Skip Navigation

InitialsDiceBearhttps://github.com/dicebear/dicebearhttps://creativecommons.org/publicdomain/zero/1.0/„Initials” (https://github.com/dicebear/dicebear) by „DiceBear”, licensed under „CC0 1.0” (https://creativecommons.org/publicdomain/zero/1.0/)C
Posts
0
Comments
693
Joined
2 yr. ago

  • Thanks. Will check it out.

  • Good way of putting it. How many people have three devices they can use for storing passkeys? I don’t and I’m a nerd.

  • That’s probably a good idea.

  • Yeah this is my situation. My personal computer is really infrequently used and as such I’m already in a dangerous situation when it comes to sign-in risk detection kicking off and asking for further authn proofs. I’ve had my phone die (and come to life when its replacement arrived) and that was a harrowing situation because all the MFA is stored there. Passkeys seem to make it worse, unless I subscribe to a sync service, which I need to infallibly trust (and I’m iffy on that; 1Password has a good security model and all that but passkeys are a different level of trust).

  • You create unique accounts for every team member so that access can appropriately be logged.

    Or you implement a PAM tool that logs access and vaults the password and rotates it after use.

  • They’re device-bound certificate based authentication with some shiny bits.

    Or they’re portable-via-certain-services certificate based authentication with some shiny bits.

    Either way they’re new and try explaining that the user needs a new one for every device (or needs a new app to carry them around in) and that if the device dies, or the app dies, they lose it all. I have quite a few people in my life who can’t wrap their heads around using a password manager.

    Personally, I find them irritating. My chosen password manager on iPhone doesn’t support them, so I need to have the iOS password vault turned on (yes, this is a dark pattern Apple has created to try to increase adoption of their password vault) to use them. Adoption needs to be much higher, interoperability needs to be better, and they need to put back the hint for which vault to use (which was removed early on to keep Microsoft and google from forcing chrome/edge vaults, but has the actual effect that chrome/edge tend to win the race over other options and means that the passkey prompt might be for a different app than the one that you prefer, leading to further user confusion)

  • That’s an IAM no-no.

  • How many unemployed people do you know in the trade? You can’t learn it overnight. Existing projects are underway, and the equipment needs to be built.

    Edit - reread the summary there and they broke ground in 2019; you’re right that’s silly.

  • Globally, there’s going to be continued need for your skills.

    Locally, it may vary.

    Look globally. And good luck with finding your path. I have done the unemployment track and it is unpleasant.

  • Damnit. Beat me!

  • The article is about Southwest Airlines. Maybe a bad copy/paste?

    the Louvre spent more money on acquiring expensive art that upgrading its security.

    Arguably that’s what the Louvre’s business is. I’d argue they need to work on their security, but as we in the industry all know, failing a regulatory requirement, getting more budget can be quite an uphill battle.

  • This from a 11 year old security audit has nothing to do with the recent heist other than demonstrate that at the time of the audit they didn’t have the funding to hire good information security people.

  • This hits close to home.

    Conversely, when an engineer or engineering manager repeatedly raises an issue and is told that they need to make it work by a date or there’s hell to pay, there’s no point in having the skip level conversations. The engineers just leave.

  • Unpopular opinion: cats are an invasive species in most places, like dogs, and shouldn’t be subject to different regulations than dogs.

    Keep them on a leash if you care about them.

    Is this a bellwether for how the car will handle a kid? Perhaps. Worth thinking about.

  • Running this all on one system presents a single point of failure. Separate the router from the server, even if simply for sanity.

  • The way that Siri works, it’ll hear “I’m hungry” as “I’m horny” and sign you up for a sex toy subscription.

  • This is why unions matter. Aside from negotiating employment agreements, they can lobby government. Enough unions across enough industries will make change.

  • Simply, check for cloud dependency; can you set it up without the thing’s app, without internet? Does it keep working when the internet is down?

    • zigbee
    • zwave
    • onvif/rtsp
    • matter
    • if it supports HomeKit, there’s a good chance you can use a bridge to bring it into Homeassistant

    Thread and matter can have “unique” implementations but it’s better than proprietary.

  • That’s true, and but the part

    they just don't often get held accountable bcs it's never to, for, or by the public (and pubic values, common morals, etc).

    Is the “special” part of it. If they were held accountable by their peers, their peers might also be held accountable. Class solidarity in action.