221–230 of 262 posts
Obligatory xkcd https://xkcd.com/949/
https://www.sharedrop.io (source: https://github.com/szimek/sharedrop ) is a great user friendly option as well. I use it with friends, and even between VMs on the same machine.
> The codes are short and human-pronounceable, using a phonetically-distinct wordlist. The receiving side offers tab-completion on the codewords, so usually only a few characters must be typed. How does this work from a security perspective? Given the lack of apparent entropy can’t a malicious actor conceivably enter the correct phrase before the good actor?
The PAKE algorithm lets you spend an interactive roundtrip to buy a full-strength key out of a weak shared secret. An attacker can attempt to guess the passphrase, and their chances are non-zero (one out of 65536 with the default configuration), but when they guess wrong, the whole protocol shuts down, and the real participants have to start over again, with a new code. So the only way for the attacker to win is for…
That is as opposed to sending a public key or key fingerprint. In that case there would be little value to the attacker in seeing the transfer. They would have to MITM the transfer of the key itself. If you wanted to prevent the attacker from sending bogus files you would also have to transfer some sort of signing key.
So a short, time limited, secret vs a longer public value.
Earlier quoted context omitted.
It makes me uninterested in Firefox. I want webapps to be able to talk to files, but Mozilla thinks it's too dangerous. Even though we already have APIs to talk to the local filesystem, & the main difference is this one isnt hideously slow. This issue is one of those that when people are screaming, why are folks using chrome, why haven't we all switched to Firefox I point to and say, because I want a good web, I want…
If it doesn't do what you want, it's fair not to like it. Just to offer a different perspective, though: I don't consider a lot of the things that Chrome does (bittorrent functionality in this case) to be part of "a good web", or really part of the web at all. I don't need my browser to be an operating system. I can use other apps to do other things. It's much more important to me to avoid another Internet Explorer-l…
Autocompleting secrets sounds unsafe. > The receiving side offers tab-completion on the codewords, so usually only a few characters must be typed.
I don't think auto-completing a code-word leaks any information, since the set of code-words is fixed. Just think of each word as being one character from a large-ish alphabet. Code-words are used so that the one time secret can be easily remembered or shared over a voice channel.
The secret can be any string you like, the protocol doesn't care, instead of "4-purple-sausages" it could be "4-65535" or "4-qtx", and have the same resistance to attack. The CLI encodes the secret as two words from the PGP word list, which was designed to be spoken and transcribed accurately even over a noisy voice channel (sort of like the Alpha/Bravo/Charlie/.. "military phonetic alphabet", except it's two alternating lists of 256 words each). In practice that pair of words is much easier to speak and listen and hold in your head for a minute or two than a random number, or the first two letters of each word divorced from the words themselves.
There are some provisions in the protocol (not yet implemented) to allow alternate word lists, so if the sender uses e.g. a French wordlist instead of the default English one, the receiving CLI learns about it early enough so that "wormhole rx" can auto-complete against the correct list. The server/attacker could learn which wordlist is in use, but still faces the same level of entropy about the PAKE secret itself.
Does it work without an Internet connection?
We've sketched out some approaches to working in a disconnected environment like that, using local multicast and mDNS/ZeroConf/Bonjour to act as an alternate mailbox server (https://github.com/magic-wormhole/magic-wormhole/issues/48). There's still design work needed, though, and I fear it would degrade the experience for fully-connected nodes (extra timeouts), so it might want to be opt-in with a `--offline` flag on both sides.
Earlier quoted context omitted.
If it doesn't do what you want, it's fair not to like it. Just to offer a different perspective, though: I don't consider a lot of the things that Chrome does (bittorrent functionality in this case) to be part of "a good web", or really part of the web at all. I don't need my browser to be an operating system. I can use other apps to do other things. It's much more important to me to avoid another Internet Explorer-l…
Probably the main benefit of another browser engine (Ladybug?) entering the scene is that it would force Mozilla to come up with a more compelling sell than "not Chrome."
I was a little surprised to learn that they'll use Swift for future development. It's not among the languages I usually think of for cross-platform work. On the other hand, maybe Ladybird using it will help drive improvement in that area.
https://nitter.privacydev.net/awesomekling/status/1822236888...
Earlier quoted context omitted.
I'm suffering from fatigue from all the political commercials in which every single Democrat apparently single-handedly reduced the price of insulin. As if government-mandated pricing were a good thing. If something is overpriced, somebody should jump in and take advantage of a business opportunity. If nobody is jumping in, perhaps the item is not overpriced. Or perhaps there is some systemic issue preventing willing…
> If something is overpriced, somebody should jump in and take advantage of a business opportunity insulin is off patent. anyone can in theory manufacture it, but the ROI is just not worth it even at the current prices. Manufacturing it is not easy, there are humongous amounts of regulations, you will probably need to do a couple of clinical trials too... so you end up with an oligopoly that are incumbents that nobod…