Email or username:

Password:

Forgot your password?
All posts firefly's posts Back to profile
6 posts total
firefly
Show previous comments
firefly
Taggart :donor:
9 May at 6:24

A password is a secret handshake you do with your keyboard.

10 May at 10:00 | Open on neon.nightbulb.net
firefly
Glenn H Shepard Jr
9 May at 18:22

"One never lies to people, they lie to themselves. A good liar gives fools what they want to hear and allows them to free themselves from the facts at hand, and choose the level of self delusion that fits their level of foolishness and moral terpitude."

--Carlos Ruiz Zafon

@bookstodon
10 May at 6:20 | Open on neon.nightbulb.net
firefly
🍄🌈🎮💻🚲🥓🎃💀🏴🛻🇺🇸
3 May at 1:42

PassKeys seem like a bad idea. Google backs them up to the cloud, so if your Google account is compromised then all your private keys are compromised. I don't see how that's an improvement over password+2FA at all.

Now security keys I get; keep the private key on an airgapped device. That's good. Hell I even keep my 2FA-OTP salts on a YubiKey.

#passkeys #fido2 #webauthn #yubikey #2fa #otp #authentication #cryptography #security #passwords #passkey #password #securityKey #google

10 May at 5:02 | Open on neon.nightbulb.net
🍄🌈🎮💻🚲🥓🎃💀🏴🛻🇺🇸

The funniest part is that no matter how many security factors we use to replace passwords (two factor auth, passkeys, security keys, etc) there's always a backup that's just another password.

#twoFactorAuth #2fa #password #auth #authentication #security #passkeys #webauthn #fido2 #passkey #passwords

3 May at 1:48 | Open on mastodon.social
dexternemrod :qubes:

@schizanon
I see that point and that's the reason why I prefer security keys.
The advantage is that if a service (not the passkey-service) is compromised they don't have your paaskey to try with other services and it's more phishing resistant. But you are right: If the passkey-service is compromises ot the user still only clicks without thinking this does not change a lot.

3 May at 4:35 | Open on troet.cafe
firefly
Structural security trumps computational security ... or ...
Diffuse structural security trumps amalgamated computational security ...
All your big, strong passkeys in one basket is less secure than your passwords in many individual baskets ...
Trying to explain this to tech bros can resemble pushing a wagon uphill ...
Because they want to sell something, logic is not paramount.

See here:

https://www.metzdowd.com/pipermail/cryptography/2023-September/038186.html

"A password in my brain is generally safer than an app or SMS stream that can be compromised. Although a passphrase may in some cases not be computationally more secure than a token mechanism or two-factor sytem, the simple passphrase is often _structurally_ more secure because that passphrase only links to and exposes one service target."

and here:

https://www.metzdowd.com/pipermail/cryptography/2023-September/038188.html

"I like to compare it to having one basket of eggs in one spot, and many baskets of eggs in many places. If your one basket of eggs has the master key to all the other stronger keys, is it easier to get the one basket, or the many baskets with weaker keys? So in this scenario cipher strength is not the most important factor for security. With a single basket one fox or pick-pocket or one search warrant can own all of your eggs for all your services."

#Passkeys #Passkey #Passwords #Password #2FactorAuth #Authentication #Security #Cryptography
Structural security trumps computational security ... or ...
Diffuse structural security trumps amalgamated computational security ...
All your big, strong passkeys in one basket is less secure than your passwords in many individual baskets ...
10 May at 5:07 | Open on neon.nightbulb.net
firefly
Eric the Cerise
8 May at 3:09

I would like to reclaim the word #Crypto .

It used to mean #Cryptography , before it got co-opted, and it should again.

For my part, I have never (?) used it in reference to #Cryptocurrencies .

I invite you to do the same.

I'll be tooting again in 5-7 years, about the correct meaning of #AI .

10 May at 4:15 | Open on neon.nightbulb.net
firefly
We may also need to weigh in on the meaning of #Quantum and #Computer.
10 May at 4:16 | Open on neon.nightbulb.net
firefly
firefly
@lcheylus@bsd.network

I would have hoped for a cover sheet showing exactly how the cipher is done. Instead of showing exactly how the killer performed the encipherment, the reader is left to divine that himself from the scattered data spread out over almost 70 pages. Typical cryptologist ... I prefer to not parse out a novella length paper to figure out what could have been expressed on one sheet.
10 May at 5:52 | Open on neon.nightbulb.net
Go Up