palata

34 ms·

811.
by palata 7mo ago
> This article is more aimed at those specifying and implementing WebAuthN and SSH, than at those using them. Sure, I'm just trying to understand the consequences of that. Felt great to finally have secure elements on smartphones an
812.
by palata 7mo ago
Meta and Cloudflare did something like that for WhatsApp Web, there is a nice blog post about it here: https://blog.cloudflare.com/key-transparency/ Now it only ensures that Cloudflare doesn't tamper with the What
813.
by palata 7mo ago
Dude, I was here to talk about security, not to be judged on the quality of my English. What I get from your take is that your English is better than mine, but not your security knowledge. > That isn't what "sandboxed" mea
814.
by palata 7mo ago
Well the idea is that the client should be open source, and audited. If you run a proprietary app, you have to blindly trust it (just like if you access a webapp). In terms of security, the best is an open source app, IMO.
815.
by palata 7mo ago
What is the consequence on e.g. Yubikeys (or say the Android Keystore)? Do I understand correctly that those count as "signature algorithms" and are a little less at risk than "full TEEs" because there is no "store
816.
by palata 7mo ago
> I think you've reached for Hanlon's razor incorrectly. Malice better explains what is happening here than ignorance. Well, I think you reach for it incorrectly, then :-). > That team knows there's a privacy-preserving
817.
by palata 7mo ago
Those are valid arguments but I like apps better, for other reasons. Mostly security. When I use, say, the Signal app: - I can audit it, download it or even compile it myself from sources - Once I have installed it, Signal doesn't get
818.
by palata 7mo ago
> Web browser is a sandbox by default. So I take this is a security concern. How do you feel about the fact that when you open a webapp in your browser, you re-download that app code every time? That the server can send you a backdoor ev
819.
by palata 7mo ago
> the Western leaders need to temper their tendencies for isolationism these days, what's the alternative guys? Agreed, but tempering their tendencies for isolationism doesn't mean trusting a country that threatens to invade so
820.
by palata 7mo ago
> compared to now, when it can only use military power to commit war crimes on a smaller scale The fact that the US is not as powerful as it used to be may actually make it dangerous. "On a smaller scale" doesn't mean it c
821.
by palata 7mo ago
Disclaimer: talking about functioning democratic governments (obviously authoritarian governments are different). We do regulate a lot of things to protect the people, especially the children. It's common to make it illegal for childre
822.
by palata 7mo ago
The only reason I can see to not treat natural monopolies as government-owned monopolies is political: those in power benefit from privatising those. Maybe this shows that Switzerland has a sane political system?
823.
by palata 7mo ago
"Your mom is so fat she would take a whole pixel on that image"?
824.
by palata 7mo ago
> Like I have said Sure, I just wanted to make sure that nobody would understand "TOFU is neither necessary nor recommended, just ignore that message and say "yes" when it appears". Both ends need to be sure of who
825.
by palata 7mo ago
> I suppose it is as if we had stopped at the Wright brother's first flight. I disagree. Building planes had obvious potential. "If I could fly like a bird, then I could go much faster to some places" seems like a straig
826.
by palata 7mo ago
My point was that photovoltaic is "an alternative" to nuclear reactors, but an alternative that relies on globalisation. Nuclear reactors... much less.
827.
by palata 7mo ago
> TOFU is neither necessary nor recommended Just to make it clear: this does not mean that it is fine to blindly accept the message on first use. The "secure way" implies copying the server's public key as well, which peop
828.
by palata 7mo ago
> and there are alternatives That's a big if, though. Solar and batteries require globalisation, based on fossil fuels. I feel like nuclear reactors are a better choice. > in a conflict, not sure having many around is generally a
829.
by palata 7mo ago
> "Google knows too much and I want an alternative" Proton is great, cheap, and convienent. I think that Proton does a good job with the suite (docs, sheets, calendar, password manager), and I believe they have a good VPN (for
830.
by palata 7mo ago
> The low-tech version could be to put a static-URL page on my blog that links to other blogs I like I think OpenRing does that? [1]. Not my blog, just linking for illustration, but you can see how it looks here at the bottom of the page
831.
by palata 7mo ago
Sure, it's always a tradeoff. There is no "perfect" security, but there is "better" and "worse" for the threat model. My point here is that when you run a webapp from a browser, you have to trust the serve
832.
by palata 7mo ago
Yep, I go for a domain owned by my country, good point!
833.
by palata 7mo ago
I believe there are two levels. 1. The US becoming relatively hostile even to countries that considered themselves allies means that being totally dependent on US monopolies (the TooBigTech crew) is a problem. So the first level is "
834.
by palata 7mo ago
Hmm, I am not completely sure what the website is trying to say (there is soooo much text and it's quite unreadable). But it feels like it says "it is hosted on US servers, so it's baaaaad". The thing is, it seems to be
835.
by palata 7mo ago
I think the argument is that when you load a webpage , you download the code everytime you want to run it, from servers owned by the company building the service. So they can choose to serve you different software (e.g. with a backdoor),
836.
by palata 7mo ago
> In the consumer space the best usually does win It was like this with capitalism. But we live in an era of Technofeudalism, where it's not the case anymore.
837.
by palata 7mo ago
> Home page boldly claims: EuRopE dOeS iT BeTtEr. That's a marketing slogan, not anything that is in the culture. > This superiority complex needs to stop. It exists in the US, though: https://en.wikipedia.org/wik
838.
by palata 7mo ago
For mail, the answer is to own your domain. If you move away from (probably) Gmail, you don't want to lock yourself into an @proton.me. Get your domain, and use whatever provider you want (it can be Proton, but there are many others).
839.
by palata 7mo ago
> Ente means 'mine' in Malayalam, a language spoken in Kerala, South India. It also means "duck" in German :-)
840.
by palata 7mo ago
Well NASA cut off on environment programs, I guess the money wouldn't have to go very far. And to be fair, Artemis contributes to making some billionaires richer. Sending humans to space has always been a great PR stunt to convince the

More ›