@atoponce@fosstodon.org
@atoponce@fosstodon.org avatar

atoponce

@atoponce@fosstodon.org

MSCSIA, cryptography, security, locksport, Linux, programming, mathematics, amateur radio, Buddhism, running, anime, and bibliophilia.

This profile is from a federated server and may be incomplete. Browse more on the original instance.

atoponce, to random
@atoponce@fosstodon.org avatar

I see variants of this question come up a lot:

"If a website allows for 100+ character passwords, and you're using a password manager, why not take advantage of it and just auto-fill?"

Because anything past 72-80 bits security doesn't provide any practical security benefit. This is 13-16 character and 6-8 word passphrases.

If the service provider is storing your password in plain text, length doesn't matter. If it's hashed, no GPU cracking rig will find it.

https://www.reddit.com/user/atoponce/comments/186u5li/password_length_recommendations/

atoponce, to random
@atoponce@fosstodon.org avatar

Without disassembly, there are 43,252,003,274,489,856,000 unique permutations in a 3×3 Rubik's Cube. If sufficiently shuffled, that provides ~65 bits security.

Which means recording the colors of each of the 6 faces after two sufficient shuffles is enough to provide at least 128 bits security.

https://en.wikipedia.org/wiki/Rubik's_Cube#Permutations

A shuffled 4×4 cube has ~152 bits security.

https://en.wikipedia.org/wiki/Rubik's_Revenge#Permutations

A shuffled 5×5 cube has ~247 bits security.

https://en.wikipedia.org/wiki/Professor%27s_Cube#Permutations

atoponce,
@atoponce@fosstodon.org avatar

It's worth defining what it means for a cube to be "sufficiently shuffled" though. I don't know if research has been done on this (I assume so).

You need to ensure that each smaller cube has equal probability of reaching every possible location in the larger cube, as well as having each possible orientation in that position.

atoponce,
@atoponce@fosstodon.org avatar

Possible true random number generator however. Something different from flipping coins, tossing dice, and shuffling playing cards.

Worth investigating at least.

atoponce,
@atoponce@fosstodon.org avatar

It looks like the shortest path to solving the worst case 3×3 cube is 20 moves. As a result, I suspect that if the cube is held behind your back and you apply 20 twists to the cube, turning it over in your hands, this would be a sufficiently shuffled cube.

https://www.cube20.org

atoponce, to random
@atoponce@fosstodon.org avatar

I've been screaming this for years. Service providers that provide authentication should do these two things at a minimum:

  1. Require at least 12 characters.
  2. Use ZXCVBN to estimate password strength and require a score of 4.

Interestingly enough, if you do those two things, you don't need stupid password complexity requirements, and you don't need a blacklist, as 12+ characters with a ZXCVBN score of 4 won't show up in password database breaches.

https://www.cc.gatech.edu/news/largest-study-its-kind-shows-outdated-password-practices-are-widespread

atoponce, to random
@atoponce@fosstodon.org avatar

No.

atoponce, to linux
@atoponce@fosstodon.org avatar

Optimist: the glass is half full

Pessimist: the glass is half empty

user: water is bloat

atoponce, to random
@atoponce@fosstodon.org avatar

When VPN providers claim they keep anonymized logs only.

atoponce, to linux
@atoponce@fosstodon.org avatar

You're familiar with the sudo(8) command, but did you know it had a logo? Did you further know that it's a sandwich?

https://www.sudo.ws/about/logo/

atoponce, to AeroPress
@atoponce@fosstodon.org avatar

The U.S. patent for the expires June 1, 2027. A little more than 3½ years.

That may partially explain why they are flooding the market with designs and accessories. The more they can get ahead of the curve with the brand, the better off they'll be against competitors.

I'll be curious to see what other manufacturers do with the design, such as Hario or Fellow however.

https://patents.google.com/patent/US7849784B2/

atoponce, to random
@atoponce@fosstodon.org avatar

Big news on the front. RAIDZ expansion has been merged.

"This feature will be available in the OpenZFS 2.3 release, which is probably about a year out."

https://github.com/openzfs/zfs/pull/15022

atoponce, to random
@atoponce@fosstodon.org avatar

As a native English speaker living in a country where English is the official and primary language, I am naive to generators in other countries and languages.

In those in countries where English is not the official primary language, what characters are used when generating ?

For example in English, the 94 graphical ASCII characters are used in every password generator I've seen for English speakers.

Note: I'm not interested in passphrases built from word lists.

atoponce,
@atoponce@fosstodon.org avatar

For example, if you live in India where Hindi is primarily spoken, are the characters in your password (not passphrase) generator Devanagari? Or are they also primarily ASCII? Would you benefit from a Devanagari password generator?

atoponce,
@atoponce@fosstodon.org avatar

I'm curious if other writing scripts are used or would be valuable when generating random meaningless password strings.

  • Greek
  • Hebrew
  • Arabic
  • Kana
  • Cyrillic
  • etc.
nono2357, to quantumcomputing

Unlikely, but waiting for the details...

atoponce,
@atoponce@fosstodon.org avatar

@nono2357 Given the current landscape of quantum computing, the probability of breaking RSA-2048 right now is 0.

https://sam-jaques.appspot.com/quantum_landscape_2022

atoponce, to opensource
@atoponce@fosstodon.org avatar

Trying to figure out if this is satire.

atoponce, to programming
@atoponce@fosstodon.org avatar

Fixing a bug in production.

Video of a seated swing amusement park ride in operation. An engineer is wearing a hard hat underneath the ride as it swings literally inches above his head. He's watching the powerful wheel that powers the ride spinning back and forth.

atoponce, to random
@atoponce@fosstodon.org avatar

This is my first time having a Bud Light. I've only ever drank locally brewed specialty craft beer.

I'm not saying this to brag, but rather surprised on its lack of taste. I'm used to crisp, malt, hop, fruit, etc. flavors. But drinking this, I'm honestly shocked at how flat it tastes.

I guess I shouldn't be surprised. I've heard that Bud Light, Coors, Corona, etc. are shit beers. But I had the opportunity to have either a free Bud Light or Coors, so I gave it a go.

I'll stick with craft.

atoponce,
@atoponce@fosstodon.org avatar

@brianokken I did have hot dogs. Heh.

atoponce, to random
@atoponce@fosstodon.org avatar

> 65536 - wordList.length
< 925

Damn. So close.

atoponce,
@atoponce@fosstodon.org avatar

@davep

atoponce, to random
@atoponce@fosstodon.org avatar

Starting November 7, 2023, Dashlane Free users will only be able to store up to 25 passwords. Otherwise, they will need to pay $60/year for a premium subscription.

atoponce, to GNOME
@atoponce@fosstodon.org avatar

Regarding the Foundation hiring a professional shaman as executive director.

Spiritual beliefs are personal. Whatever. This really shouldn't be the headline.

Instead, what is more concerning for me is her complete lack of technical executive experience.

Don't get me wrong. She doesn't need programming or sysadmin experience. But she should have experience understanding how to lead such an organization.

That's what seems to be glaringly missing. Can just anyone be executive director?

atoponce,
@atoponce@fosstodon.org avatar

This is total speculation, but I'm guessing someone on the board of directors knew her personally and recommended that she would be the perfect fit for the job.

Holly Million does have experience leading other nonprofits and organizations, although we don't know necessarily to what extent.

The GNOME Foundation posted for the job in August 2022 and revised the opening description in May 2023. Maybe the board was getting desperate?

Curious why a board member wasn't promoted.

  • All
  • Subscribed
  • Moderated
  • Favorites
  • •
  • provamag3
  • thenastyranch
  • magazineikmin
  • InstantRegret
  • GTA5RPClips
  • ethstaker
  • Youngstown
  • everett
  • slotface
  • osvaldo12
  • rosin
  • mdbf
  • kavyap
  • DreamBathrooms
  • megavids
  • ngwrru68w68
  • Durango
  • modclub
  • cubers
  • khanakhh
  • Leos
  • tacticalgear
  • cisconetworking
  • vwfavf
  • tester
  • anitta
  • normalnudes
  • JUstTest
  • All magazines
    •