WingNews logo WingNews GitHub [2]

robbya's comments

robbya | 6 years ago | on: Why build this blog, or anything, on IPFS?

I read this as: a group of professional engineers dedicated to hosting/scaling a platform designed for hosting blogs will perform better than a single random person managing a personal blog in their spare time. I generally think that's accurate.

robbya | 6 years ago | on: The “No Code” Delusion

> removing a 'create file' clause does not cause that file to be removed on subsequent runs, as the tool has no concept of ownership

Terraform on the other hand does have a concept of ownership, diff-ing, and applying changes. It takes some work as you now need to track state, but I've been very happy with Terraform.

robbya | 6 years ago | on: Academic Torrents

I think it's worth recognizing that this is a good first step in a hard problem. Hosting many TB of data for free isn't easy. Building an index on top of that data isn't easy either, and it looks like no such index exists today, but if someone decided to build that index they wouldn't need to worry about the hosting portion of the problem. That's a great starting point.

robbya | 6 years ago | on: Academic Torrents

https://academictorrents.com/about.php#mirroring

Using RSS to allow mirrors to host different subjects is really clever, although some of the categories seem quite large (>5TB). It may be worth breaking up each category (sharding) to keep each to 100GB or less so a volunteer can pick a couple and not worry about running out of disk when a category grows.

Then it would be good to track how many seeds each category-shard has so volunteers can help where it's most needed.

robbya | 6 years ago | on: Language Learning with Netflix extension

> just put a different joke in

I wonder how often you get a different joke on the translated audio and yet another different joke in translated sub titles. Kind of wild.

robbya | 6 years ago | on: Language Learning with Netflix extension

FWIW subtitles for the original language will also sometimes vary from the original audio as well. I tend to re-watch shows on low volume with subtitles on so I've caught this a number of times, but it's fairly rare.

Usually I've seen the subtitles shorten the words in the audio. "You must come with me now" -> "Come now" or similar. I've been assuming it's to help the reader keep up with some quick exchanges.

robbya | 6 years ago | on: HTML attributes to improve your users' two factor authentication experience

> Imagine someone in a domestic abuse situation

Depending on how abusive you are thinking, that sounds like rubber hose cryptanalysis. That's a hugely powerful approach and I think all 2FA can be bypassed with that, if not most of modern cryptography.

https://en.m.wikipedia.org/wiki/Rubber-hose_cryptanalysis

> having their phone taken

Keep in mind that other 2FA methods also are phone based, like TOTP / Google Authenticator. Those also fail if your unlocked phone is taken. SMS is even weaker than those, but still better as a second factor versus nothing.

robbya | 6 years ago | on: HTML attributes to improve your users' two factor authentication experience

Edit: looking again, I see what I missed.

> The only real defense is to never associate your phone number with personal accounts which even then is often not possible.

Yes that's exactly right. If I don't trust a website to not use my phone number as the sole factor for recovery, then I should not use SMS 2FA on that site and I should not add my phone number to any part of my profile. If I know (how?) that the website won't use SMS for recovery, then SMS 2FA is better than nothing.

As a website owner, if I offer SMS 2FA auth and use SMS in isolation for recovery, then I'd want to stop using SMS for recovery. After that, removing SMS 2FA and not offering any second factor would weaken my security. I.E. SMS 2FA is weak but better than nothing. SMS single factor recovery is terrible, fix that ASAP.

robbya | 6 years ago | on: HTML attributes to improve your users' two factor authentication experience

You're talking about account recovery, not 2FA. A website can use my phone number for account recovery even if I'm not using SMS as 2FA.

I agree with everything you said about SMS for account recovery.

Account recovery that uses a phone number is weak. There was a paper on HN this week that detailed this.

However, if we are going to compare SMS 2FA (I.E. password plus code sent over SMS) against just password, SMS 2FA wins. In both cases I need to steal your password, the SMS part is an added challenge although it's easier to bypass than many people want.

Given SMS 2FA and any other 2FA option, SMS 2FA loses.

robbya | 6 years ago | on: HTML attributes to improve your users' two factor authentication experience

Sure, everything that has a backdoor is bad. But what does that have to do with SMS 2FA?

Surely SMS 2FA (without a backdoor) is better than nothing. Sites should still offer something better than SMS for 2FA as it has widely documented issues. But as an end user presented with SMS 2FA or no 2FA; SMS 2FA is the safer option.

Is there a reason to assume an arbitrary SMS 2FA implementation would have a back door? That would be news to me.

robbya | 6 years ago | on: SMS is not 2FA-secure

Why? It's not "secure" but it's more secure than nothing.

The paper mentions some websites that claim to use SMS 2FA, but actually use SMS as a single factor for password resey. While that's really bad I think the solution is to fix those broken implementations not to stop using SMS 2FA everywhere in favor of using nothing.

robbya | 6 years ago | on: SMS is not 2FA-secure

This is really a criticism that Google called their system 2FA but actually was using it as a sole factor. That's bad security and bad naming. Had they actually used it as a second factor, then you would have seen a security benefit.

robbya | 6 years ago | on: Ask HN: How many of you are rolling your own auth?

> Most any language's built in psuedorandom number generator is going to be sufficiently random that you will have no trouble.

I once collected a $3k bug bounty over this. Python's use of Mersenne Twister in the lib/random module should not be used for token generation. Mersenne twister uses a relatively small state space and is fully deterministic (it never re-seeds or mixes in new entropy). If you get a couple sequential random values you can reconstruct that state space and predict all future values. I.E. request a password reset 10x in a row and examine the tokens in the emails.

Please only use secure random number generators when creating security related tokens.

Example blog post: https://know.bishopfox.com/blog/2014/08/untwisting-mersenne-...

page 1
more