some information can be viable for longer than that, there are some extreme cases where 2~3 minutes would not suffice
207 karma · joined April 29, 2020
really bizarre response, if you don't have something good to say, don't.
Modern solutions move away from passwords to MFA and/or digital/physical tokens which there we can control the security level with high precision.
Users are the weakest link as the author stated.
you can set the option to compute a billion rounds for each password.
U2F(Yubikeys utilize it) and TOTP are both great options.
even push to login is quite common these days.
You have great options.
For a long time security wasn't a top priority for many companies if we are frank about this.
Today we have standardized implementations and guidelines, we have many additional options like TOTP or U2F which are pretty robust.
Nowadays if someone wants to implement good user identity/authentication they can.
Passwords are used because they are convenient and intuitive.
Once you use a 'password manager' you basically have a glorified key generator/storer
We already have so many alternatives from GPG keys to FIDO/FIDO2 solutions
Security isn't always the first priority when running a website/app, it is the sad but honest truth(coming from security expert with over a decade of experience)
1. TOTP is time based, after 30 seconds it means absolutely nothing, you cannot recreate the 'secret key' from that number
2. with TOTP everything is well-known. TOTP will usually generate a 6 digit 'secret', this makes managing it very predictable:
6 digits = 1,000,000 options(including all zeros) we can easily calculate a good security margin
like: 5 attempt - 5/1,000,000 = 0.000005% chance of success Very predictable security margin
for passwords it's a huge unknown, it entirely depends on the user password quality
TOTP and passwords are not the 'similar' because TOTP is a secret generated from the 'key' and is only valid for a short time period
this make usage of that secret vastly more challenging for attackers, especially at scale.
I've seen real attacks where passwords are stolen, it is impossible to keep track of that. However for TOTP since the attacker has to login NOW, you can very easily detect anomalies of a new IP addr with many successful logins for different accounts
Or to put it differently, when you capture a password it is always valid credential but for TOTP, it requires more advanced infrastructure(automatic logins, save tokens)
and even then the token will eventually expire, with password you can generate infinite tokens
Most of malware, logically, abuse common features within the operating system
It is always the abuse of legitimate features which are the problem
GPUs are gaining traction in FP workloads, it can be seen clearly with CPU/GPU data-center market share
Moore's law is pretty much over, we can't simply print more performance these days, we are going to see major shift to accelerators which would require some rewrites, otherwise you're going to be stuck
for CPUs INT perf is king, even in HPC/enterprise
Some workloads can be accelerated via AVX-512 as shown here by Anandtech:
https://www.anandtech.com/show/17601/intel-core-i9-13900k-an...
See how AMD CPUs with AVX-512 enabled some a massive boost even with similar/less cores
I would agree that most typical workloads don't benefit much from AVX-512, it requires software support and good use-case(wide parallel SIMD)
making two displays work properly with correct aspect ratio and refresh rate
buggy UI components that needed restart from terminal
Many features aren't fully accessible from the UI AFAIK
I actually tend to interact with Linux machine mostly via terminal because UI is so unreliable from my experience
If there's one thing that Linux does very poorly IMO, it is GUI (technically desktop environments but you get the point)
The core issue is that Linux wasn't designed around regular consumers but rather around pros/techies
This is why Android or even ChromeOS were able to penetrate consumer markets far more while being based on the same Linux kernel
Google prioritized easy, intuitive UI that any person can pick up easily without any prior knowledge
no terminal commands, no need to understand file-systems, no config-changes, no debugging errors
Apple has proved this is as crucial as the quality of the kernel/OS itself
Do you even listen to what you're describing here? trailing someone, trying to extract fingerprints? this isn't a Jame Bond movie.
Cyber attacks are common because they are completely digital\anonymous by nature.
Secondly, humans can't remember\generate truly secure passwords, unique for every account they own. they usually rely on a tool like a password manager.
PM are definitely better than weak passwords but are actually weaker than biometrics. they are a central point of failure and have been attacked in the past.
For the average Joe, biometrics are more secure since he is not using such tool anyways.
a photo\mask isn't perfect and actually in some instances they fail to work vs sensors because of that.
It is more of a question of how robust is the authentication method.(can a photo\mask fool it? which can happen sometime but usually require pretty high quality sample)
As I explained you can't get the fingerprint from the device\key, it is simply not there.
This isn't the problem of the implementation\technology if someone stole your fingerprint. it didn't lead to your biometrics compromised
What's easier to do? stealing someone's fingerprint or cracking\guessing their password.
Definitely the latter.
Password based biometrics is the last place I would look at for biometric compromise.
We leave biometric traces everywhere, all the time. do you cover your face and wear gloves in public? hmmmm...
I think what you want is secret keys completely detached from the user. we have that as well with hardware tokens.
FIDO simply wants to make authentication stronger, you can use hardware keys that have a key burnt into them which is unique and much harder to brute-force than passwords.
Again according to how biometrics are described in whitepapers\industry, we extract features from the fingerprint\face sometimes very little compared to the actual biometric and use it to derive a key. that key cannot be reversed to get the original features and different algorithms use different features.
The signal from the sensor is used as a "seed" to generate key using robust cryptography
Different sensors will output different "data" based on the sensor type.
Username is simply an ID. Password is how we truly verify who the user is.
Bio-metrics are just convenient because they are unique and hard\impossible to replicate.
The evaluation tested both detection and prevention capabilities
There's also other interesting investments in air breathing cathode batteries.