monko

@monko@lemmy.zip
0 Post – 45 Comments
Joined 1 years ago

vague woman/man/genderless person(?) who is or isn't deadly serious and/or trolling you at this very moment

What if we reduce the cost of living instead, lol jk gotta feed the landlords

I don't get it. Are you saying that lemmy.world has too many US users? Why would that matter?

26 more...

"Is this normal?"

No, it is not normal to state what percent-better-person you would leave your romantic partner for. It's cynical and narcissistic.

What if your partner is in an accident that changes how they look or live? Now that they're X% "less" than what you signed on for, you can just dip?

Like I get being upfront about stuff, but this is just transactional. It's not about your commitment to another person, it's about maximizing your return on investment.

3 more...

Glad this is being discussed. Having worked adjacent to the authentication market, I have mixed feelings about it, though.

There are a few problems with passkeys, but the biggest one is that no matter what, you will always need a fallback. Yes, Apple promises a cloud redundancy so you can still log in even if you lose every device.

But that's just Apple's ecosystem. Which, for what its worth, is still evolving. So the passkey itself is phishing-resistant, but humans still aren't. Fallbacks are always the weakest link, and the first target for bad actors. Email, or sometimes phone and SMS, are especially vulnerable.

Passkeys in their current iteration are "better" than passwords only in that they offload the fallback security to your email provider. Meanwhile, SIM swapping is relatively ready easy for a determined social engineer, and mobile carriers have minimal safeguards against it.

Usability? Great, better than knowledge-only authentication. Security? Not actually that much better as long as a parallel password, email, or SMS can be used as a recovery or fallback mechanism.

I'm not saying passkeys are bad, but I'm tired of the marketing overstating the security of the thing. Yes, it's much more user-friendly. No one can remember reasonably complex passwords for all 100 of their online accounts. But selling this to the average consumer as a dramatic security upgrade, especially when so many still run passwords in parallel or fall back to exploitable channels, is deceptive at best.

13 more...

No, I know this dude's deal, he is 100% for real (or trying to get a reaction, but that's not satire on its own). His posts are often like this.

4 more...

I also choose this guy's wife.

2 more...

Traffic impacts will be clearer in coming months. But in my view, the amount of noise is higher.

Looking at the popular posts and even my front page, the quality has subjectively gone down. Small subs are virtually the same, but that's not where Reddit wants to make their money.

5 more...

Yudkowsky is well-known for his work in AI. He occasionally makes jokes, but it's usually about AI (not relationships). I know that on his profile, it says something like "when I don't use punctuation, it's a joke," akin to Reddit's /s.

And yeah, he left off a period on the first post, though not the other two. But that said, he rarely makes multi-part jokes. It's pretty clear to me, having read his posts and articles for a while, that he means this.

To further clarify that this is a "rationalist" of the highest order, consider that he wrote a half-a-million-plus word fanfic of Harry Potter, but with Harry studying science instead of magic: https://en.wikipedia.org/wiki/Harry_Potter_and_the_Methods_of_Rationality

1 more...

Breath of the Wild is merely okay.

It's kind of tedious, the weapon durability system is annoying, and the visuals are held back by the Switch's weak specs.

Folding Ideas

Earth 2.0's soft launch was met with modest success, but some far-right critics claim the day 1 patch, which removed racism, bigotry, and hate based on identity, makes the game "unplayable."

1 more...

If they meet someone they want to date more than you, why would they keep you around? You're 75% less ideal. What are you bringing to the table, besides a lower average score for the polycule?

9 more...

No shame in that! It is actually pretty well-written, and it has some engaging points. I'm not "anti-rationalism" or anti-this-guy or anything like that. LessWrong did more for global altruism than I ever will.

I'm just pointing out that a person who has dedicated their entire public persona to an ideology (or lack of one) is probably not joking when they start evaluating romantic partners with supposedly objective percentages.

God he is so good at losing money rn

2 more...

"an endless scroll of buttholes"

art

Mozel tov, may your love enemy forever crawl on his belly

Better the devil you know than the Jesus you don't

I "barged in" to a thread on Lemmy, a public forum where all are supposedly welcome? Are you seriously trying to exclude me based on my identity or background?

2 more...

Do you think "supress" simply means "not up voting non-US content?" Okay, maybe I got that one wrong.

But you really don't get how hostile you guys come off toward US folks who are just existing?

I mean, your comment is the very embodiment 9f the anti-US sentiment I see from so many. What are people supposed to do to appease you?

4 more...

So, you're saying that US users on lemmy.world are keeping other nationalities from talking about issues or viewpoints relevant to them?

15 more...

Same. But I don't think the Russians or Chinese would give two shits what I think about them dominating an online space lol

Also pretty sure Iranians are struggling to get online rn let alone take over an instance

Not sure exactly what you're getting at, but any authentication model must be designed with the assumption that a user can lose all their devices, passkeys included. That's where fallbacks come into play. Even with Apple's system, you can recover your keychain through iCloud Keychain escrow, which (according to their help page) uses SMS:

To recover your keychain through iCloud Keychain escrow, authenticate with your Apple ID on a new device, then respond to an SMS sent to a trusted phone number.

While SIM swaps aren't super common, they're not the most difficult attack. Passkeys are strong against direct attacks, for sure. But if I can reset your account using a text message sent to a device I control, is it really that much more secure?

3 more...

Maybe, idk, let Taiwan decide what is best for Taiwan?

The article is about service providers, like payment processors, offering alternatives to far-right interests when incumbent providers refuse their business.

For a cryptocurrency to be useful, it would need to be accepted by the service provider. And I doubt you could pay for your anti-vax rally at the airport Radisson with crypto.

5 more...

I wasn't really sure what you were talking about, so I looked them both up, and I think there's a really good chance your optician gave you Nazi-tinted lenses by mistake.

3 more...

I get what you're saying, but it's not about getting locked out. It's about other people using recovery methods to take over your account. Why would anyone try to break through durable public-key encryption when you can just phish a victim's email account password?

And it's not like real-time phishing for 2FA/MFA isn't widespread—it's just not automated to the same level as other methods. That said, two- or multi-factor is going to stop 99% of automated hacks. It's the determined ones that I'm concerned about.

In regards to the Apple thing... Apple passwords can be reset using a recovery email. That means the security of the account leaves Apple's ecosystem and relies on the email provider. So, if I'm a cybercriminal determined to hack your account, I start there.

Then, if you've got your keychain all set up, it's time for a SIM swap. I clone your SIM or convince your mobile carrier to give me a SIM with your number. And even if recovery contacts and keys are alternatives, the use of SMS is problematic. If you really can turn it off, then I'm all for it. But if you can't be sure, neither can I.

SMS is a very low-security option that is showing its age. It was never intended to be a secure verification method, yet it's become incredibly popular due to its availability. Unfortuantely, telecom companies are simply not interested in upping their security.

All SIM swap protection is opt-in at this point. Verizon and the gang might wise up considering the lawsuits leveled at them by victims—many of whom lost millions in cryptocurrency due to the carriers' negligence—but it's not likely.

The point here isn't that passkeys are bad for consumers. They're convenient and about as secure as existing methods. The problem is that they're being sold on average folks as a security upgrade even though they're more of a sidegrade. PKI/FIDO already existed before the whole passkeys buzz did, and it had the same limitations. This is mostly just branding and implementation.

1 more...

Speaking from personal experience, prepaid cards rarely work for these types of transactions. If you think service providers don't know the difference, you're kidding yourself. There are good reasons to demand a real card.

1 more...

Sorry, I didn't mean to poke at your anxieties! I was remarking on the arbitrary nature of the original post.

While you're probably right that Eliezer is open to dating poly people, the post in question definitely appears to take a monogamous stance—that is, the question of whether to exchange one person for another of "higher value."

Saying that you're cool if

one my partners meets someone else they want to date at least as much as me, they do

is different from

I'd trade up if I found somebody 10%/25%/125% better than you

which is what the original post said.

5 more...

Saying there's no real-world use for thought experiments or theory is like saying tricycles are useless because they're slower than jogging.

I would love to see some examples of these minority topics being down voted or suppressed since it seems to be deeply affecting international users' experience.

To me, it seems like you and the OP resent US users for simply existing in an online space without putting forth any solutions to the issue. Are you sure you're not trying to find ways to justify anti-US bias?

If you want the space to have more equal representation, why not produce high-quality content that appeals to your fellows rather than moaning about people who by your own admission mean no harm?

10 more...

Totally! Browser and device fingerprinting are commonly used as first-line defenses against ATOs (account takeovers). There are other kinds of fingerprinting, like those that can learn about your installed hardware and drivers. Really, I'm learning about more fingerprinting methods all the time. That said, decisions are usually made based on several different information sources. These include variables like:

  • GPS geolocation
  • IP address/location
  • Time of day
  • Device ID, OS version, browser version, etc.
  • Hardware profiles, including CPU and GPU architecture/drivers
  • User behavior like mouse movement, typing patterns, and scrolling
  • Whether the user is connecting via a known VPN IP address
  • Cookies and extensions installed on the browser

There's even some buzz around "behavioral biometrics" to identify individuals by how they type, but this is still not the sole method of identification. It's mainly about flagging bots who don't type like humans. However, learning how an individual types can help you determine if a subsequent visitor is the actual account owner or a bad actor.

In my experience, fingerprinting and adjacent identity proofs are rarely used in isolation. They're often employed for step-up authentication. That means if something doesn't match up, you get hit with a 2FA/MFA prompt.

Step-up can be pretty complex if you want it to be, though, with tons of cogs and gears in the background making real-time adjustments. Like you might not even realize you've been restricted during a session when you log in to your bank account, but once you try to make a transfer, you'll get an MFA prompt. That's the UX people in action, trying to minimize friction while maintaining security.

Perspective: shoebox.

Values: likely shoebox-based, or perhaps worshipping the ever-present AC

Science: science as a set of principles and methods for understanding the physical world wouldn't be affected by a man or men in a shoebox.

😉

No, unfortunately that is simply untrue.

The payment processor in the article, Stripe, does indeed work with crypto businesses and allows users to keep a crypto balance, but you would need to convert to regular tender to book a room at a Radisson (at least according to their website).

Sadly for the hodlers, while you might be able to buy your coke and hookers with Dogecoin, the hotel will want a credit card on file.

3 more...

If you want to go full bore, nothing beats 100% DEET. It is like gasoline, but I have yet to find a more effective personal repellent.

1 more...

Depends on the provider in question. While Apple does allow SMS recovery, they also let you designate a trusted contact who can let you in as an alternative. This is obviously more convenient (if you have a friend or family member who can be available when you need them), but the situation with SMS vulnerabilities is still my main gripe.

Born to Die by MDC

In Español, my name is El Tigre Chino!

Ok buddy.

Gotcha, point taken. Ultimately, I think there needs to be a better identity proofing process overall. But that may rely on a total infrastructure overhaul, which seems unlikely.