Natanael

joined 1 month ago
[–] Natanael@infosec.pub 1 points 20 hours ago (3 children)

There are endless positive but fundamentally dysfunctional ideologies. Anything which doesn't address how large populations behave is dysfunctional.

[–] Natanael@infosec.pub 1 points 1 day ago

It's also what Google Maps live view is using. Street view imagery plus rough location plus on-phone camera sensor calibration data allows it to compute highly accurate positions relative to surroundings.

[–] Natanael@infosec.pub 5 points 1 day ago (1 children)

Taxing liquid capital is fairly straightforward, especially if it's tied to income (like company founders owning shares).

Taxing non-liquid assets is complicated because it's hard to make it fair in cases of family home inheritance and similar situations.

But taxing use of assets as collateral for loans (to create liquidity from a non-liquid asset) should be reasonably fair, it can be treated as an advance on capital gains taxes on the collateralized asset.

[–] Natanael@infosec.pub 1 points 6 days ago

Passkeys can be synchronized, but aren't intended to be exported raw as they're meant to be used with a TPM / secure element chip or equivalent secure hardware to protect the key in use. Bitwarden can synchronize them.

Also, they intentionally create distinct keys per site, so you can't link multiple accounts using the same passkey / hardware security key.

[–] Natanael@infosec.pub 1 points 1 week ago (2 children)

That's literally no different from a regular password manager or having a 2FA TOTP code app set up for it

[–] Natanael@infosec.pub 3 points 1 week ago

It literally just takes a slightly different domain name. Lots of infosec pros have been phished when not paying attention

[–] Natanael@infosec.pub 1 points 1 week ago (4 children)

Passkeys use unique keys per site for that reason

[–] Natanael@infosec.pub 3 points 1 week ago (2 children)

TOTP codes can be phished, hardware security keys and passkey can't

[–] Natanael@infosec.pub 2 points 1 week ago

Google Chrome on PC can let you verify from the phone to unlock passkeys

[–] Natanael@infosec.pub 2 points 1 week ago

TOTP can be phished remotely, passkeys / hardware security keys can't (need to get malware into the users' computer instead)

[–] Natanael@infosec.pub 6 points 1 week ago

The synchronization part is the annoying part. And when you have multiple accounts on one site you can end up with multiple passkeys for it.

 

UK wanted global access to decrypt any and all Apple users' iCloud data on request. Apple pulled iCloud encryption from the ADP program instead within UK.

Seems like their idea is to ensure encrypted data outside of UK stays out of UK jurisdiction because the affected feature isn't available there anymore. But this will prevent UK residents from using iCloud end to end encryption in ADP and keeping for example backups of photos and iMessage logs protected, so for example journalists are a lot more exposed to secret warrants and potential insider threats.

view more: next ›