invite response« First « Previous Comments 48 - 87 of 305 Next » Last » Search these comments
49
Patrick
2021 Jul 27, 9:46am
Patrick
2021 Jul 27, 9:46am
https://edwardsnowden.substack.com/p/ns-oh-god-how-is-this-legal
In short, the phone in your hand exists in a state of perpetual insecurity, open to infection by anyone willing to put money in the hand of this new Insecurity Industry. The entirety of this Industry’s business involves cooking up new kinds of infections that will bypass the very latest digital vaccines—AKA security updates—and then selling them to countries that occupy the red-hot intersection of a Venn Diagram between “desperately craves the tools of oppression” and “sorely lacks the sophistication to produce them domestically.”
An Industry like this, whose sole purpose is the production of vulnerability, should be dismantled. ...
If you want to see change, you need to incentivize change. For example, if you want to see Microsoft have a heart attack, talk about the idea of defining legal liability for bad code in a commercial product. If you want to give Facebook nightmares, talk about the idea of making it legally liable for any and all leaks of our personal records that a jury can be persuaded were unnecessarily collected. Imagine how quickly Mark Zuckerberg would start smashing the delete key.
51
richwicks
2021 Aug 7, 3:54am
richwicks
2021 Aug 7, 3:54am
If people want a phone that doesn't spy on them, they have to have a stripped down OS that they can understand, that will trivially monitor inbound and outbound connections.
It has to be simple enough so that that a typical coder can understand the OS (i.e. an embedded OS) and move the complexity up into libraries.
The problem with OSes is they are monolithic. Understanding Linux is a tremendous task, understanding Windows is an impossible task. This was done for efficiency reasons back in the day, but building an OS on top of a kernel, like MACH, that's still doable. This is a software abstraction of the hardware itself. The OS runs on top of another OS, a very simple OS. This was once called a Board Support Package.
Kernels allow you to run multiple operating systems on a single device, often simultaneously. NO hardware is directly accessible, and you can always detect access to the hardware through the interface. I think this will have to be done at some point to guarantee security.
If you had, for example, a virus running on your phone, you'd be able to detect the outbound data packets on it, and the incoming data packets on it. What files were modified, which parts of the storage were written or sent out, and what devices were activated. This was impractical 20 years ago because we were running on 200 Mhz machines, but it's entirely practical now at the cost of a bit of battery life - and my phone runs fine for weeks without a charge when its unused. I have a junk phone I use only for wifi access, and screwing around on (it's got damaged screen), I can leave that thing sitting on the counter for 2 weeks, and it goes from 100% charge to 90% charge over that time.
We can even further secure the devices, by using the kernel to require certified binaries only be run, and to expand the storage, to not only record things like date and time, but the applications that created them. This has already been figured out, but it's purposely not implemented. It's trivial to eliminate viruses, and to guarantee secure communication - the reason it's not done, is the government doesn't want it done.
I worked on the XBox project. One of the main concerns on developing that system was PREVENTING unauthorized code from running on it. Why? Because MS sold the machine for BELOW COST to gain marketshare. They make up the cost differential because for each game sold, they receive a cut of the sale. So, they might sell the first revision of their machine for $300, but it cost $500 to make, but they expected 10 games to be bought by a user on average, so they would initially break even. Then they cost reduce and the box to $400 to make, then $300, then $250, then $200 and so on. As they do this, they also reduce the cost of the game machine to gain market share.
What they were terrified of, is a company could run arbitrary software on it, and cut out MS from their fee, or even worse, making a machine that kicked ass, that was a full replacement for a desktop, that could act as a server. Game machines, are no longer toys, they are as powerful as servers. They do not want you to be able to use them as full machines, just toys - but games have to have a digital signature, this could be done with any machine, that would obliterate viruses - but they don't. Why do you think that is?
Machines are PURPOSELY built with backdoors, and phones, they are the worst. Nobody cares about desktops today, they care about your personal communication.
It has to be simple enough so that that a typical coder can understand the OS (i.e. an embedded OS) and move the complexity up into libraries.
The problem with OSes is they are monolithic. Understanding Linux is a tremendous task, understanding Windows is an impossible task. This was done for efficiency reasons back in the day, but building an OS on top of a kernel, like MACH, that's still doable. This is a software abstraction of the hardware itself. The OS runs on top of another OS, a very simple OS. This was once called a Board Support Package.
Kernels allow you to run multiple operating systems on a single device, often simultaneously. NO hardware is directly accessible, and you can always detect access to the hardware through the interface. I think this will have to be done at some point to guarantee security.
If you had, for example, a virus running on your phone, you'd be able to detect the outbound data packets on it, and the incoming data packets on it. What files were modified, which parts of the storage were written or sent out, and what devices were activated. This was impractical 20 years ago because we were running on 200 Mhz machines, but it's entirely practical now at the cost of a bit of battery life - and my phone runs fine for weeks without a charge when its unused. I have a junk phone I use only for wifi access, and screwing around on (it's got damaged screen), I can leave that thing sitting on the counter for 2 weeks, and it goes from 100% charge to 90% charge over that time.
We can even further secure the devices, by using the kernel to require certified binaries only be run, and to expand the storage, to not only record things like date and time, but the applications that created them. This has already been figured out, but it's purposely not implemented. It's trivial to eliminate viruses, and to guarantee secure communication - the reason it's not done, is the government doesn't want it done.
I worked on the XBox project. One of the main concerns on developing that system was PREVENTING unauthorized code from running on it. Why? Because MS sold the machine for BELOW COST to gain marketshare. They make up the cost differential because for each game sold, they receive a cut of the sale. So, they might sell the first revision of their machine for $300, but it cost $500 to make, but they expected 10 games to be bought by a user on average, so they would initially break even. Then they cost reduce and the box to $400 to make, then $300, then $250, then $200 and so on. As they do this, they also reduce the cost of the game machine to gain market share.
What they were terrified of, is a company could run arbitrary software on it, and cut out MS from their fee, or even worse, making a machine that kicked ass, that was a full replacement for a desktop, that could act as a server. Game machines, are no longer toys, they are as powerful as servers. They do not want you to be able to use them as full machines, just toys - but games have to have a digital signature, this could be done with any machine, that would obliterate viruses - but they don't. Why do you think that is?
Machines are PURPOSELY built with backdoors, and phones, they are the worst. Nobody cares about desktops today, they care about your personal communication.
52
WookieMan
2021 Aug 7, 7:46am
WookieMan
2021 Aug 7, 7:46am
richwicks says
Fuck that device. Fuck it hard. Apple can take all my shit for all I care, new devices are set up in minutes not hours. I don't game but my kids do, it's the worst platform I've ever encountered. So convoluted and retarded to be honest. I'm no techie, but I've build mediocre websites that worked well for real estate. Xbox (currently) is not intuitive and is a shit show. Maybe it was better when you worked on it, as again I don't play video games.
We've spent hours doing something to get the kids a game or whatever. The feedback is the exact same from other parents. My one buddy just rebuilt the JP Morgan investment site for trading. Even he said Xbox is a shit show. I've seen the dude work, his keyboard is on fire.
I worked on the XBox project.
Fuck that device. Fuck it hard. Apple can take all my shit for all I care, new devices are set up in minutes not hours. I don't game but my kids do, it's the worst platform I've ever encountered. So convoluted and retarded to be honest. I'm no techie, but I've build mediocre websites that worked well for real estate. Xbox (currently) is not intuitive and is a shit show. Maybe it was better when you worked on it, as again I don't play video games.
We've spent hours doing something to get the kids a game or whatever. The feedback is the exact same from other parents. My one buddy just rebuilt the JP Morgan investment site for trading. Even he said Xbox is a shit show. I've seen the dude work, his keyboard is on fire.
53
Patrick
2021 Aug 12, 10:54pm
Patrick
2021 Aug 12, 10:54pm
https://puri.sm/posts/internet-of-snitches/
Imagine an Internet of Snitches, each scanning whatever data they have access to for evidence of crime. Beyond the OS itself, individual phone apps could start looking for contraband. Personal computers would follow their lead. Home network file servers could pore through photos, videos and file backups for CSAM and maybe even evidence of copyright infringement. Home routers could scan any unencrypted network traffic. Your voice assistant could use machine learning to decide when yelling in a household crosses the line into abuse. Your printer could analyze the documents and photos you send it.
54
SumatraBosch
2021 Aug 13, 12:54am
SumatraBosch
2021 Aug 13, 12:54am
I want a phone that kicks larry and serge in the nuts and take a massive shit on their faces every time I make a call and hundreds of times a second when I don't/
56
Eric Holder
2021 Aug 20, 2:48pm
Eric Holder
2021 Aug 20, 2:48pm
Patrick says
Already does to some extent.
Your printer could analyze the documents and photos you send it.
Already does to some extent.
57
richwicks
2021 Aug 20, 5:15pm
richwicks
2021 Aug 20, 5:15pm
WookieMan says
I am unoffended. I'm a contractor. Some people would call me a mercenary for hire, but I know what I really am. I'm a prostitute. I'm a whore.
If your kids like video games, look into the retroarcade. Maybe your kids need the "latest and greatest", but if they just want to play video games, I have a library of over 10,000 of them, not to play (my life isn't that long), but to preserve.
For < $100, you can have a raspberry pi, running retroarcade with more video games on it, than any one person can play in a lifetime. Also, it burns less than 10 watts.
https://retropie.org.uk/
The last time I tried to play a modern arcade game was 10 years ago. When I was a kid, a video game was a 10 minute distraction, that at worst could be a 2 hour struggle to win. Today, video games are just ordeals, that take WEEKS to get through. Want a blast from the past?
http://impossible-mission.krissz.hu/
That's one of the toughest video games I conquered as a kid. I can still beat it, and I recently have, but there's no enjoyment in it.
richwicks saysI worked on the XBox project.
Fuck that device. Fuck it hard. Apple can take all my shit for all I care, new devices are set up in minutes not hours. I don't game but my kids do, it's the worst platform I've ever encountered. So convoluted and retarded to be honest. I'm no techie, but I've build mediocre websites that worked well for real estate. Xbox (currently) is not intuitive and is a shit show. Maybe it was better when you worked on it, as again I don't play video games.
I am unoffended. I'm a contractor. Some people would call me a mercenary for hire, but I know what I really am. I'm a prostitute. I'm a whore.
If your kids like video games, look into the retroarcade. Maybe your kids need the "latest and greatest", but if they just want to play video games, I have a library of over 10,000 of them, not to play (my life isn't that long), but to preserve.
For < $100, you can have a raspberry pi, running retroarcade with more video games on it, than any one person can play in a lifetime. Also, it burns less than 10 watts.
https://retropie.org.uk/
The last time I tried to play a modern arcade game was 10 years ago. When I was a kid, a video game was a 10 minute distraction, that at worst could be a 2 hour struggle to win. Today, video games are just ordeals, that take WEEKS to get through. Want a blast from the past?
http://impossible-mission.krissz.hu/
That's one of the toughest video games I conquered as a kid. I can still beat it, and I recently have, but there's no enjoyment in it.
59
Patrick
2021 Aug 20, 5:39pm
Patrick
2021 Aug 20, 5:39pm
richwicks says
That's interesting.
One fun thing about tech is that your work is often used by millions of people.
I worked on a phone (the Nextel phone) that was used by millions. And many well-known websites. Not that I did a huge part of any of them.
I worked on the XBox project.
That's interesting.
One fun thing about tech is that your work is often used by millions of people.
I worked on a phone (the Nextel phone) that was used by millions. And many well-known websites. Not that I did a huge part of any of them.
60
richwicks
2021 Aug 20, 6:27pm
richwicks
2021 Aug 20, 6:27pm
Patrick says
It's a feather in your cap to work on something that nearly everybody knows about.
I just did DV - Design Verification. I wrote tests to confirm the hardware worked properly, in simulation and emulation - the emulator is the size of 2 refrigerators, that ran at 100 Khz that could accept PORTIONS of the design and arrangements needed to be made to power it, and ventilation had to be constructed to keep the lab cool. That machine was as expensive as a 20 room mansion is.
I honestly find technology boring today. Why get an XBox or PS5 or whatever? The only advancement in these systems is better graphics, but shit - they're good enough now. The difference in graphics from XBox1 and the 360 - it's minimal. Sure, it's better, but not the difference between a PS1 and a PS2.
richwicks saysI worked on the XBox project.
That's interesting.
One fun thing about tech is that your work is often used by millions of people.
I worked on a phone (the Nextel phone) that was used by millions. And many well-known websites. Not that I did a huge part of any of them.
It's a feather in your cap to work on something that nearly everybody knows about.
I just did DV - Design Verification. I wrote tests to confirm the hardware worked properly, in simulation and emulation - the emulator is the size of 2 refrigerators, that ran at 100 Khz that could accept PORTIONS of the design and arrangements needed to be made to power it, and ventilation had to be constructed to keep the lab cool. That machine was as expensive as a 20 room mansion is.
I honestly find technology boring today. Why get an XBox or PS5 or whatever? The only advancement in these systems is better graphics, but shit - they're good enough now. The difference in graphics from XBox1 and the 360 - it's minimal. Sure, it's better, but not the difference between a PS1 and a PS2.
61
Patrick
2021 Aug 20, 6:56pm
Patrick
2021 Aug 20, 6:56pm
I wrote the AT command set parser on the Nextel phone. Not that anyone uses a modem with a phone anymore.
I also rewrote the credit card form on Craigslist which all their revenue goes through.
I also rewrote the credit card form on Craigslist which all their revenue goes through.
62
richwicks
2021 Aug 21, 12:23am
richwicks
2021 Aug 21, 12:23am
Patrick says
This is why I hated DV. It needs to be done, but none of my work is used by the public.
If you ever use a DC fast charger from ChargePoint - I wrote the communication stack for that. I'm probably North America's expert on that communication protocol, and it's a TERRIBLE protocol. So terrible that I quit in disgust that there was no pushback on it. My superiors simply didn't understand there was an intent to make a monopoly on several fronts. The whole "green energy revolution" is rife with corruption, and I know corruption having volunteered for a few charities, which are mostly just ways to take donations for a problem, when there is no intention of fixing the problem.
Electric cars, in my opinion, are a total scam - but my code is everywhere now. Have to find something more worthwhile to do with my limited time on earth than to work for the mafia.
I wrote the AT command set parser on the Nextel phone. Not that anyone uses a modem with a phone anymore.
I also rewrote the credit card form on Craigslist which all their revenue goes through.
This is why I hated DV. It needs to be done, but none of my work is used by the public.
If you ever use a DC fast charger from ChargePoint - I wrote the communication stack for that. I'm probably North America's expert on that communication protocol, and it's a TERRIBLE protocol. So terrible that I quit in disgust that there was no pushback on it. My superiors simply didn't understand there was an intent to make a monopoly on several fronts. The whole "green energy revolution" is rife with corruption, and I know corruption having volunteered for a few charities, which are mostly just ways to take donations for a problem, when there is no intention of fixing the problem.
Electric cars, in my opinion, are a total scam - but my code is everywhere now. Have to find something more worthwhile to do with my limited time on earth than to work for the mafia.
64
Patrick
2021 Nov 11, 9:24pm
Patrick
2021 Nov 11, 9:24pm
https://reclaimthenet.org/data-broker-handed-over-smartphone-gps-data-to-dc-government-for-covid-research/
The EFF, a digital rights group, says it has seen public records (obtained here) that show location data broker Veraset and the District of Columbia (DC) government had struck a deal early in the Covid pandemic last year, allowing the latter full access to highly sensitive, individually identifiable GPS data, harvested from people’s mobile devices in the DC area.
Veraset made the offer and DC authorities accepted it, which was followed by half a year of updates coming from the company – that operates a proprietary database for this data, meaning that Veraset’s tools cannot be audited or scrutinized by the public – tracking hundreds of thousands of people going about their day.
65
AmericanKulak
2021 Nov 11, 9:32pm
AmericanKulak
2021 Nov 11, 9:32pm
At 3AM in the morning, I often wonder if going after Craigslist and others for "Pushing Prostitution" was an excuse to clear the path for for-profit companies, like Facebook Marketplace (which I refuse to use) and even Zillow.
66
Patrick
2021 Nov 13, 11:21pm
Patrick
2021 Nov 13, 11:21pm
I used to work at Craigslist and I believe that was indeed the case.
It was purely an anti-competitive move by bigger companies like Facebook.
It was purely an anti-competitive move by bigger companies like Facebook.
67
Patrick
2021 Dec 1, 1:40pm
Patrick
2021 Dec 1, 1:40pm
https://reclaimthenet.org/israel-is-using-counter-terrorism-phone-surveillance-to-track-omicron-carriers/
November 30, 2021
Israel is using counter-terrorism phone surveillance to track Omicron carriers
The implementation could be illegal.
69
fdhfoiehfeoi
2021 Dec 13, 10:48pm
fdhfoiehfeoi
2021 Dec 13, 10:48pm
I'm fucking sick of smartphones. My work seems to have endless reasons why they want me to use my personal phone. So far I've told them I don't have a data plan, but there's wifi, so sure that won't hold up forever. As soon as I have time, going to look into prepaid shit phones that don't have app capability. The internet and cellphones have become so locked down it's ridiculous.
70
seesaw
2021 Dec 14, 5:25am
seesaw
2021 Dec 14, 5:25am
Time to De-Google.. See Rob Braxman on Youtube.
https://www.youtube.com/watch?v=HVL1Xr7IEsY&source=patrick.net
Best Privacy phone. Rob seems very intelligent
https://www.youtube.com/watch?v=HVL1Xr7IEsY&source=patrick.net
Best Privacy phone. Rob seems very intelligent
71
Bd6r
2021 Dec 14, 12:35pm
Bd6r
2021 Dec 14, 12:35pm
NuttBoxer says
L8star Small Mini flip Cell Phone Magic Voice Changer Bluetooth Dialer Cellphone BM60 ca. 35 $
your employer's brain would freeze - they would have no idea what to do with this!
As soon as I have time, going to look into prepaid shit phones that don't have app capability.
L8star Small Mini flip Cell Phone Magic Voice Changer Bluetooth Dialer Cellphone BM60 ca. 35 $
your employer's brain would freeze - they would have no idea what to do with this!
72
Eric Holder
2021 Dec 14, 12:50pm
Eric Holder
2021 Dec 14, 12:50pm
NuttBoxer says
Motorola F3: no GPS, no contacts, no nothing. =))
I'm fucking sick of smartphones. My work seems to have endless reasons why they want me to use my personal phone. So far I've told them I don't have a data plan, but there's wifi, so sure that won't hold up forever. As soon as I have time, going to look into prepaid shit phones that don't have app capability. The internet and cellphones have become so locked down it's ridiculous.
Motorola F3: no GPS, no contacts, no nothing. =))
73
fdhfoiehfeoi
2021 Dec 14, 1:04pm
fdhfoiehfeoi
2021 Dec 14, 1:04pm
Finding a non-smartphone that is supported by carriers is tricky. Was looking at nokia 3310, but not sure there's any carriers who support it, and will allow me to remain anonymous.
74
Eric Holder
2021 Dec 14, 1:44pm
Eric Holder
2021 Dec 14, 1:44pm
NuttBoxer says
If a phone is capable of using US GSM frequencies it will be supported by the carriers.
Finding a non-smartphone that is supported by carriers is tricky. Was looking at nokia 3310, but not sure there's any carriers who support it, and will allow me to remain anonymous.
If a phone is capable of using US GSM frequencies it will be supported by the carriers.
75
joshuatrio
2022 Jan 3, 6:31am
joshuatrio
2022 Jan 3, 6:31am
Anyone found a good privacy friendly phone yet?
My moto g5 plus is flaking out and I don't want another phone that constantly spies on me.
My moto g5 plus is flaking out and I don't want another phone that constantly spies on me.
77
GNL
2022 Jan 3, 8:41am
GNL
2022 Jan 3, 8:41am
Is there any truth to a new Tesla phone coming out? It is supposed to be 100% private.
78
RWSGFY
2022 Jan 3, 10:36am
RWSGFY
2022 Jan 3, 10:36am
joshuatrio says
Motorola F3.
Anyone found a good privacy friendly phone yet?
My moto g5 plus is flaking out and I don't want another phone that constantly spies on me.
Motorola F3.
79
Hircus
2022 Jan 3, 3:56pm
Hircus
2022 Jan 3, 3:56pm
NuttBoxer says
I started accumulating cheap smartphones and tablets for this reason (can often buy them for $30-50). Sometimes its tough to avoid installing an app to use some handy device, but I refuse to allow some chinese app to invade my phone. So I just keep a dummy device that uses a throwaway email address and no contacts / personal info etc... and install the apps on that, keeping my real phone clean. I don't even bother with a sim, just wifi.
2FA is becoming popular, especially for those who work in tech companies, and they seem to want their employees to use their personal phones to either install the 2FA app, or to receive text messages. A 2nd dummy device can work well for this use case too.
I'm fucking sick of smartphones. My work seems to have endless reasons why they want me to use my personal phone. So far I've told them I don't have a data plan, but there's wifi, so sure that won't hold up forever. As soon as I have time, going to look into prepaid shit phones that don't have app capability. The internet and cellphones have become so locked down it's ridiculous.
I started accumulating cheap smartphones and tablets for this reason (can often buy them for $30-50). Sometimes its tough to avoid installing an app to use some handy device, but I refuse to allow some chinese app to invade my phone. So I just keep a dummy device that uses a throwaway email address and no contacts / personal info etc... and install the apps on that, keeping my real phone clean. I don't even bother with a sim, just wifi.
2FA is becoming popular, especially for those who work in tech companies, and they seem to want their employees to use their personal phones to either install the 2FA app, or to receive text messages. A 2nd dummy device can work well for this use case too.
80
Patrick
2022 Jan 4, 12:31am
Patrick
2022 Jan 4, 12:31am
Hircus says
I like this idea.
Hircus says
At one previous company, I just ran a phone emulator on my laptop to run the 2FA app.
I started accumulating cheap smartphones and tablets for this reason
I like this idea.
Hircus says
2FA is becoming popular, especially for those who work in tech companies, and they seem to want their employees to use their personal phones to either install the 2FA app, or to receive text messages. A 2nd dummy device can work well for this use case too.
At one previous company, I just ran a phone emulator on my laptop to run the 2FA app.
81
fdhfoiehfeoi
2022 Jan 4, 9:42am
fdhfoiehfeoi
2022 Jan 4, 9:42am
clambo says
Ubuntu is less privacy focused than they used to be. Started when they introduced their new app store, wanna say it's called Unity back in lts16 I believe.
I was looking at Ubuntu touch which can run on my Pixel.
Ubuntu is less privacy focused than they used to be. Started when they introduced their new app store, wanna say it's called Unity back in lts16 I believe.
82
fdhfoiehfeoi
2022 Jan 4, 9:44am
fdhfoiehfeoi
2022 Jan 4, 9:44am
Hircus says
For this I signed up for 1Password using an email not associated to me. Works well, and if my employer removes that option, will insist they send me a fob.
2FA is becoming popular, especially for those who work in tech companies, and they seem to want their employees to use their personal phones to either install the 2FA app, or to receive text messages. A 2nd dummy device can work well for this use case too.
For this I signed up for 1Password using an email not associated to me. Works well, and if my employer removes that option, will insist they send me a fob.
83
fdhfoiehfeoi
2022 Jan 4, 9:45am
fdhfoiehfeoi
2022 Jan 4, 9:45am
WineHorror1 says
I would trust Tesla anything as much as Windows anything. Musk is a wolf in sheeps clothing, and possible the first AI human due to his neural net implants.
Is there any truth to a new Tesla phone coming out? It is supposed to be 100% private.
I would trust Tesla anything as much as Windows anything. Musk is a wolf in sheeps clothing, and possible the first AI human due to his neural net implants.
85
fdhfoiehfeoi
2022 Jan 4, 12:23pm
fdhfoiehfeoi
2022 Jan 4, 12:23pm
Simplest explanation, it's bullshit. A lazy man's excuse for not making a good password.
Longer explanation, it's a second authentication method meant to verify only you have access to that site/account/data. First method is your password, second can be a text, push notification, or randomly generated code sent to your fob or password manager.
But if you use a password manager to create unique passwords of 20+ characters for every account you have, that is WAY better security than any secondary authentication.
My opinion, and I think there's a strong case, is dual auth/2fa was created to track us. 99% of people who use 2FA do it from a personal cellphone.
2FA = Two Factor Authentication.
Longer explanation, it's a second authentication method meant to verify only you have access to that site/account/data. First method is your password, second can be a text, push notification, or randomly generated code sent to your fob or password manager.
But if you use a password manager to create unique passwords of 20+ characters for every account you have, that is WAY better security than any secondary authentication.
My opinion, and I think there's a strong case, is dual auth/2fa was created to track us. 99% of people who use 2FA do it from a personal cellphone.
2FA = Two Factor Authentication.
86
Hircus
2022 Jan 4, 7:08pm
Hircus
2022 Jan 4, 7:08pm
NuttBoxer says
I dont see how one could backup such an argument. 2FA clearly offers meaningful security benefits that you cannot get by just making your password stronger. Whatever strong password you use, will always be improved upon by adding 2FA to it.
A strong password ONLY defends against attackers who try to guess your password. It does nothing to prevent them from copying your password. 2FA adds strong protection against both. 2FA defends against a different category of attacks that using only a strong password cannot help with. It's a fact.
Here's an example: a strong password is easily copied and successfully reused by an attacker some minutes/hours/days in the future. If the account had 2FA enabled, the attacker could not succeed merely by copying attacks, because they cannot copy a 2FA token, because they're 1 time use and expire in a short period of time.
The typical setup where people use a laptop/desktop with a password manager program locally installed as their main computer / web browser benefits by using 2FA on a separate device. There's many cases where an attack / compromise may be made on the laptop, even if just temporarily, or partially, but the attackers ability to gain access to their online accounts is still not successful because they have not also compromised the separate 2FA device.
Even power users, like us software engineers, benefit from 2FA. There's so many attacks that a keen eye just cannot avoid, much less realize they have even occurred.
Using 2FA on a physically separate device is a significant security boost.
But if you use a password manager to create unique passwords of 20+ characters for every account you have, that is WAY better security than any secondary authentication.
I dont see how one could backup such an argument. 2FA clearly offers meaningful security benefits that you cannot get by just making your password stronger. Whatever strong password you use, will always be improved upon by adding 2FA to it.
A strong password ONLY defends against attackers who try to guess your password. It does nothing to prevent them from copying your password. 2FA adds strong protection against both. 2FA defends against a different category of attacks that using only a strong password cannot help with. It's a fact.
Here's an example: a strong password is easily copied and successfully reused by an attacker some minutes/hours/days in the future. If the account had 2FA enabled, the attacker could not succeed merely by copying attacks, because they cannot copy a 2FA token, because they're 1 time use and expire in a short period of time.
The typical setup where people use a laptop/desktop with a password manager program locally installed as their main computer / web browser benefits by using 2FA on a separate device. There's many cases where an attack / compromise may be made on the laptop, even if just temporarily, or partially, but the attackers ability to gain access to their online accounts is still not successful because they have not also compromised the separate 2FA device.
Even power users, like us software engineers, benefit from 2FA. There's so many attacks that a keen eye just cannot avoid, much less realize they have even occurred.
Using 2FA on a physically separate device is a significant security boost.
87
GNL
2022 Jan 4, 7:31pm
GNL
2022 Jan 4, 7:31pm
Ok, I understand what 2FA is now. I have a Stripe account for my business. Every time I log in, I get a text with a code which I then have to enter in order to complete the log in. How could a person defeat that? No one else has my phone.
« First « Previous Comments 48 - 87 of 305 Next » Last » Search these comments
Many others have attempted Open Source phones and failed. I hope this one works, especially since I just discovered that you cannot turn off wifi or Bluetooth on Android or iOS. "Turning it off" in the controls on those phones merely disconnects you from current access points, but leaves them on so they can spy on your location with great precision and open you up to various exploits:
https://www.theguardian.com/technology/2017/sep/21/ios-11-apple-toggling-wifi-bluetooth-control-centre-doesnt-turn-them-off