401–410 of 540 posts
Cannot get past rule 5, tried a bunch of different solutions from this thread but nothing works. Maybe a browser quirk ( I'm on Brave IOS) Anybody else have the same problem?
Earlier quoted context omitted.
1. If they have the access to steal your hardware key then they also probably have access to replace your usb charging cable with a malicious one, or install a keylogger on your system, or place a microphone or camera near you for acoustic or optical keylogging. All ways your password could be stolen without you knowing. If your yubikey is stolen at least you find out fast and could warn your IT manager to lock you o…
> 1. If they have the access to steal your hardware key then they also probably have access to replace your usb charging cable with a malicious one, or install a keylogger on your system, or place a microphone or camera near you for acoustic or optical keylogging. All ways your password could be stolen without you knowing. If your yubikey is stolen at least you find out fast and could warn your IT manager to lock you…
You can do FDE with a smart card+pin or smart card+biometrics depending on your threat model.
I consider a pin provided to local hardware or for local decryption different from the concept of a password as is widely deployed on every web service under the sun.
Services should never see your secrets though, only public keys.
I assumed we were talking about web passwords given that is the only scope FIDO2/passkeys cover.
I'm stuck at "iatetomatoesyesterday0265Z#521juneVpepsiVIIxngxcaboutAg[moon emojis]italy2020Bf7+" trying to solve the chess notation puzzle. I especially laughed at the rule "must include today's Worldle" and I'm happy with my solution including every emoji for "must include the current phase of the moon as an emoji." (HackerNews doesn't seem to display emoji. My solution is to paste every moon phase emoji.) Excited t…
"Congratulations! You have sucessfully chosen a password in 113 characters." This was a horrific abomination, and delightfully evil. My solution (which includes some spoilers, even though each game has somewhat different rules): https://social.joshtriplett.org/@josh/posts/AX8ypcJYS8eSFLUX...
Did you actually manage to re-type that?
Earlier quoted context omitted.
You can just search for the answer to save having to do that
Now it seems progress has become literally impossible because the chess move + the captcha includes digits that add up to more than 25. I guess having to restart is intended to be part of the game, or is this a bug?
Earlier quoted context omitted.
> 1. If they have the access to steal your hardware key then they also probably have access to replace your usb charging cable with a malicious one, or install a keylogger on your system, or place a microphone or camera near you for acoustic or optical keylogging. All ways your password could be stolen without you knowing. If your yubikey is stolen at least you find out fast and could warn your IT manager to lock you…
Web passwords are the primary issue. Secrets that are local on your system with hardware enforced rate limiting, such as a pin on a yubikey, are reasonable. Pins are short and memorable. Passwords generally must be 256 bits of entropy and thus not easily memorable. You can do FDE with a smart card+pin or smart card+biometrics depending on your threat model. I consider a pin provided to local hardware or for local dec…
I consider PINs, passwords and passphrases as the same thing, just different rules to create/input them. Numerical PINs might be easier to remember, but as with unlock patterns on a phone, it is also easier to casually observe someone entering and memorizing it.
Biometrics I am not a fan of, because they can be stolen without you noticing. With password you have to enter it in an untrusted environment, which takes more effort to setup. Also biometrics cannot easily be changed if they leak. And they also change with time and events involuntary and some people even have identical biometric data.
> I assumed we were talking about web passwords given that is the only scope FIDO2/passkeys cover.
The discussion started with wanting to replace all passwords.
I don't know anything about passkey, but FIDO2 can be used for harddrive encryption: https://0pointer.net/blog/unlocking-luks2-volumes-with-tpm2-...
IMO, 2FA via hardware key etc. next to a password/PIN it great, but IMO some kind of proof of knowledge can not be replaced by just a proof of possession.
So Neal solves Wordle every midnight to keep this game running?
Not sure exactly where the data comes from, but the game uses an API at https://neal.fun/api/password-game/wordle?date=2023-06-15 Seems like it has answers up to July 30, so he's either a time traveller or it's possible to get future answers by looking at the Wordle source.
Earlier quoted context omitted.
You can just search for the answer to save having to do that
Now it seems progress has become literally impossible because the chess move + the captcha includes digits that add up to more than 25. I guess having to restart is intended to be part of the game, or is this a bug?