Mama told me not to come.

She said, that ain’t the way to have fun.

  • 2 Posts
  • 2.24K Comments
Joined 2 years ago
cake
Cake day: June 11th, 2023

help-circle















  • Nobody wants to put in protected bike lanes because everybody drives.

    If you build it, they will come. The Netherlands used to be very car dependent until the government put in a massive effort to build out bike infrastructure, and now it’s the bike capital of the world. Here are a few things they changed to make it happen:

    • eliminate routes through cities to push cars to go around on the highways instead of driving through the city center
    • design traffic calming into roads - raised intersections, narrow roads, bollards to force cars to not travel in a straight line around residential areas, etc
    • improve arterial mass transit, and build bike and pedestrian infrastructure to get to them

    Once the cars started moving outside the city center, cycling and transit became became much more practical, but it all started by making driving less convenient so other modes of transportation became more attractive.



  • Original comment:

    Here’s a fun fact: phone manufacturers know this. So what they call “100%” is not actually 100%.

    My response, which was a small clarification:

    That depends on the manufacturer, some do, some don’t. My phone has a setting to control the max charge, so I set it to 80% when I got it.

    And the follow up from a different user:

    Yes, but that 100% is not really that. It has been programmed to display that percentage, when i reality its 80%.

    And my response:

    No, I’m saying that not all manufacturers have that limit, and it’s a relatively new setting (last few years). If you have an older phone or something not from the top few manufacturers, it might not have that feature.

    Then our conversation started. That’s the context. Here’s your first comment:

    Exactly, which is neither a user setting or relatively new. Battery manufacturers have always had to decide what voltage is what state of charge (percent).

    The user setting where you limit it to 80% is on top of what the previous commenter was describing

    And then my response:

    Sure, if the manufacturer sets it to not charge to the max. I’m saying some manufactured charge to the max by default, hence why that setting is useful.

    My point is and has always been that this isn’t universal, so don’t just assume that your phone stops charging at 80% if battery longevity is important to you. Check if your phone does it so you can know.

    If anyone is trolling here, it’s you.



  • It is a security threat, and to claim it doesn’t count is absurd.

    Oh, absolutely.

    Replay attack is the wrong term, here’s the threat model I’m talking about. Basically, the attacker watches the authentication flow and uses the resulting session (token?) to make web requests as you, stealing whatever data it wants. There’s no attack on the authentication scheme, but on the shortcuts web services use.

    It doesn’t matter if you use passwords, TOTP, or webauthn, there’s going to be some vector to attack the system without breaking the authentication mechanism.

    The average user isn’t going to see much security benefit from webauthn vs TOTP in the same way that adding a better lock to your front door is unlikely to improve your overall home security, because at a certain point, the burglar will just smash a window. TOTP is good enough because it’s safe from attacks on email and SMS that worse one-time code systems use. You should definitely have a lock on your door, but at a certain point, the lock is no longer the weak point in the system.

    And yes, I’m using “code generation” as a generic catchall. I group auth systems like so:

    • offline threats - e.g. passwords that can be broken by seeing the hash
    • reliant on third party service that can be attacked separately - email and SMS
    • “code generation” - uses some cryptographic mechanism to generate some unfakable code that can’t be reused; seeing more examples doesn’t help, and codes can’t be reused

    If your password manager handles the second factor, the user experience of TOTP vs webauthn is nearly identical, and the security is nearly identical to your average attacker, to the point where they won’t attack the authentication mechanism itself, but something else on the website or the password manager itself.

    The problem is that most people do only use plain old passwords. If we can get any kind of extra security, even TOTP, then all the better.

    Exactly. The difference between TOTP and webauthn only really matters if you’re a government or something else where state-level actors are part of your threat model. If your service uses one or the other, the distinction isn’t important to the average user.