Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

RustDesk now supports true unattended remote access on Wayland

rustdesk.com

Post reply on HN
Print view View original

11–20 of 176 posts

Re: RustDesk now supports true unattended remote access on Wayland

#11

Post by throwaway27448 »

applfanboysbgon wrote: post #9
LoganDark wrote: post #4

RustDesk should fix their password requirements: https://github.com/rustdesk/rustdesk/discussions/2888

It's open-source, so just build it yourself with the tiny change. Something this trivial could be done with a 30 second prompt at this point, so there's not even an excuse of "too much effort". I will note that the XKCD password scheme being proposed there is, in fact, completely insecure. A modern consumer GPU can crack "four random English words" in a day. You can argue that it's the user's choice to be allowed to…

> A modern consumer GPU can crack "four random English words" in a day.

Sure, if you can rely on users using a specific format. The joy of the xkcd technique is you don't need to tell other people what yours is.

But, people just aren't going to remember strings of gibberish. Expecting users to do this is just silly.

Re: RustDesk now supports true unattended remote access on Wayland

#13

Post by vablings »

throwaway27448 wrote: post #10

What is rustdesk and how is it distinct from vnc? Edit: i appreciate the explanations; thank you.

Well first there was TeamViewer which was VNC with more bells and whistles then it became enshittified. Then anydesk came along and ate up teamviewer then that became enshittified, Now we have rustdesk which seems to hopefully be a bit more immune to being enshittified.

If you already use VNC this is not something for you

Re: RustDesk now supports true unattended remote access on Wayland

#14

Post by applfanboysbgon »

throwaway27448 wrote: post #11
applfanboysbgon wrote: post #9

Earlier quoted context omitted.

It's open-source, so just build it yourself with the tiny change. Something this trivial could be done with a 30 second prompt at this point, so there's not even an excuse of "too much effort". I will note that the XKCD password scheme being proposed there is, in fact, completely insecure. A modern consumer GPU can crack "four random English words" in a day. You can argue that it's the user's choice to be allowed to…

> A modern consumer GPU can crack "four random English words" in a day. Sure, if you can rely on users using a specific format. The joy of the xkcd technique is you don't need to tell other people what yours is. But, people just aren't going to remember strings of gibberish. Expecting users to do this is just silly.

The "joy of the XKCD technique" is that it prescribes a specific format millions of people will use, and it's so trivial to break that you can throw it into your cracking algorithm at virtually no cost.

If you were willing to use a bespoke, more secure variation of it, you could include a capital letter and a number rather than filing an issue on a repo insisting that you be allowed to use exactly the insecure variation.

Re: RustDesk now supports true unattended remote access on Wayland

#15

Post by tredre3 »

applfanboysbgon wrote: post #9
LoganDark wrote: post #4

RustDesk should fix their password requirements: https://github.com/rustdesk/rustdesk/discussions/2888

It's open-source, so just build it yourself with the tiny change. Something this trivial could be done with a 30 second prompt at this point, so there's not even an excuse of "too much effort". I will note that the XKCD password scheme being proposed there is, in fact, completely insecure. A modern consumer GPU can crack "four random English words" in a day. You can argue that it's the user's choice to be allowed to…

> A modern consumer GPU can crack "four random English words" in a day. [...] but arguing that that scheme is actually secure is just wrong.

Let me do just that!

This is a networked service. You send your password (or a hashed form) to it, and it validates it. You don't have the local hash to bruteforce it offline.

Even if we only consider the top 10k english words, it's 10000^4. It's going to take years to bruteforce this over a network because you'll go through so many rate-limits, cooldown periods, and outright bans that it's questionable whether it's even possible.

Re: RustDesk now supports true unattended remote access on Wayland

#16

Post by throwaway27448 »

applfanboysbgon wrote: post #14
throwaway27448 wrote: post #11

Earlier quoted context omitted.

> A modern consumer GPU can crack "four random English words" in a day. Sure, if you can rely on users using a specific format. The joy of the xkcd technique is you don't need to tell other people what yours is. But, people just aren't going to remember strings of gibberish. Expecting users to do this is just silly.

The "joy of the XKCD technique" is that it prescribes a specific format millions of people will use, and it's so trivial to break that you can throw it into your cracking algorithm at virtually no cost. If you were willing to use a bespoke, more secure variation of it, you could include a capital letter and a number rather than filing an issue on a repo insisting that you be allowed to use exactly the insecure variat…

I think you are both greatly overestimating the number of people who remember what xkcd is and their willingness to do what a webcomic prescribes uncritically. What you describe as "bespoke" is likely the normal way someone might use it: with their chosen format.

For instance, I have multiple separator characters, multiple beginning and end characters, and numbers places at specific places, and arbitrary casing. That may be overkill but it's still essentially the xkcd format.

Re: RustDesk now supports true unattended remote access on Wayland

#17

Post by applfanboysbgon »

tredre3 wrote: post #15
applfanboysbgon wrote: post #9

Earlier quoted context omitted.

It's open-source, so just build it yourself with the tiny change. Something this trivial could be done with a 30 second prompt at this point, so there's not even an excuse of "too much effort". I will note that the XKCD password scheme being proposed there is, in fact, completely insecure. A modern consumer GPU can crack "four random English words" in a day. You can argue that it's the user's choice to be allowed to…

> A modern consumer GPU can crack "four random English words" in a day. [...] but arguing that that scheme is actually secure is just wrong. Let me do just that! This is a networked service. You send your password (or a hashed form) to it, and it validates it. You don't have the local hash to bruteforce it offline. Even if we only consider the top 10k english words, it's 10000^4. It's going to take years to bruteforc…

Virtually any password other than "password123" is fine if you're rate limited to a few guesses per day by a networked service. Passwords should be secure against the inevitable data breach when the service you're using loses their hashed password database, which happens on a routine basis.

Re: RustDesk now supports true unattended remote access on Wayland

#19

Post by rcxdude »

throwaway27448 wrote: post #10

What is rustdesk and how is it distinct from vnc? Edit: i appreciate the explanations; thank you.

VNC is one way of doing remote GUI access (well, more a family of different protocols and products with different capabilities and tradeoffs). RustDesk is just another product that does the same thing but doesn't have a specific connection to VNC as a protocol so e.g. doesn't have to handle legacy authentication modes and stream formats. In my experience most remote access solutions beat VNC for performance, for example.

Re: RustDesk now supports true unattended remote access on Wayland

#20

Post by applfanboysbgon »

throwaway27448 wrote: post #16
applfanboysbgon wrote: post #14

Earlier quoted context omitted.

The "joy of the XKCD technique" is that it prescribes a specific format millions of people will use, and it's so trivial to break that you can throw it into your cracking algorithm at virtually no cost. If you were willing to use a bespoke, more secure variation of it, you could include a capital letter and a number rather than filing an issue on a repo insisting that you be allowed to use exactly the insecure variat…

I think you are both greatly overestimating the number of people who remember what xkcd is and their willingness to do what a webcomic prescribes uncritically. What you describe as "bespoke" is likely the normal way someone might use it: with their chosen format. For instance, I have multiple separator characters, multiple beginning and end characters, and numbers places at specific places, and arbitrary casing. That…

> I think you are both greatly overestimating the number of people who remember what xkcd is and their willingness to do what a webcomic prescribes uncritically

XKCD's youtube videos get millions of views each. It is a very popular comic, and that particular password advice has spread beyond it.

> What you describe as "bespoke" is likely the normal way someone might use it.

And yet the issue in question is about someone who refuses to adapt it.

Post reply on HN