Hacker Newsnew | past | comments | ask | show | jobs | submit | ghosts_'s commentslogin

a BUNdler


what a stupid link to share


https://briarproject.org/download-briar-desktop/ hacker news doesn't allow you to share the other link


Dashlane's been using argon2 for quite awhile now, AFAIK one of the only ones doing so.


These probably won't replace password managers, just result in passkey managers... Dashlane already supports passkeys & 1password just announced intent to support soon.


How do they "manage" passkeys? There's nothing to manage except your fingerprint/face authentication.


They're essentially certificates, so most implementations will only store them on-device, and most implementations I've seen seem to favor the phone as the device you use.

It really depends on the platform - but in short you'll either need a phone, or be locked into an ecosystem (browser, OS, etc) making using them on multiple devices & browsers difficult or impossible. A password manager supporting passkeys makes this easy as you can 1-click generate a passkey, and 1-click sign-in to services from any device or browser.


Given that Apple and Google (at least) are collaborating on a shared standard, shouldn't lock-in to an ecosystem not be a thing?

And: does using a third-party passkey manager open up passkeys to the same security issues as password managers? Specifically, more than remaining within the Apple-or-Google-supplied system?


It's shared standard in the sense that all implementations will be the same, AFAIK passkeys you generate on iOS systems aren't easily used on windows ones, etc. Or they'd require scanning a QR code from a phone which IMO sucks when a password manager has it in the browser already.

Also what security issues with password managers? There's some potential concerns with extension-based over OS based systems, but if your device is compromised where someone can actually access memory then they'd both be equally void to some extent, AFAIK there's nothing seriously concerning security wise on a password manager vs keychain, etc.


You get some form of cross-platform sync. Apple, Google, and so on each have syncing, but in their ecosystem only. You can break out with the QR codes, but this might not be the preferred solution to some.


Given that Apple and Google (at least) are collaborating on a shared standard, shouldn't cross-platform sync be possible?


Dashlane, 1Password & Bitwarden are the most popular I believe.


I think this gives people a false sense of security, yes zero knowledge is extremely useful + cool, and certainly reduces the risk in event of a breach, but all it really means is that _all_ of your passwords are behind some encrypted blob in the open, that would be extremely difficult to decrypt. Not impossible. Certainly any average or even very high-end machine today would have a pretty much 0 percent chance at decrypting the data, it's still out there in the open forever. Imagine in 10 years we have some leaps in quantum computing or discover a flaw in the algorithms use, all a hacker would need to do is go back & decrypt the data to try some credential stuffing attack, etc.

TL;DR is short-term I wouldn't be freaking out of my password manager was hacked, but I would still definitely update all credentials at some point & treat it as an actual breach, and not an "oh no we were hacked but it's okay because zero-knowledge!".

Also how many times have they been hacked now? Who's still using last pass?


ISP's could easily stop Bitcoin, I don't really think anyone claims they can't? Bitcoin isn't mean to be an impossible to kill hydra of economic power, but a decentralized, peer-to-peer, trustworthy ledger of transactions.

ISP's could block the common ports Bitcoin uses (but that would likely break a lot of other applications), they could potentially blacklist certain IP's, but because of the decentralized nature of Bitcoin this would likely only affect discovery in a minimal manner. ISP's could also inspect packets to determine if the traffic is Bitcoin related, but potentially something like TOR could prevent that inspection, if enough ISP's inspect & block Bitcoin TOR would likely not be of help (as it simply protects the transit of data, not the entry/exit).

BGP is also a pretty serious vector for a bad actor ISP to utilize, check out the following article: https://www.theregister.co.uk/2017/04/11/evil_isps_could_dis...

Definitely a lot of ways BTC could be affected. Governments could also outright ban it and that would destroy the network as it would lose a huge amount of value as a serious asset.


Adding to this - ISPs likely would never try any of the above, simply because it would hurt their public perception, isn't worth the time, and is potentially illegal depending on the area.


in which countries?


I've used some easter eggs to enable developer features. Like the konami code would prevent session timeouts so we could test things over a longer period, etc. Haven't introduced any fun ones yet though (may do so now!)


To be fair the claim for the money was stipulated that you must have credit monitoring already in place. The point of the cash settlement was to offset the cost of whatever you had to pay for credit monitoring. They are asking for the service now to presumably reduce the cash payouts though.


It comes in handy with economic discussions, (barters, trades, etc.) as well as general debates / arguments with peers. There's many behavioral economic games and pro-social experiments in game theory that deal with improving social perception or increasing the odds of outcomes with framing / anchoring / priming.


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: