Krisjohn

They're going with Passkeys.

That's odd, because I can sign into (on-prem) Confluence with my Yubikey (5 NFC) as the MFA via Firefox. I get a little Windows "tap your key" prompt and everything.

It's not just you.

Usernames and passwords are easy, if insecure. Type username, type password, done. Get admin to reset password if you forget. Put in password manager if one account is used by a team.

Security keys are hard. Needing a physical key around every time you have to log into something is annoying. Backups are hard, because off-site backups can't be done over the Internet. Self-service hardware tokens for services with infamously bad customer service is highly risky. Resetting an account if a key is lost or locked requires physically transferring hardware, which can be hard if someone is traveling, or can cause days of downtime. Team access is basically impossible if an account is secured with a physical key.

Authenticators are fine, except if you lose a couple of smartphones too close together, or you need a team to access one account. Password managers that let you securely store the QR code, or actually generate the key put the MFA in the same place as the rest of the credentials, which is not ideal but increasingly necessary for the same reason password managers came into existence in the first place.

Windows Hello and FaceID are actually pretty good, although fingerprint-based biometrics can be a little hit and miss. Not that a decent proportion of Windows users have Hello-compatible hardware. Interestingly, two TV shows in just the last few months (The Peripheral and, believe it or not, Mayfair Witches) have had a moment where a phone belonging to a dead or unconscious person was unlocked by showing it their face, so the shortcoming are entering public knowledge.

We can "all" agree that passwords are "bad", but we cannot agree on what to replace them with, mostly because the level of computer literacy for most solutions is much higher than just typing in a username and password. I can bang out the stuff above because, as an IT professional, I've experimented with KeePass, Windows Hello and Yubikeys in the last six months, buying my own hardware, to try to find some level of opsec that could be used by our customers. All I've done is highlight the lack of commitment to IT in general and training of all kinds in basically all of our customers.

If you create a system that will always punish 5% of a group of people, you need to admit that you just enjoy punishing people.

These are "Split Systems", yes?

Gardening. You're going to want that veggie garden producing real soon now.

Why walk away from AMD for one design/manufacturering fault? It's easy to avoid, just buy a card that doesn't use the reference cooler.

Why is this not phrased as "60% of NY jobs don't pay enough for you to survive in NY"?

Or more likely (speculating) "At least three quarters of NY jobs trap workers in poverty"?

The fact that people have found some way to surivive by bending or breaking rules, or have some precarious "solution" that could fail at a moment's notice, is irrelevant.

It’s the visibility problem at the entrance to a tunnel. While you’re in the bright light, it’s harder to see into the shadow. I know that theoretically you should slow down, but practically nobody does, so it’s unsafe to suddenly break during a brief loss of visibility, as demonstrated.

The Tesla CHANGED LANES AND STOPPED. There was no tailgating. This is 100% the Tesla’s fault. Everyone else is a victim.

Dropping the wireless keyboard onto the "bottom" and having the remaining accessible screen turn into a touchpad was pretty cool.

Were falling through the computer literacy gap between SMS MFA and authenticator/Yubikey MFA at the moment. While an IT person can do password managers (with secure backups) authenticators, passkeys, and biometrics, all with half-decent opsec, the average user can barely do more than a couple of passwords for everything, and SMS MFA.

It's absolutely critical that the companies we support vastly improve their security, but there's no way to get there from here with their staff, lack of any established processes, and zero training infrastructure.

I’m sorry, but if you start your complaint by saying Looper is some brilliant thing that sets the bar, or whatever, I’m not going to be taking you very seriously. The plot for that was so full of holes they literally had to invent a gun that only works if the target is about two feet away for the movie to not end in the first 15 minutes.

Website blocked due to trojan

Website blocked: nuxx.net Malwarebytes Browser Guard blocked this website because it may contain malware activity. We strongly recommend you do not continue.

Nothing is ever easy.

Me too. I've been using the Bitnami builds. VM for ages, but currently the Windows app.

All I got was a broken page and "Lorem ipsum dolor sit amet, consectetur adipiscing elit. In ullamcorper eget euismod orci. Cum sociis natoque penatibus et magnis dis."

Who has time for training? My small team is about half the size it should be. I'm already rarely doing stuff I already know how to do each day. I'm supposed to rush to keep up with all the new stuff I meet on the job AND do training on stuff I'm mostly not going to need to know for work, yet somehow remember enough of it to pass an (expensive) certification test? Reality does not suit a subscription model for this kind of training. Better to buy or download something I get to keep until I have a chance to use it.

We never had a BTRFS event on OS drives that didn't result in total loss of the OS. We have finally removed it from the last server it was put on.

Look around when you're outside and take notice of all the maintenance not being performed. Speak with people who have a job and see how many of them would describe their workplace as chronically understaffed. We're a long way away from "people idling at a job site". And even if we weren't, there's a cost to idle tasks that sit around waiting for someone to be available to do them.

That said, only a small percentage of workers are happy to be pointless. Punishing everyone over the few hypothetical lazy does more harm than good.

It's also a security risk. Get ahold of enough branded stuff and you can make people think you work at Twitter on a video call.

All the USB-C ports are slowly failing on all the Lenovo laptops we supplied to an important customer. Many have already required motherboard replacements to get the batteries to charge again, although whatever's been happening to the batteries as the USB-C ports fail has been killing them too.

We've also had Lenovo USB-C cables fail, and Lenovo docks fry themselves.

"Sign in with X" buttons all suck anyway. Why lose access to just one account when you can lose access to dozens? Use a password manager.

The new Manycam owners also trashed lifetime licences. They immediately released version 8 and refused to provide perpetual keys for the new version to customers that had bought lifetime licences. They also refused to offer any refunds.

Every single coping strategy for dealing with chronic understaffing is toxic.

Our knowledgebase at work has instructions on how to disable Modern Standby. Shout out to Lenovo and their shitty laptops - never waking up from standby may have been how they started, but I know they're all going to end with dead USB-C ports.

https://ozbargain.com.au/ for Australia

When our customers' marketing departments want in to the "Fediverse" with company-branded usernames, this is what I'm going to recommend.

Oh, yeah, not in. On.

Thanks for the heads-up. I got too focused on schadenfreude.

I've added https://raw.githubusercontent.com/JackCuthbert/pihole-twitte... to my pihole and flagged this in our security forum at work.

I once wanted a Tesla Powerwall. If I do get anything like that for the house, it's not going to be a Tesla product. Though, to be fair, I made that decision before he set Twitter alight.