• 0 Posts
  • 23 Comments
Joined 2 years ago
cake
Cake day: July 25th, 2023

help-circle





  • I don’t like that passkeys are portable, this kind of defeats the entire purpose. The way they were sold to me is the following: it’s 2 factors in one. The first is the actual device where the key lives, and the second, the user verification, like a pin, face scan, fingerprint etc. If it’s synced across the cloud, there’s no longer the first factor being the unique key on the unique device.

    Granted, passkeys even without the first factor are still magnitudes better in terms of convenience and security compared to passwords, but it just disappoints me a little that there are no good options to save passkeys on my local device only, with no cloud sync.

    If anyone knows of a local-only passkey manager app for android, as well as the same as a firefox extension, I’d love to know about it!



  • Telegram isn’t in trouble because they are a ““private”” messenger because 1) they aren’t and 2) they basically asked for it. They are hosting pirates, drug dealers and scammers and they refuse government requests for the data they have about the user. That is the issue: not complying with data requests. For example, signal, a truly secure messenger, will comply with data requests and will send the authorities everything they have about a user, which is really not that much to begin with. This whole Telegram story is absolutely unrelated to chat control



  • I simply think that until now (maybe they will start tomorrow), the PR and lawsuit risk of listening to people is too high, for the benefit they would get out of it. Much simpler metrics are enough for them to get a very good profile of the user. Voice data isn’t like in the test scenarios where the person will repeat 45x the word cat food, people talk about the weather and about gas prices which is pretty useless for creating an ad profile if you ask me. But the scary part is now with AI models and on device AI everything, local processing of the mic data into topics that then get sent to their servers is more concerning is not much more feasible.

    And for the lawsuits I am not sure they could write it off as a bug everywhere other than the us and Canada because there are actually normal laws in most other countries





  • Proton Pass or Bitwarden are both very good options. Here is my breakdown of their pros and cons:

    Pros of Proton Pass over bitwarden

    • Much better UI/UX (in terms of looks and ease to navigate)
    • The app is feels much faster than Bitwarden’s, maybe its not objectively, but it feels lightyears ahead in terms of speed
    • Possibility for separate email and username fields
    • more seamless integration with simplelogin aliases than what Bitwarden has
    • TOTP is available in the free version

    Cons of proton pass compared with bitwarden:

    • No “Identity” item type (vault item where you can store info about yourself like your SSN etc.)
    • No payment card autofill
    • Can only register the “generic” 6-digit type of TOTP (Steam guard TOTP didn’t work when I tried it)
    • No custom fields that auto-fill on the web page
    • less settings in general, for example, you can’t decide of the hashing algorithm of your account’s password, and you can’t tweak the hashing parameters
    • more expensive
    • less “Foss”: the server code is not published and there are no 3rd party servers like vaultwarden