PAKE still require storing verifier on the server, which is basically a password hash. There's no significant difference in security between PAKE and a home-grown implementation that Bitwarden uses with respect to password hash leaks f
368.
Passwdqc 2.0.0(openwall.com)
1 points by dchest 6y ago|0 comments
369.
by dchest 6y ago
[1] is generally considered an incorrect story. It was denied by every party involved, presented no evidence, and not confirmed by anybody else. It is possible in theory, but this particular story is considered a BS.
370.
by dchest 6y ago
That’s what I’m saying - just don’t do this and you won’t need signed tokens.
371.
by dchest 6y ago
What if you aren't using a browser? There's no difference between browser authentication via a cookie and app authentication via a token. The cookie stores the session token, the app store the session token. What if you explici
372.
by dchest 6y ago
The best cure against doubts is shipping as soon as possible, and then slowly improving what you have. Lots of successful software began as an incomplete and ugly version of what they became. So, solve your initial issues as quickly as poss
373.
by dchest 6y ago
There's no need to use PAKE in a web app.
374.
by dchest 6y ago
It's not absolutely required for end-to-end encrypted apps (that encrypt data with password or use it for authentication). The two benefits of SRP-like (aPAKE) protocols are: - a password hash (verifier in SRP) is not transmitted dur
375.
by dchest 6y ago
Please, do not use vim crypto for anything serious, such as password storage. It has a weak KDF, is malleable (especially important if you decide to sync your password files), and most important, the authors disregard suggestions of compete
376.
by dchest 6y ago
In 2010 https://en.wikipedia.org/wiki/.yu
377.
by dchest 6y ago
https://www.auditor.ca.gov/reports/2019-113/images/2019-113-...
378.
by dchest 6y ago
”I can’t believe...” - this is why people run A/B tests.
379.
by dchest 6y ago
Wire, Viber, iMessage, Keybase, Signal. Here’s how Wire works https://wire-docs.wire.com/download/Wire+Security+Whitepaper... Here’s Signal’s multi device protocol https://signal.org/docs/specifica
380.
by dchest 6y ago
Nope, there are plenty of chats with e2ee and all the conveniences you’re mentioned.
381.
by dchest 6y ago
that does very little because the existing file has already chosen its chunk boundaries If they both used the same rolling hash function on the same or similar data, regardless of the initial and final boundary and regardless of when they
382.
by dchest 6y ago
Correct! I’m not sure why comments here equate music on YouTube with giving it away - while it devalues it by making it free to listen, artists still get royalties from advertising.
383.
by dchest 6y ago
Pinboard.in, from the current owner of delicious?
384.
Apple devices are leaking sensitive data over BLE(team.inria.fr)
44 points by dchest 6y ago|3 comments
385.
by dchest 6y ago
There is a standard drink (differs by country, I believe UK even has labels showing the amount of standard drinks contained) - https://en.wikipedia.org/wiki/Standard_drink This study is from US, so: “For example, in th
386.
by dchest 6y ago
Clickbait.
387.
by dchest 6y ago
Unwrapping it puts the private key into memory, from which it can be extracted (it’s hard, of course, but looking at the state of Intel security, everything is possible). Secure Enclave is supposed to sign with non-extractable private key w
388.
by dchest 6y ago
Can you really read Rust code after learning it or does it still look like a bunch of squiggles?
389.
by dchest 6y ago
In the same interview, Craig said they run virtualized ARM Linux. It’s virtualization, not emulation, so x86 won’t run indeed.
390.
by dchest 6y ago
https://www.youtube.com/watch?v=zSBsq6HBBzw

More ›