md_

51 ms·

511.
by md_ 5y ago
Hmm. I'm of two minds about this. Vanguard restricts (or used to) trusted keys to those made by Yubico. This annoys me, given they let me use any phone number. So this suggests (as you seem to be arguing) that attestation is an attract
512.
by md_ 5y ago
- Yes. - To my (limited) knowledge, yes, you are right that keys will get more unique over time. That's a very good point. Keys are not rotated nor (generally) are they rotatable; they are usually read-only. If you are using a very old
513.
by md_ 5y ago
https://fidoalliance.org/fido-technotes-the-truth-about-atte... explains this pretty well. Basically: * Attestation keys are not unique per authenticator; they're shared among batches of authenticators. * If you extrac
514.
by md_ 5y ago
Apple Sign-In is just an OpenID federated login; these don't inherently provide any anti-automation or rate limiting; they just push the problem to the Identity Provider. IdPs like Apple/Google/Microsoft might do a fine job o
515.
by md_ 5y ago
The batch size requirement is imposed by the FIDO spec, to ensure that batch IDs are not so high entropy as to pose a privacy problem. "In this Full Basic Attestation model, a large number of authenticators must share the same Attestat
516.
by md_ 5y ago
Desktop (i.e. non-portable) WebAuthn authenticators are good for things like transactional authorization (e.g. confirm a payment on PayPal), but not especially useful for authentication: if you already have your WebAuthn secrets on your bro
517.
by md_ 5y ago
This is the goal with WebAuthn and FIDO.
518.
by md_ 5y ago
This doesn’t make any sense to me. There’s no precedential issue here. Law enforcement can and routinely do demand such data, and in the case of other services they receive it. The only news here is that Signal can’t produce much of it beca
519.
by md_ 5y ago
Judges taking their word for it is exactly what happens when you respond to a subpoena. That’s literally how it works.
520.
by md_ 5y ago
Sometimes a cigar is just a cigar.
521.
by md_ 5y ago
This is one of those posts that sounds truthy because it makes a bunch of broad assertions. ;) Legal systems are peopled by people. Just like other systems. Unlike many other systems, the American legal system is in fact highly distribute
522.
by md_ 5y ago
Increasing money supply without a commensurate increase in CPI is consistent with a rise in asset prices, especially speculative assets. (Maybe this is what you're saying as well?) If the Fed prints $1,200 for every adult making less
523.
by md_ 5y ago
CPI includes housing, though. Obviously it's fair to say that inflation may be measured more in some prices than others, but you're sort of muddying the waters by referring to housing as both an asset class and a cost-of-living, r
524.
by md_ 6y ago
Cellebrite claims, "Lawfully access locked devices with ease Bypass pattern, password or PIN locks and overcome encryption challenges quickly on popular Android and iOS devices" https://www.cellebrite.com/en/u
525.
by md_ 6y ago
Yeah, I saw that. But the whole thing is a bit too unclear to me to know what happened. I'm not saying this is innocent, but it's not at all clear to me that vulnerabilities were deliberately introduced with the goal of allowing t
526.
by md_ 6y ago
Ah, I must've missed that. I do see people saying patches have reached stable trees, but the researchers' own email is missing (I assume removed) from the archive. Where did you find it?
527.
by md_ 6y ago
Agreed on the time issue—as I noted above. I think it's still of a pretty different cost character to actually allowing malicious code to make it to production, but (as you note) it's hard to be sure that this would not make it to
528.
by md_ 6y ago
https://www.theonion.com/reporters-expose-airport-security-l...
529.
by md_ 6y ago
I'm confused. The cited paper contains this prominent section: Ensuring the safety of the experiment. In the experiment, we aim to demonstrate the practicality of stealthily introducing vulnerabilities through hypocrite commits. Our go
530.
by md_ 6y ago
Probably a reference to https://techcrunch.com/2014/03/28/after-supporting-prop-8-br... .
531.
by md_ 6y ago
I honestly thought this blog post was parody, until I realized it was way too long to be anything but genuine. Sigh.
532.
by md_ 6y ago
I like that! Thanks! In truth, though, I always felt that the large size of "group 1" was an indictment of "group 2". Put differently, I sometimes joke about big companies like LinkedIn or Facebook: "Why does it tak
533.
by md_ 6y ago
I'm quite similar. But I'm not sure a good CS curriculum has to be like that. One of the neat things about most applied CS is that you can teach it hands on, with minimal equipment. Even more, you can teach it using "toy&quot
534.
by md_ 6y ago
I struggle a little bit with this. I _do_ think there are two (or more) classes of developers: there are clearly those who bounce among the FAANG, might become senior staff or engineering leadership, and, yes, tend to be worldly, well-read,
535.
by md_ 6y ago
It’s still a part of the so-called nuclear triad. Whether it’s actually critical for second-strike credibility (absent a 24/7 in-air alert, which I think no longer exists?) is up to debate, of course, but that would be the rationale.
536.
by md_ 6y ago
Your intuition here is basically what's formalized by Piketty in "Capital in the 21st Century": that the rate of growth of capital exceeds the rate of economic growth. What's interesting is that while intuitively this ma
537.
by md_ 6y ago
Sure, and if you squint hard enough, there are similarities between having a warning label slapped on your Tweets and being thrown in a gulag for decades. But if you're squinting that hard, not a lot of light is getting through.
538.
by md_ 6y ago
That's true. And the alternative (contextual warnings) is of unclear value: https://link.springer.com/content/pdf/10.3758/MC.38.8.1087.p... .
539.
by md_ 6y ago
The point here seems not to have independent professional fact-checkers, but to crowd-source it. On the one hand, I certainly struggle to see how more crowds will improve upon what is fundamentally a problem with crowds to begin with. On
540.
by md_ 6y ago
Oh, I get your point. I mean, in the extreme, yeah, malicious hardware can exfiltrate secrets. A hidden antenna, as you say—or more subtle attacks (e.g. https://dl.acm.org/doi/10.5555/1267336.1267341 , though this

More ›