leevlad's comments

leevlad | 4 years ago | on: Crypto.com accounts had unauthorized withdrawals

In this case you set the anti-phishing code in your account settings (arbitrary string). Then they include it in all email comms (in the top right of the email body). So if you get an email from what looks like "Crypto.com", but with a different anti-phishing code - then you can be certain that it's phishing.

leevlad | 4 years ago | on: Improving first impressions on Signal

Fair. And I think I know what you're referring to.

Yes, they do upload your contact list, but I believe there's a prompt at setup time that allows you to opt out? It might even be an OS-level prompt to the tune of "Signal would like to access your Contacts". Not 100% sure on that one as I haven't set up a brand new Signal installation in years.

It's done to help their user acquisition. It uploads your contacts to match against other contact lists and let you know who's on Signal. I recall seeing a blog post explaining how they are doing it in a fully encrypted way, possibly using Secure Enclave (? though I think the 2021 version of that would probably involve ZK proofs/homomorphic encryption of some kind, and I hope they put some time into that).

I don't recall ever having to set a PIN specifically for that. And besides, a 4-6 digit PIN would be a terribly insecure way to "encrypt" anything server-side :) But yes, that would be a shame if it were the case.

leevlad | 4 years ago | on: Improving first impressions on Signal

Correct me if I'm wrong, but I believe your comment is misguided.

The PIN is a security option that prevents a SIM-swapping attacker from registering a new device under your phone number unless they know the PIN. You can opt out of it (and it might be opt-in to begin with). You can also easily opt out of PIN reminders. Both of these options are in Settings -> Account.

As for server state - my understanding is that Signal attempts to be zero-knowledge overall, but they definitely store some state on the server. I believe it's encrypted using your private key that's not backed up to the server. Setting the PIN does not change that.

Server state comment aside, it seems your main complaint is about a pop-up PIN entry UI that can be opted out of? I get that it might seem annoying, but it feels like a fairly weak criticism of a messaging platform, certainly not one that should warrant an impression that Signal is "on the way out"?

leevlad | 6 years ago | on: Firefox Multi-Account Containers

A few more usecases that I've added to my workflow since discovering container tabs:

* Work/personal separation

* Multiple AWS accounts

Also, I am very impressed with how well they're integrated into Firefox. For example, opening a link in a new tab will preserve the container. CMD+Shift+T will restore a recently closed tab and remember its original container. I really like the color coding too.

leevlad | 6 years ago | on: Firefox Replay

Curious to hear what's missing. I do some light front-end work (css/react) and have been fully on Firefox for about a year. Haven't looked back.

leevlad | 6 years ago | on: 16-inch MacBook Pro

How do you like pasting a TAB into your text editor/terminal every time you want to switch windows?

leevlad | 6 years ago | on: 16-inch MacBook Pro

I have lost responsiveness in both my CMD key and the E key. Apple agreed to replace the front panel of my MBP for free, so at least there's that.

leevlad | 6 years ago | on: Alphabet in bid to buy Fitbit

One can only dream. It was so far ahead of its time, and I still consider it superior to any smartwatch out on the market. I have mine from 5 years ago that still works great. We need more products like this.

leevlad | 6 years ago | on: Firefox 70

I do a moderate amount of ReactJS dev, and FF has been excellent. I barely noticed the transition from Chrome to FF when it came to my workflows.

leevlad | 6 years ago | on: NordVPN confirms it was hacked

I'd keep in mind that cloud providers have well-known IP blocks that can sometimes be rate-limited by various internet sites/services, primarily to combat botting. You might inadvertently get caught in the IP range that's being actively rate limited by e.g. Instagram. YMMV.

leevlad | 6 years ago | on: iOS 13’s privacy pop-ups of Facebook data grabs

This kind of comment indicates how effective the marketing/media kool-aid has been. Having paid very close attention to how both systems work (and having used both iOS and Android extensively in recent months), I don't think I'd necessarily declare either of these platforms a clear privacy champion.

leevlad | 6 years ago | on: Firefox 69.0 Released

Pretty sure it's keyed on your email alone. Not sure where you saw anything about passwords.

leevlad | 6 years ago | on: MITM on HTTPS traffic in Kazakhstan

Wow, if only everyone was as smart as Kazakhstan and figured out that this super awersome Security Certificate was "an effective tool" to protect the entire country's information space. And I've been wasting time with strong passwords, 2FA, E2E encryption, full disk encryption, etc. /s

leevlad | 6 years ago | on: Mazda is purging touchscreens from its vehicles

The infotainment system in my 2017 CX-5 often freezes on cold startup. There is no way to dismiss the "Warning" screen (which takes up the whole screen), even by pressing the "Dismiss" button. Just have to wait for it to go away on its own. I've had the backup camera freeze fully, which seems like a safety hazard. A few times, the whole system failed to initialize too, which forced me to pull over at the next gas station, and "power cycle" it by fully turning my car off and starting it back up again.

Mazda punches far above its price in terms of driving dynamics and interior quality, but I think their infotainment system is plain garbage and they should be absolutely ashamed of such poor quality.

leevlad | 6 years ago | on: Switch from Chrome to Firefox

I'm using latest stable FF release as my main dev browser. Sourcemaps are supported just fine. For my usecases, I can hardly tell the difference between Chrome devtools and FF devtools. YMMV

leevlad | 7 years ago | on: An update about Redis developments in 2019

To be honest, the top level comment in this chain reads a bit like an attempt at a plug for FoundationDB than a legitimate criticism of Redis. You could s/Redis/<literally any other DB>/g
page 1