Mama told me not to come.
She said, that ain't the way to have fun.
Bitwarden has no secondary key, and the master key is never sent to the server. All they get is an email address and encrypted data. If you forget your key, your passwords cannot be accessed, which means an attacker is screwed too.
There are tons of ways to give yourself ways to "recover" your password that don't compromise you in a breach scenario:
- logged in devices - they have the key decrypted and can generate a new one, re-encrypt, and overwrite the data server-side
- store a physical copy of the password at home somewhere (notebook?)
- share passwords with a trusted person (SO) for critical shared accounts
- securely store an unencrypted backup of your password vault (say, on a personal computer with full disk encryption)
Maybe that's how 1password works, idk, but I do recommend verifying that there's no password recovery option on whatever password manager service you use.
your email (to be able to recover your password for the password manager)
If your password manager has a password recovery mechanism, that means your key is stored on the server and would be compromised in a breach. If that's the case, I highly recommend changing password managers.
The ideal way a password manager works is by having all encryption done client-side and never sending the password to the server. If the server cannot decrypt your password data, neither can an attacker. That's how my password manager works (Bitwarden), and I highly recommend restricting your options only to password managers with that property.
If you need a backup, write it in a notebook and keep it in a safe. If your house gets broken into, change your password immediately before the thief has a chance to rifle through the stuff they stole. My SO and I have shared passwords to all important credentials, so that's out backup mechanism.
I don't know your rule, but when I hear this, usually it includes the name of the service or something, so a script kiddie armed with a levenstein distance algo could probably detect it.
That said, the "safer than the person next to you" rule applies here. You're probably far enough down that list to not matter.
As for password manager breaches, the impact really depends on what data the password manager stores. If all decryption is done client-side and the server never gets the password, an attacker would need to break your password regardless. That's how Bitwarden works, so the only things a breach could reveal are my email, encrypted data, and any extra info I provided, like payment info. The most likely attack would need to compromise one of the clients. That's possible, but requires a bit more effort than a database dump.
If there's a leak with multiple services, it's possible some script kiddie will flag it as having a pattern. I'm guessing the rule is simple enough that an unsophisticated attacker could figure it out with several examples.
It's way better than reusing passwords, but I don't think it's better than a password manager, and it takes way more effort esp given all the various password rules companies have (no special characters, must have special character, special character must be one of...). If you're paranoid, use something like keypassxc that's just a file.
Yes, it is better. The likelihood that someone will physically access your device is incredibly low, the likelihood that one of the services in your bucket gets leaked and jeopardizes your other accounts is way higher.
I set mine to require my password after a period of time on certain devices (the ones I'm likely to lose), and all of them require it when restarting the browser.
it just unlocks with a fingerprint, and I think law enforcement are allowed to force you to biometrically unlock stuff
True, but it's also highly unlikely that LE will steal your passwords.
My phone requires a PIN after X hours or after a few failed fingerprint attempts, and it's easy to fail without being sus. In my country, I cannot be forced to reveal a PIN. If I travel to a sketchy country or something, i switch it to a password unlock.
Yeah, hurricanes aren't really a thing in that region, they have monsoons instead.
I disagree that anything you describe could actually be both commercially viable and deployable without authoritarian involvement
You haven't heard of Ring cameras? Commercial security systems? They do basically what I'm describing, just not as well because they don't have as much of an incentive. Are end users willing to pay for these more advanced models? No, so consumer grade cameras stick to object detection like deer vs racoon instead of specific individual detection (e.g. scanning eyes).
Governments, however, are willing to pay that amount. Why? Because they think it'll help them detect criminals, and they think that helps keep people safe. It's an extension of the HOA idea, just with government-scale funds backed up with law enforcement to go after threats. That, in itself, isn't authoritarian, but setting up such a system opens the door for authoritarians to take control and misuse it.
I'd go so far as to say that the people in your theoretical HOA are analogous to supporters of a authoritarian regime.
Analogous, sure, but the HOA has no enforcement arm for non-residents, so all they can do is ask the police to intervene. That's the difference with a city, it has a police force it can order to intervene using information from that system. It's the mixing of enforcement and surveillance that makes it authoritarian.
So a surveillance system is not itself authoritarian, it's only authoritarian of there's some enforcement arm to enforce obedience or punish disobedience.
If it is nearly impossible to meaningfully use apolitically, then it is not apolitical.
Again, I disagree. Something is only political when used for political ends.
What's crazy is I agree with some of what he says, but disagree entirely with his company.
Basically, he says the Antichrist promises security in exchange for giving up your freedom. However, his company does exactly that, it promises security in exchange for taking away freedom from the people. So at best he's a hypocrite and at worst an accelerationist.
I agree that people are willing to trade freedom for security, but I disagree that's what governments should do. Governments need to protect freedoms first, and security second.
Similarly, even if HOAs could deploy a system like that, that’d make them authoritarian.
That really depends how the system is used. If it explicitly doesn't record regular residents and people who have signed up officially as visitors (and homeowners can review footage), I don't think the camera system itself would really be authoritarian. Yeah, the system would be capable of violating privacy, but as long as the system is transparent and reviewable by the residents, I think it can be privacy-respecting. Basically, it would be like a home security system, but across a neighborhood, and it can even be self-hosted to not let third parties access the data (and police requests would go through the HOA board, which consists of residents).
That's my point. If the system itself can be used in a privacy-respecting way (and the vast majority can), even if it's typically not used that way, the system itself cannot be authoritarian. If an institution uses it in an authoritarian way, then the institution is authoritarian.
In short:
- cameras are not authoritarian
- databases are not authoritarian
- license plate and face recognition software isn't authoritarian
- connecting 1-3 together in a searchable way isn't authoritarian (would be a fun hobby project)
- Sharing info from 4 isn't authoritarian (again, could be a fun hobby with friends)
- An institution (gov't, business, HOA, etc) using 4 and/or 5 to enforce policy on citizens/employees/residents/etc is authoritarian
I have friends that use home cameras to do object classification as a hobby, mostly to identify and fee record wildlife. I've also heard of people doing this to identify package deliveries and catch package thiefs. Sharing those models with others on the internet is largely the same idea as what flock is doing, and with enough data, similar solutions to what Palantir is doing could be done entirely by hobbyists.
The products Flock and Palantir aren't authoritarian in and of themselves, it becomes authoritarian when those products are used to enforce policy.
Some solutions here are technically illegal to make laws about. The government cannot force a company to give away its copyrighted server code, not even in compiled form. Since there are alternatives that don't require giving away copyrighted material, it's better to keep it vague.
So it's both the friendliest to companies and the easiest to pass as a law.
I would argue that such a product would be by its nature political, because it’s only practical use case was the furtherance of a political goal.
Again, I disagree. Surveillance has a lot of use cases outside of government, and a huge use case is keeping the government in check. Palantir could have sold its services to non-profits like the ACLU as a check on local, state, and law enforcement agencies. They could have sold it to HOAs and neighborhood watch associations as an early warning system for repeat offenders.
The government skirting the 4th amendment (and a few others) doesn't automatically make its sub-contractor's products "authoritarian," it makes its use of those products authoritarian.
So a system that does so (like the ones sold to the govt) is a political software product.
I disagree with that conclusion. The use by the government is authoritarian, but that doesn't make the product authoritarian.
To me where it gets tricky is when private entities grow to government-sized proportions, and begin to use these same tools for similar purposes
A private entity can do authoritarian things, like spying on its employees or customers. Authoritarianism isn't strictly tied to governments, but anything that acts like a government. Here's the first definition I found:
Characterized by or favoring absolute obedience to authority, as against individual freedom.
Software can't really favor obedience to authority, it can't really deny you your freedoms, it's just software. Likewise for a camera system. The only way those things can be authoritarian is if paired with some form of enforcement arm, like corporate security or law enforcement. So that combined system is authoritarian, the cameras or software on their own cannot be authoritarian.
That's my point.
And ideally give enough forewarning that the community can build it before they shut the servers off.
The question is, will he still see a profit if it takes 5-10 years? Will his investors stick with him even if he loses billions? They almost left in 2008, what if this takes longer than that?
If you're taking the contrarian stance in investing, you have to be right both about direction and timing, and timing the market is very hard if not impossible.
DuckDuckGo still does that, and it generates UUIDs too, which is nice.
Yeah, I read that he has somewhere around $300M. Not a billionaire, but not poor.
That's the thing though, options are generally relatively short in duration, with most being a few months. The longest options are around 1-2 years out.
Could AI stay keep its hype for 1-2 years? Probably. Will it? Who knows!
The market can remain irrational longer than you can remain solvent.
Looks like very mixed returns. Which is what you'd expect from a strategy of betting on areas that are significantly overvalued.
Again, I don't think it really does.
Let's say I identify an officer that shot a pepper ball at a protester. Let's say I report it to the news, file a complaint, and file a lawsuit. Here's what I expect to happen:
- news agency runs a small piece on the incident, perhaps naming the officer, perhaps not
- police does an internal investigation and determines the officer was acting within their duties
- lawsuit is dropped because I don't have standing (I'm not the victim), and if I did have standing, the agency might get fined and the officer retains their position
That's not real accountability IMO, real accountability would result in the officer getting investigated by the AG or something and potentially jailed for using excessive force.
Make sure whatever password manager you use doesn't store the key on their servers. Bitwarden does this correctly (if you lose your PW, Bitwarden can't recover it), and I'm sure some competitors do as well. LastPass apparently didn't.