I prefer security keys. At work I use a yubikey, and I have Google’s security keys for my personal stuff. I tend to use totp as a backup.

For everything not banking, it’s great, I agree. I still prefer my security keys to everything. It’s hard to duplicate a digital key when it only exists on protected storage on a physical device, where that key never exists outside of that physical device.

In case anyone doesn’t know: FIDO works using a pair of asymmetric digital keys, the public key is sent to the remote site, and only the private key can decrypt anything encrypted by the public key. So a challenge (usually some mathematical calculation, not sure), is encrypted by the site/service that is handling the login, it sends over the encrypted request, which is passed, in it’s entirety to the fob. The fob requires a physical activation to process the challenge (usually a touch, but some require a fingerprint). The challenge is then decrypted, processed, the response is encrypted, and sent to the site for login, which decrypts the response with the public key, and compares the result to the result of the challenge that was sent.

There’s no part of this that can really be compromised. An eavesdropper can obtain the encrypted challenge (unable to be decrypted in any reasonable manner), and the response/public key… The public key isn’t useful, and the response is only valid for that specific login because there are aspects of the challenge that are unique per login.

All information in flight is unreadable nonsense. The only unique information to the key that is sent anywhere is the public key, which is supposed to be public.

Totp has the vulnerability of needing to relay the seed, usually by QR code. The only vulnerability there is when you set it up and the seed is shared to you, it can be intercepted. If that seed is stored anywhere that becomes compromised, then it becomes meaningless. It can be mined from an authenticator, or captured in flight.

Both of these are better than alternatives. Email/sms codes can be intercepted, either by an administrator or by an internet relay, or by sim duplication, etc. You know that already.

I don’t hate totp, I just recognize the faults in it.

There’s problems with physical security keys too, mainly in the fact that, if you lose the fob, you’re screwed. So it’s recommended to have a backup. Either in the form of a second fob, which is setup for all the same accounts which is stored securely, or in the form of another authentication method like totp.

Personally, I use a backup FIDO key for my accounts whenever possible. I also have a password manager that can store my totp so everything is in a single vault. If the vault is compromised then I’m screwed though… 90% of my accounts use a password reset email which is not stored in my vault. Only two things are not in my manager: that recovery email login (secured by my Fido key) and my bank (obviously also the vault login).

At work, I use the yubikey for everything that supports it, with totp as backup in my work’s duo authenticator account (duo is also setup to use my yubikey). So it’s all Fido/totp.

The only service I really want to use my security keys with that doesn’t support it, is my bank account… I suppose, also my government stuff, but almost all of that is informational. I can’t really make changes to my government stuff from their webpages. It’s generally just the government telling me things about my tax returns and whatnot (all SMS secured).

I hate the trend of companies requiring an app for 2FA… Something that’s not totp, but similar. You have a specific authenticator app for a single service on your phone only and it’s not great… Obvious examples include steam and Blizzard. Fuck that. I hate it. Go away. Give me normal MFA options… Dick.

I’ve ranted enough. Back to work for me.

Well, I have no arguments with what you’ve said. I think security keys/FIDO tokens should be more prevalent too. Otherwise this is 100% correct and I feel the exact same way.

I dunno about this analogy. I think the doctor proved that with enough time, anything can become a door.

Your story reminds me of something that my bank started doing. I got a robocall about something to do with my credit card, and the voice said to verify using x and y using my keypad, I think it was day/month/year of birth or something and I immediately noped out of the call. I hit all the wrong buttons until it got me to a person and I ripped them apart, and their supervisor for basically training their userbase to answer security questions given by an automatic voice on the other end of the line with no way to verify who is calling.

You can spoof your caller ID, you can get a text to speech robocall bot with DTMF recognition and just spam call a whole area where the bank operates and gather a bunch of personal information because it sounds just like the bank and there’s no way to prove who called.

What a crock of shit. It’s a security nightmare.

I did call my bank after at a known valid number, verified them as they verified me, and there was something going on, so the call was legit, and totally unacceptable.

These clowns want us to trust them completely, and give us no reason to do so, but they want us to bend over backwards to validate ourselves. Fuck that.

You’re right. I should try harder to be stupid if I’m going to impersonate the Don.

You know, there’s good people on both sides. People with a lot of value and good ideas. It reminds me of my businesses, so many good people. There’s a lot of good people in this world. You know what else is good? Watermelon. It’s a melon… Made… From water. How incredible. It’s delicious. How do they do that?

• Trump, probably.

I agree with the idea of bodily autonomy. Above all, someone should have the right to do, or not do, whatever they want with their own person.

Whether that is to listen to doctors advice, buy pharmaceuticals and self-administer as prescribed, or even end your own life, and everything in between.

Quick disclaimer, suicide should still be evaluated by a psychiatric professional, and simply being suicidal shouldn’t necessarily mean that nobody can, or should stop you from committing that act. I’m mostly referring to medically assisted self termination, after the appropriate safeguards, checks, and balances have been cleared. Simply wanting to off yourself without being cleared as having sound mind should be something we, as a society, should address carefully, with the assistance of mental health professionals.

With all that being said: I probably would DIY some pharmaceuticals. Anything that’s an opiate or other restricted substance, definitely not. But if I can buy the ingredients without needing a special permit or license, I definitely would.

Definitely menus.

Most of the run/gun aspects are very similar regardless of which Borderlands game you’re playing.

BL3 was by far the best for menus. Not perfect, but a lot less cumbersome than the previous games.

I want to go back and play through the whole series again, but the nuances of the older games that were fixed in the more recent games always throws me.

I play on PC and it’s very very obvious that kb/mouse was an afterthought for some of the games… I just hate doing fps with a joystick/thumbstick.

Either way, I’ve redeemed this for all of my copies of Borderlands. So the next time I log in, I should have golden keys for days.

The movie, that came out like, a month ago?

I was always planning to watch it when it went to streaming/home video kind of release. I rarely go to the theatre anymore.

I’m also waiting on the same for the new Deadpool + Wolverine movie…

Considering the little I’ve heard about it so far (trying to avoid spoilers), it seems like I should skip the Borderlands movie, but I’ll probably still watch it.

Something I’ve noticed with institutional education is that they’re not looking for the factually correct answer, they’re looking for the answer that matches whatever you were told in class. Those two things should not be different, but in my experience, they’re not always the same thing.

I have no idea if this is a factor here, but it’s something I’ve noticed. I have actually answered questions with a factually wrong answer, because that’s what was taught, just to get the marks.

What if this lifetime is also a dream.

Like inception.

The closest thing to a thin and light that I own is my framework.

I felt like anything less than what framework offers for repairability wouldn’t be sufficient for me.

There’s actually an argument that makes the point of driving prices down with soldered RAM.

The individual memory chips and constituent components are cheaper than they would be for the same in a DIMM. We’re talking about a very small difference, and bluntly, OEMs are going to mark it up significantly enough that the end consumer won’t see a reduction for this (but OEMs will see additional profits).

So by making it into unupgradable ewaste, they make an extra buck or two per unit, with the added benefit of our being unupgradable ewaste, so you throw it out and buy a whole new system sooner.

This harkens back to my rant on thin and light phones, where the main point is that they’re racing to the bottom. Same thing here. For thin and light mobile systems, soldered RAM still saves precious space and weight, allowing for it to be thinner and lighter (again, by a very small margin)… That’s the only market segment I kind of understand the practice. For everything else, DIMMs (or the upcoming LPCAMM2)… IMO, I’d rather sacrifice any speed benefit to have the ability to upgrade the RAM.

The one that ticks me off is the underpowered thin/lights that are basically unusable ewaste because they have the equivalent of a Celeron, and barely enough RAM to run the OS they’re designed for. Everything is soldered, and they’re cheap, so people on a tight budget are screwed into buying them. This is actually a big reason why I’m hoping that the windows-on-ARM thing takes off a bit, because those systems would be far more useful than the budget x86 chips we’ve seen, and far less expensive than anything from Intel or AMD that’s designed for mobile use. People on a tight budget can get a cheap system that’s actually not ewaste.

At this point, “centrist” is slang for, “I want to argue for what I believe in under the guise of being the ‘Devils advocate’”.

Remember you absolutely must not go to these specific sites.

Do not do it.

See you all tomorrow for class.

But how else is he going to pay for his yacht… I mean, pay to feed his children… Yeah, that’s relatable with millennials and zoomers that are so far in debt and earning so little that they can’t afford kids, right?

Thanks for the follow up!

It is plausible that location used to be a bathroom in a now missing building. I just don’t think TP would hold up like that at all. TP is generally designed to come apart over time, especially in the presence of water, to help it go through wastewater pipes and get processed when it reaches the wastewater plant at the end of the line.

So I think, even if the holder is genuinely part of the original building that was there, someone added to it with, what looks like, a TP roll… For art.

There’s reasons behind this. LPDDR IIRC works most efficiently when it’s closer to the CPU than what dimms would allow for.

Boosts speed and lowers the power requirements.

It also incentivizes people to buy larger SKUs than they originally wanted, which, bluntly, is probably the main driver for going that direction… I’m just saying that there’s technical reasons too