Earlier quoted context omitted.
There was a recent discussion on HN that branches into this idea about the importance of UX. I agree with you, with a twist. What you want is that the happy path for security is zero hassle, but the unhappy paths should also drop dead with zero hassle. This is the UX I really like for WebAuthn / U2F. All the interactions on the happy path are very smooth. Need a second factor, tap, go. Almost frictionless. On my phon…
Another unhappy path is very difficult. Your phone got stolen or smashed. Your 2FA is just not available. Welcome to the sea of hassle proving your identity. But a little bit of hassle beforehand, in the form of printing one-time codes and storing them even in your wallet would help dramatically.
Let them paste passwords (2017)
111–120 of 129 posts
Re: Let them paste passwords (2017)
#112Making password entry difficult is like attempting weight loss by eating bland food. It's not the flavour that makes you fat. Nonetheless, there's this perception that something delicious can't be good for a diet. People have this notion that to lose weight, there must be penance . An element of punishing oneself for past transgressions seems essential . Security people have the same mindset. Security must be a hassl…
> Making password entry difficult is like attempting weight loss by eating bland food. It's not the flavour that makes you fat. Big side-tangent, but amusingly enough, one modern view on the etiology of metabolic syndrome is that your brain tracks satiety for different nutrient classes separately; so foods that are "tasty" in the sense of containing many different nutrient-signals (sugar, salt, fat, acid, etc.) take…
Re: Let them paste passwords (2017)
#113Making password entry difficult is like attempting weight loss by eating bland food. It's not the flavour that makes you fat. Nonetheless, there's this perception that something delicious can't be good for a diet. People have this notion that to lose weight, there must be penance . An element of punishing oneself for past transgressions seems essential . Security people have the same mindset. Security must be a hassl…
> Making password entry difficult is like attempting weight loss by eating bland food. It's not the flavour that makes you fat. Big side-tangent, but amusingly enough, one modern view on the etiology of metabolic syndrome is that your brain tracks satiety for different nutrient classes separately; so foods that are "tasty" in the sense of containing many different nutrient-signals (sugar, salt, fat, acid, etc.) take…
I’ve dieted now a few times quite successfully while living with a chef roommate.
He cooks amazing meals. Salads with more ingredients than I’d ever bother to use, stuff like that. As a chef he really puts time into hitting many flavors (not always, but often).
I’ve never had an easier time losing weight than this last time! Down to my healthiest in years, and been super happy with how easy it’s felt.
Here’s a theory: I’m getting a lot of happiness from eating delicious food. If I eat bland things, sure over time I may adapt to it. But to be honest, getting joy out of eating is one of just two things that is an inexhaustible source of delight for humans. Trying to diet and deprive yourself of flavor is like fighting two dragons at once.
The dopamine/serotonin balance I get from a well crafted, layered meal is actually what keeps me satisfied and feeling like “I had my pleasure, I owe it to myself to accept that as enough”. A fun diet is easier to follow.
Edit: just to add. I also get a ton of happiness from cooking new and interesting things. To me, the craft of cooking also helps mentally. I get satisfaction from trying new things, being creative, pleasing my SO, etc - humans need some amount of creativity and play. By fulfilling that through cooking, you avoid seeking it in eating. I’ve noticed clearly when we make a nice meal I’m so happy at just having done something well, my dopamine is low once it’s time to eat.
Re: Let them paste passwords (2017)
#114Earlier quoted context omitted.
> Making password entry difficult is like attempting weight loss by eating bland food. It's not the flavour that makes you fat. Big side-tangent, but amusingly enough, one modern view on the etiology of metabolic syndrome is that your brain tracks satiety for different nutrient classes separately; so foods that are "tasty" in the sense of containing many different nutrient-signals (sugar, salt, fat, acid, etc.) take…
Bread (a refined food) will make you sick and fat before it makes you full. Maybe a very whole wheat would work OK in this system. Fruits are also a highly refined food (genetically engineering/ artificially selected for extremely high sugar.)
Re: Let them paste passwords (2017)
#115Earlier quoted context omitted.
That means the password is held in plain text or reversable encryption. They should only have a salted hash of your password. Using a shared secret in addition to a salted password is probably acceptable, although how much extra security it gives is debatable.
Possibly or they could store N salted hashes, one for one of the N permutations of a mask over the password character positions. This basically splits the end user password into N passwords with smaller entropy but this can be mitigated by requiring high entropy for the original password.
(if they ask for 2 characters, assuming a-zA-Z0-9 you're talking maybe 4k permetations, and then you know 2 characters)
A 10 character 64 symbol phrase would take 64^10, or 1e18 guesses
5 lots of 2 characters 64 symbols would take 5*64^2, or 20k guesses
Re: Let them paste passwords (2017)
#116Being a Firefox user, I have set dom.event.contextmenu.enabled and dom.event.clipboardevents.enabled set to false, so that I can continue right-clicking and pasting.
Paste as Keyed Characters types in the contents of the clipboard for you [0].
Paste AlphaNumeric Only will only paste in letters and numbers from the clipboard [1]. Very useful when pasting contact phone numbers into forms that only allow numbers.
Re: Let them paste passwords (2017)
#117On this point: > write passwords down in places that are easy to find (like post-it notes next to the screen) Writing passwords on post-it notes is often used as a ridicule of non-tech-savvy folks behavior. I'd like to pose this question: If you're doing this not at an office, but at home, is this really so bad? Say you run a web site on AWS and write your really long AWS password on a piece of paper at home. It woul…
One solution is to use an easy to remember prefix with your passwords and only write down the secure part. Password is mayfly-DyHpE82sd3r3rvr!2sDQ Part you write down is DyHpE82sd3r3rvr!2sDQ
Re: Let them paste passwords (2017)
#118Earlier quoted context omitted.
> Making password entry difficult is like attempting weight loss by eating bland food. It's not the flavour that makes you fat. Big side-tangent, but amusingly enough, one modern view on the etiology of metabolic syndrome is that your brain tracks satiety for different nutrient classes separately; so foods that are "tasty" in the sense of containing many different nutrient-signals (sugar, salt, fat, acid, etc.) take…
This all sounds very interesting, but doesn’t at all match my lived experience. I’ve dieted now a few times quite successfully while living with a chef roommate. He cooks amazing meals. Salads with more ingredients than I’d ever bother to use, stuff like that. As a chef he really puts time into hitting many flavors (not always, but often). I’ve never had an easier time losing weight than this last time! Down to my he…
I think you're arguing with the GP comment, not my comment. The kind of "diet" being described in my comment above—if you even want to think of it as a diet—doesn't actually stop you from eating anything, if you count by "flavor experiences" rather than "meal experiences." It just makes you get your "flavor experiences" separately, rather than all at the same time. (Or "as separately as you can." A food with N-1 macronutrients is still going to fill you up faster than a food with N macronutrients; so just minimizing macronutrient variety per meal is fine. You don't have to strictly limit yourself to some small number. Eating a salad with dressing as your meal, is still better than eating a salad with dressing and meat in it.)
Most foods invented throughout history actually already fit this "diet." Vegetable soups, however many ingredients, still have only two or three major macronutrients. Roasted poultry only has one. Mashed potatoes only have two. A steak has one. Fruit pies have three. Nigiri sushi has three. Most authentic italian pastas have three. Even "bad for you" foods like hot dogs or mac-and-cheese only have three, if you make them from scratch.
There are two types of recipes that have high macronutrient variety: those invented throughout history to be served to nobility/royalty, that were "fancy for the sake of being fancy"; and those invented in the modern era of year-round grocery-store ingredient availability (and thus no need to work with what's in-season, freshly-harvested, before it rots.)
Sandwiches, hamburgers, American pizza, "tex-mex" tacos/burritos, and other food-court staples: nine or more macronutrients each. The kind of cheese powder found in doritos or shelf-stable mac&cheese counts for eight by itself! The average take-out order of "American Chinese food" hits almost a dozen. Most French sauces reach seven macronutrients on their own, before counting what you're putting them on. A full English breakfast has twenty macronutrients.
Some of these are capitalism at work, creating ever-greater superstimuli out of originally-simpler meals (e.g. pinche tacos; authentic regional Chinese cuisine; etc.) You can just buck that trend, and be healthier for it.
But for some of the others, the macronutrient-variety is fundamental to what the food "is." In those cases, keep in mind that most of the food experiences these foods give you, are made up of—"synthesized" from—simpler standalone food experiences, that just happen to be happening at the same time in your mouth, without really being one unified food experience. You can have the experience of eating just the "melty cheese" part of a pizza—that's raclette. You can have the experience of eating just the meat part of a hamburger—that's a hamburger steak. A loaded twice-baked potato breaks down into two separate meals: baked potatoes + sour cream, and a pasta-salad-like dish. Etc.
None of these are "less tasty" when taken separately. They're just different ways of having the same experiences. If you like, you can eat garlic bread for one meal, a Greek salad for the next, and charcuterie for a third—and you'll have "eaten a pizza" of whatever toppings you like. (Personally, I'd rather just eat a simple caprese pizza, which has ~5 macronutrients; but if you prefer the complex flavors, go ahead and have them. Just—separately.) Likewise, if you're getting American Chinese take-out, you can just eat one of the dishes you ordered per meal, rather than trying to have a little bit of all of them each meal. (Some of those dishes are, individually, pretty macronutrient-rich, but if you want those flavors, this is how to get them.)
Of course, you can have complex foods if you do it as an indulgence, the way people think of ice cream (which is actually not an indulgence under this paradigm; you'd get full on a meal of pure ice-cream quite quickly, if you were just eating from hunger, rather than stress-eating.) You'd just have to be consciously aware that your body isn't going to correctly estimate when you've had enough everything-pizza, and so you'll have to consciously limit your intake rather than relying on satiety in that case. You'll likely end up somewhat hungry after such a meal. That's fine—you'll get to feel full again soon-enough, as long as your next meal after that is a low-macronutrient-variety one.
Re: Let them paste passwords (2017)
#119Earlier quoted context omitted.
Sure, but this isn’t engaging in the above poster in good faith.
I don't have the data on sales, so I can't comment on that. Without seeing the marketing, it's hard to tell why OP's solutions are not chosen. (I don't expect it to be as easy as "it's not difficult enough")
Re: Let them paste passwords (2017)
#120Earlier quoted context omitted.
Possibly or they could store N salted hashes, one for one of the N permutations of a mask over the password character positions. This basically splits the end user password into N passwords with smaller entropy but this can be mitigated by requiring high entropy for the original password.
Making it insanely easy to brute force if you have access to the hashes (if they ask for 2 characters, assuming a-zA-Z0-9 you're talking maybe 4k permetations, and then you know 2 characters) A 10 character 64 symbol phrase would take 64^10, or 1e18 guesses 5 lots of 2 characters 64 symbols would take 5*64^2, or 20k guesses
And all this to protect for keyloggers. Probably a hardware token second factor is more effective.