>Operating systems are supposed to get in the way of things like this
debbie from accounting will say "darn thing wont let me do my job", and get frustrated from all of the prompts and approvals she doesnt understand. she is just going to click yes on every single prompt, not reading it. no meaningful security increase occurs.
debbies boss is going to get annoyed that debbies productivity has fallen 15% because she doesnt understand what her computer is asking for and she is having to stop what she is doing to hit some stupid prompt every 10 minutes. no meaningful security increase occurs.
tier 1 tech support will quit their jobs because now they arent just resetting hundreds of passwords each day, they have to listen to people yelling at them about their computer prompting for permissions every 10 minutes. "just hit yes whenever it shows up", they say. no meaningful security increase occurs.
neckbeard mcneckbeard on HN will screech "mIcRoSlOp thinks they know how to secure my computer better than me!! screeeeeee walled garden screeeeeeeeee if i bought it i should be able to do anything to it". mr. mcneckbeard is very vocal and causing all sorts of bad publicity. they hack some workarounds or change the settings so that they dont get prompted every 10 minutes. no meaningful security increase occurs. (side note: i ~mostly~ agree with mr mcneckbeard)
if security is not convenient, people will work around it, and you'll end up with even worse security because everything will be done in the shadows.
security an extreme balancing act. if the friction is too high, it will end up lowering security, not increasing it.
>Backwards compatibility is not more important than this
in more situations than you probably think, backwards compatibility is literally the most important thing.
at the risk of going a bit off topic here, what specifically has deteriorated?
as someone who has used 1password for 10 years or so, i have not noticed any deterioration. certainly nothing that would make me say something like they are a "shell of their former selves'. the only changes i can think of off the top of my head in recent memory were positive, not negative (e.g. adding passkey support). everything else works just as it has for as long as i can remember.
maybe i got lucky and only use features that havent deterioriated? what am i missing?
All of their browser extensions have been unusuably glitchy and janky for me for about four years, I recently gave up and switched to manually copying passwords over from the desktop or mobile apps.
Personally, I can tolerate that, but there are so many small friction points with the application that just have never been improved, since they started focussing on enterprise customers the polish and care seems to have disappeared
I dabbled earlier but started using 1Password in earnest in 2010 or so with 1PW3. There are plenty of things that could be argued about when it comes to the switch from a native Mac application to Electron, degradations in the GUI etc, some of us may be more sensitive then others. But one major objective thing you're apparently missing was the shift to a forced subscription, including deactivating previous supported sharing methods, and with the typical-for-VC-driven-feudalism-model eye wateringly, outrageously expensive and inferior multi-user support. Pure, proud rent seeking. And then naturally as well the artificial segregation of simple features like custom templates began too.
I hope someday that's made illegal. In the meantime there's Vaultwarden.
almost everyone knows the formula for olvine and quartz, too, of course
theres probably less than 10 people in my entire company that know half of the words you wrote there. whats an "iso"? what is "flashing" the "iso"? how do i "boot medium"? what is "KDE" and why do i want to say yes?
(i know what these are, and maybe most people browsing a tech-focused forum with "hacker" in the name, but the vast majority of people do not)
You are right, I somehow forgot the word "here" after "anyone". I don't expect the average laymen be able to follow these steps, but I have those expectations from the people here.
this is a well-studied field (stylometry). when combining writing styles, vocabulary, posting times, etc. you absolutely can narrow it down to specific people.
even when people deliberately try to feign some aspects (e.g. switching writing styles for different pseudonyms), they will almost always slip up and revert to their most comfortable style over time. which is great, because if they aren't also regularly changing pseudonyms (which are also subject to limited stylometry, so pseudonym creation should be somewhat randomized in name, location, etc.), you only need to catch them slipping once to get the whole history of that pseudonym (and potentially others, once that one is confirmed).
Stylometry is okay if you're trying to deanonymize a large enough sample text. A reddit account would be doable. But individual 4chan posts? You barely have enough content within the text limit.
In one use case, it is kind of a verbal exclamation point, but it has more meanings and uses than just that. Likely originates from Hokkien, but it has evolved into it is own thing. If you are curious, more details here https://en.wikipedia.org/wiki/Singlish
sure, not denying that. my writing style is fairly different now in my 40s than it was in my late teens/early twenties.
but, those changes are usually pretty gradual and relatively small. thats why when attempting to identify someone via writing, you look at several aspects of the writing and not just word choice (grammar, use of specific slang, sentence length, paragraph structure, punctuation, etc.). it is highly unlikely that all aspects of someones writing changes at the same time. simply removing "ha" is inconsequential to identification if not much else changed.
additionally, this data is typically combined with other data/patterns (posting times, username (themes, length, etc.), writing that displays certain types of expertise, and more) to increase the confidence level of correct identification.
i am on mullvad and accessing it fine. if you are on one of the default exit nodes, try switching it. i find the default nodes get blocked by a lot of sites, likely due to malicious behavior of other users.
if fines were levied and actually collected, itd be a pretty robust regulation for privacy. theres other issues with it, but nothing that requires gdpr to be wiped out -- just modified (and clarified) a bit.
>you just need to know at least a little more than the companies you are consulting for.
sometimes (i'd argue often, actually), you don't even need that. simply having an outside/fresh perspective and the fact that you aren't part of any of the existing groups/silos is valuable.
Often the most useful thing is just listening to the right people in the company. I wouldn't be 100% surprised if someone in the company in the story had already had the idea for the third electrode, but it took the suggestion from the high-paid consultant to get it taken seriously.
Meta are paying $30k per year, which is crazy really, when you think how much Blender has assisted in getting content onto their platform. Nvidia is better at $120k, but again, think how many graphics card buys Blender cycles has driven.
this is a very common pattern in tptacek's comments, but it's not worth calling out as he absolutely refuses to recognize it, always falling back to a similar response you see here.
with a quick google of "3des broken" and reading the first paragraph of wikipedia on 3des, i was able to guess (correctly!) what they original commenter was referring to.
It's pretty self-indulgent of me to respond to this comment, but just real quick: the pattern you're seeing is me in fact not being one of the top-tier experts in cryptography on Hacker News (just one of the loudest), and not knowing who this person is, and not having had a reason to think about 3DES in quite a long time. What you're reading as snark or lawyering is, rather, me meaning exactly what I said, and being uncertain about what that person was talking about.
if i were to guess, they are referring to CVE-2016-2183, which lead to deprecation of 3DES by NIST in 2019 (announced in 2017) and disallowing all uses in 2023. openssl also stopped including it in default builds starting in 2016 because it is considered weak.
This is Sweet32, an attack on any block cipher with an 8-byte block size. We don't consider those ciphers "broken"; they just can't be used safely in some common modes. You shouldn't use 3DES or IDEA or Blowfish, of course, but I don't think they're considered "broken", not in the same sense that, say, RC4 is.
It's true that 64 bits was known not to be enough when DES shipped decades ago, but there is some difference between "We know that's a bad idea" and a demo showing why, and so I think I'm OK with the word "broken" in that context.
There's a reason POCs matter right? Why you feel comfortable (even though I don't agree) saying multi-threaded Go doesn't have a memory safety problem and yet you wouldn't feel comfortable making the same claim for C++.
I'm not a cryptographer but to me "broken" seems to imply that the core algorithm itself can be attacked. If merely applying it in certain ways as part of some larger system can fail then aren't most (possibly all) ciphers broken? It's entirely possible to do all sorts of stupid things.
Granted, a 2^32 block limit is pretty severe by modern standards.
Sorry, calling that a block limit was an error by omission on my part. 2^32 yields a 50% chance of reuse. If we pick a sane security margin it's a lot smaller. Assuming I did the math correctly just now, 2^-32 only gives you ~2^17 blocks; dropping that to 2^-24 yields ~2^21 blocks.
Off the top of my head, NIST was suggesting something like 8GB as the working limit. It would depend on your risk tolerance and the application in practice I guess. For something like video you might not really care about exposing a few 8 byte blocks here and there where the exposure is one block XORed with the other.
An aside, personally I quite like TDES for the purpose of generating secure handles and the like. The larger block sizes of pretty much every other common algorithm yield URLs and integers that are more difficult to work with. 64 bits is a manageable enough length and you don't have to implement the algorithm yourself (at which point you'd have rolled your own crypto).
Not to be rude, but it seems to me that you are engaging in some hairsplitting. In general, security people do not recommend to use 3DES or RC4 - even if RC4 is broken in other ways than 3DES.
RC4 is actually broken. It's fundamentally broken. As you run it, it's face melts off like the guy at the end of Raiders. It's genuinely weird nobody noticed how bad it was, in a practical sense, until the late aughts.
The 64 bit block size in 3DES (and Blowfish and IDEA) limits how much data you can encrypt under a single key. I think the real "tell" that this isn't hair-splitting is that people don't ever generally talk about Blowfish being "broken", just obsoleted.
to any non-cryptographer, i think that's a distinction without a difference. it's disallowed from use by the major standards institute due to a vulnerability where people can recover the plain text.
that sounds "broken" to me, but i'm not a cryptographer. so, i'll defer to you when you say it's not broken. (i dont know what the cryptographer-specific definition of broken is -- it'd be great if you would shed some light on that)
debbie from accounting will say "darn thing wont let me do my job", and get frustrated from all of the prompts and approvals she doesnt understand. she is just going to click yes on every single prompt, not reading it. no meaningful security increase occurs.
debbies boss is going to get annoyed that debbies productivity has fallen 15% because she doesnt understand what her computer is asking for and she is having to stop what she is doing to hit some stupid prompt every 10 minutes. no meaningful security increase occurs.
tier 1 tech support will quit their jobs because now they arent just resetting hundreds of passwords each day, they have to listen to people yelling at them about their computer prompting for permissions every 10 minutes. "just hit yes whenever it shows up", they say. no meaningful security increase occurs.
neckbeard mcneckbeard on HN will screech "mIcRoSlOp thinks they know how to secure my computer better than me!! screeeeeee walled garden screeeeeeeeee if i bought it i should be able to do anything to it". mr. mcneckbeard is very vocal and causing all sorts of bad publicity. they hack some workarounds or change the settings so that they dont get prompted every 10 minutes. no meaningful security increase occurs. (side note: i ~mostly~ agree with mr mcneckbeard)
if security is not convenient, people will work around it, and you'll end up with even worse security because everything will be done in the shadows.
security an extreme balancing act. if the friction is too high, it will end up lowering security, not increasing it.
>Backwards compatibility is not more important than this
in more situations than you probably think, backwards compatibility is literally the most important thing.