palata

28 ms·

721.
by palata 7mo ago
> If you are doing something illegal or controversial with the key, then yes it would be foolish to store it in the cloud. "Not trusting a private company" does not equate to "doing something illegal or controversial"
722.
by palata 7mo ago
> I don't do that. My password manager simulates keystrokes 2 seconds after I hit the button. So a malware on your computer can just listen to the keystrokes, or read on the screen? If the OS is compromised, they can extract the pas
723.
by palata 7mo ago
It's more trusting something you can audit and control (e.g. open source) vs trusting something you cannot audit and control (e.g. proprietary service by BigTech).
724.
by palata 7mo ago
Well, on the work messenger, you talk about work. For private discussions, you do that on your private device, with a private messenger. I would say that the digital sovereignty is more about "Entity X doesn't want the US to have
725.
by palata 7mo ago
> TPMs do not have value for individuals managing access between trusted devices. But you just admitted that it prevents the key from being stolen, right? So the value is that the key cannot be stolen. Doesn't mean that a malware ca
726.
by palata 7mo ago
That's a valid attack, but one thing is that they only get access this one time, and you may realise that something wrong happened (maybe not). But they won't get your private key.
727.
by palata 7mo ago
But then why not use the Yubikey directly?
728.
by palata 7mo ago
Well on Android there is the Keystore that can access the secure element (if present on the device). And it can be secured with biometrics or PIN.
729.
by palata 7mo ago
Though if your computer is compromised, then the malware can read the password, right?
730.
by palata 7mo ago
Not sure I get that. If you generate it "in the cloud", doesn't it mean that someone else (the cloud) has access to it?
731.
by palata 7mo ago
I don't get this. Why don't you use your Yubikeys as passkeys then?
732.
by palata 7mo ago
Well a Yubikey can require a password/PIN. So having your device + knowing the password.
733.
by palata 7mo ago
A passkey is just a thing that authenticates with FIDO2 (or is it WebAuthn?), I believe. With a password, you open your password manager, copy the password in memory, paste it into the input field and trust that nobody could read it from yo
734.
by palata 7mo ago
> What happens when someone else who’s not only giving this to folks who want to patch up holes gets access to this technology? Are they implying that there is no way that some entity in the US is currently using Mythos to find offen
735.
by palata 7mo ago
What I don't like is that they tend to make this one example sound like Mythos developed an exploit so hard that no group of expert humans could hope to ever do it. It sounds like " millions of experts have been looking for this
736.
by palata 7mo ago
Isn't symmetric cryptography safe from quantum computers? For your backup, just use a symmetric key, right?
737.
by palata 7mo ago
My understanding is that symmetric cryptography is not at risk from quantum computers, though. For a backup, symmetric cryptography is fine.
738.
by palata 7mo ago
If the data is encrypted, it can go on the cloud, though.
739.
by palata 7mo ago
I was working really well, so I paid a yearly subscription. Two weeks later, it got to a point where I wouldn't pay for it if I had a choice. I wonder if the business model is: "make it great, get people to pay yearly subscription
740.
by palata 7mo ago
> Mars is a different planet. Not only is it more ridiculous, but the first step then would be to find a way to survive in complete autonomy in an environment that has no breathable air . No need to build rockets for that, we can put a
741.
by palata 7mo ago
I had almost forgotten about StackOverflow, which I left before AI killed it because of the toxic moderation. I guess this serves as a kind reminder that the moderation is still toxic even after AI killed StackOverflow.
742.
by palata 7mo ago
> - No trust that they won't nerf the tool/model behind the feature I actually trust that they will.
743.
by palata 7mo ago
What you're saying is that other people may find jj easier for them, right? I am fine with that. I am just saying that the "you should use jj, you will finally stop shooting yourself in the foot regularly" doesn't work s
744.
by palata 7mo ago
I tried jj for a few months. It was fun to learn a new thing, but I haven't had a single case of "wow, this would have been a pain with git". Then I went back to git (it's been 6 months now) and I haven't had a sing
745.
by palata 7mo ago
> Humans should be a multi planetary species Humans won't be a multi planetary species. The next star is Proxima Centauri, 4.25 light-years away. We would need tens of thousands of years to reach it. Let's say we make drastic
746.
by palata 7mo ago
I run restic with rclone, which is not only compatible with S3-like storage (which include many, like Hetzner, OVH, Exoscale) but many others, from mega to pcloud through Google Drive. For stuff I care about (mostly photos), I back them up
747.
by palata 7mo ago
I guess I'll have a look while I download my next linux distro ;-).
748.
by palata 7mo ago
So there is no way to see the live action material?
749.
by palata 7mo ago
My takeaway is that for data that matters, don't trust the service. I back up with Restic, so that the service only sees encrypted blobs.
750.
by palata 7mo ago
This. I use Restic, the cloud service doesn't know about what I send, it's just encrypted blobs as far as it is concerned.

More ›