prophesi

50 ms·

901.
by prophesi 7y ago
Not joking; An acronym + virus is much better than china + virus, or Covid-19 (which is actually the name of the disease).
902.
by prophesi 7y ago
The best of both worlds would be to come up with a precise, "inconvenient" name, then create an acronym from it.
903.
by prophesi 7y ago
For those curious by the claim that homomorphic encryption is not computationally practical, Bruce Shneier has a great article on it https://www.schneier.com/blog/archives/2009/07/homomorphic_e...
904.
by prophesi 7y ago
Hm, I stand corrected! Though I have two thoughts on that: 1. It wouldn't add very much complexity to implement random IV's. You can send it with the ciphertext, or in the generated URL. In my own project, I use btoa(JSON.stringif
905.
by prophesi 7y ago
Yeah, the WebCrypto API has a built-in function for this. I hope the author fixes the code, because this is otherwise a dangerous tutorial. window.crypto.getRandomValues(new Uint8Array(12)); If the author followed the MDN guides for it, the
906.
by prophesi 7y ago
You know, I'm almost sold on it. I still think it's a bad idea to use it in the browser, but for native apps/games, some of the pros could be really nice (particularly client-side hashing). ZKPP's Pros - You can make sur
907.
by prophesi 7y ago
Perhaps you have a keylogger on your computer. Or a malicious app was able to access your clipboard. Or a third-party script on the site hijacked the form submission (Magecart, which is still an issue to this day). Or perhaps you're us
908.
by prophesi 7y ago
> Entering a password into an HTML form is NOT SECURE, period. What I meant by needing the user to enter a password (whether in a web app or native app) is that the user will still need to use a password manager and 2FA for decent securi
909.
by prophesi 7y ago
Yes, verifying the hash of a password is simpler than SRP. You'll still need a password manager and 2FA with SRP. The user will still be entering in their password into a form-field on the client. You'll still need 2FA to make sur
910.
by prophesi 7y ago
Sure, but if the database is compromised, the attacker will have the server's private key. They can still bruteforce passwords, except against SRP's less battle-tested hashing algorithm. It's simply a lot more complexity for
911.
by prophesi 7y ago
PBKDF2 solves all of those issues, which LessPass uses. I think I understand what you're trying to say, though; it _is_ insecure to rely on the user for entropy. If the master password is weak, that consequently weakens the entropy of
912.
by prophesi 7y ago
The major problem with passwords is reuse. Nobody's out there trying to bruteforce your passwords, unless you're a state-level threat. In reality, they'll be using your password from a database leak from a different service a
913.
by prophesi 7y ago
It seems like Lesspass would be encouraging best practices in that case; if you believe your seed password has been compromised, then you _should_ change all of your passwords. On a similar note, I also think it's bad security hygiene
914.
by prophesi 7y ago
And the popular alternative of taking the subway is definitely not an improvement in terms of hearing loss.
915.
by prophesi 7y ago
Does anyone know what happened to the live demo on https://github.com/harvardnlp/NeuralSteganography ? It basically does what memespeech is doing, except much better. Both parties would need to agree on a cover text (l
916.
by prophesi 7y ago
I'm frustrated enough that smartphones have a battery life that can barely last through the work day. Call me from your smartwatch once we've made enough advancements in battery technologies.
917.
by prophesi 7y ago
I wouldn't say software is entirely neutral. As you say, they have their faults, and some are designed in a way that lends itself to evil purposes. Openness is the key, as the Steve Jobs quote in a parent comment is saying. Users need
918.
by prophesi 7y ago
I wouldn't try hosting on Sia if you're trying to make a profit. I spent 20USD on Sia currency. And I didn't go out and purchase a RPi + harddrive for it. You likely wouldn't make a profit if you did. RPi's are grea
919.
by prophesi 7y ago
For the first few months, you'll basically have all of your Sia drained as your contracts start coming in and your host wallet gives them collateral. But yeah, my contracts only recently started to complete, and I've got the amoun
920.
by prophesi 7y ago
Honestly, I'm a bit confused on who the targeted audience is for this article. I've been running as a host for Sia for months now. My rig is a raspberry pi and a 10tb external HDD I had laying around.
921.
by prophesi 7y ago
Honestly, I wouldn't willingly install anything by Microsoft. Everything is overloaded with unnecessary telemetry. On that note, for anyone using Microsoft's VS Code, I recommend https://vscodium.com/
922.
by prophesi 7y ago
"Contacts and phone: The app requires this permission so it can search for existing work or school Microsoft accounts on your phone and add them to the app, helping to ensure your account works properly. This permission also helps save
923.
by prophesi 7y ago
+1 to andOTP. It's on F-Droid and still gets semi-regular updates. It's a bit obnoxious that it requires a password, but that just means an autofill from my password manager for free at-rest encrypted storage.
924.
by prophesi 7y ago
Is there a news site that actually shows the leaked list of clients?
925.
by prophesi 7y ago
Yeah, I've been using Nextcloud for two years now. It overshadows Dropbox in terms of features and file-syncing.
926.
by prophesi 7y ago
No, I meant microg's Phonesky. Aurora Store is probably why Phonesky's development has been nonexistent; Aurora already seems to do what Phonesky was hoping to accomplish.
927.
by prophesi 7y ago
It's been in early development for ages, but MicroG's degoogled Play Store may fit the bill. https://microg.org/ I could see there being a filter for apps without google dependencies. That said, I think F-Droid is
928.
by prophesi 7y ago
Ah, thanks! I couldn't tell that was a case from the readme.
929.
by prophesi 7y ago
It'd be cool to implement this as a browser extension, that either silently strips the parameters, or opens a dialogue upon a link click telling you what the extension is allowed to strip out before proceeding.
930.
by prophesi 7y ago
Ah, and thank you for that! I had read the article a few times, but I didn't fully understand the attack until I saw your comment.

More ›