scare your kids this halloween by telling them stories about "the fetterman"

If you actually read the “Passkeys are a trap. Do not use them.” post going around, you’ll find a transparent attempt to clumsily string together a conspiracy.

The post is predicated on the idea that a feature of WebAuthn called “attestation”, which is only used in high-assurance and usually corporate scenarios, and usually with physical hardware security keys, will be leveraged to hurt people, somehow.

The post posits that a website like X will bait and switch users: first, you get a passkey. Then, later, scary “attested” passkeys! This simply isn’t possible to do because attestation isn’t supported on the web for mass market, consumer authentication.

Attestation for passkeys (software-based, syncable credentials) is antithetical to their mass market goals, and would freeze out independent, non-corporate-backed credential managers. It’s an explicit non-goal of the designers of passkeys, who work together in a forum anyone can join.

And trust me, websites and apps like banks repeatedly asked for attestation at the beginning of the industry’s passkey journey. The platforms, browsers, and credential management apps have held firm that the goal of passkeys is reducing phishing and **not** some kind of trusted computing scheme. (And I will note: over my dead body!)

Besides the theory of the case being fundamentally wrong, there are several things that make the post disqualifying in terms of arguing something useful or important in the realm of security, privacy, and user authentication:

1. Intentionally presenting things that are complicated as inherently suspicious. (Delivering security by design can be complicated, yes!)

2. Describing TOTP as a “great solution” for adding security to a password-based account. When the most common threat model on the web is phishing (a word the post never mentions!), TOTP hardly buys you _anything_. TOTP is phishable.

3. Seeming to be unbothered by how many logical leaps are being taken without actually understanding the topic being discussed.

There are bad things happening in tech and untrustworthy people and companies do exist, but they’re largely in the AI space, not the “let’s stop people we love from getting compromised through phishing” space.

having a little too much fun setting up server rules for testing

Okay the guy ought to be in jail I know, but it's at least slightly amusing to me that every BBC article about him now always seems to include that unflattering photo of him in the car looking completely deranged

I realized today that the reason my MacBook's webcam lens is always smeared is because the industrial design encourages the user to put their finger on it every time they open the lid. Another piece of amazing design from Apple's genius designers

https://youtu.be/03--ARTlhw4

can't believe that ice cube won a nobel prize

note to ui designers. when i'm reading a long piece of text. i select text while i read it. I select text while i read it!. i select the text using my mouse. while i read the text i often select the text. when i select the text i just want to select the text. i don't want to perform actions on the text. i don't want a popup menu to appear when i select the text. i don't want to accidentally click on a Share link. i want to select text while i read it

https://youtu.be/YEaicg1kYMk

Posh. Baby. Sporty. Pumpkin. Ginger. Old. But they were, all of them, deceived, for another Spice was made.

I can't even keep track of the names of these themed months any more. It's "Orctober"? What the fuck does that even mean

"Why do Swiss Army knives have a hook attachment?"

https://youtu.be/PVEZl-32iTE

@fraggle it's blowfish2 by default, which avoids the 64-bit block problem.

the main deficiency is that it's CFB mode with no MAC, so it has no authenticity guarantee and is vulnerable to arbitrary tweaking (ciphertext xor tweak turns into plaintext xor tweak once decrypted).

some builds of vim support cryptmode=xchacha20v2 via libsodium, but this is poorly documented and the code doesn't make it clear whether it's XChaCha20 alone (same tweaking problem) or XChaCha20Poly1305 (AEAD, secure).

TIL vim has built-in encryption. If you type :X it prompts you for a passphrase and after saving the file it will be stored in encrypted form. When you reopen the file in vim it detects the encrypted format and prompts you for the passphrase to decrypt, so it's completely transparent. It uses the blowfish cipher, which is pretty old now but still considered secure, so long as it's only used for small files

i heard they made a digger movie, is tom cruise the nobbin or the hobbin

@rooster Hearing “carbon footprint” always makes me think of this:

Needed to put up a shelf and instead of asking hubby I tried to do it myself with YouTube. Went to the shed to pick up the spirit level I've seen him use, and the shed has twelve loaves of pumpernickel bread and a toaster. And this is how I find out he's a bread fetishist.

I like the dense German style pumpernickel that Aldi sells seasonally in autumn. I don't like to share it with my wife, so my fess is that I bought 48 kg of it and have stashed it in my toolshed. When my wife thinks I am tinkering, I am also toasting and eating into my stash.

https://theonion.com/guy-who-sucks-at-being-a-person-sees-huge-potential-in-1850488022/

#wikipedia