not_that_noob

A PIN is really a numeric password. It has all the same flaws - compromise risk (say via social engineering) and the risk of forgetting and needing it reset.

So the ‘passwordless’ option here is either rename the password to PIN or eliminate it to provide single-factor login. The latter is a dream for smart attackers, since there is always some social engineering route they can use to acquire a legit token.

If anyone has doubts about UBI, consider the great A/B (or rather B/W?) experiment the government ran as part of the New Deal. One group was provided subsidies for housing (analogous to UBI) and another was not - decades later, the initial modest help compounded to leave one group much more prosperous than the other. I'm willing to bet on the outcome of this study.

https://www.npr.org/2017/05/03/526655831/a-forgotten-history...

"African-American families that were prohibited from buying homes in the suburbs in the 1940s and '50s and even into the '60s, by the Federal Housing Administration, gained none of the equity appreciation that whites gained. So ... the Daly City development south of San Francisco or Levittown or any of the others in between across the country, those homes in the late 1940s and 1950s sold for about twice national median income. They were affordable to working-class families with an FHA or VA mortgage. African-Americans were equally able to afford those homes as whites but were prohibited from buying them. Today those homes sell for $300,000 [or] $400,000 at the minimum, six, eight times national median income. ..."

So if a worker wanted a day off, all they had to do was think bad thoughts?

There is a potentially disastrous blow to FB's business model in the GDPR that relates to this sort of profiling. It is forbidden under GDPR, unless the user grants explicit consent (opt-in). See [1].

Without this, FB's targeting abilities for ads just evaporates. It is going to be interesting to see how this pans out.

[1] https://ico.org.uk/for-organisations/guide-to-the-general-da...

This already happens - it's called spear phishing. Instead of wasting time with multiple users, the attacker picks a high-value target. For example, if you can get one admin, it's game over.

Not disagreeing. Note however that I'm talking about the authenticator. If that is compromised, then the attacker now has access to all keys.

It's the weakness of single-sign on - if the authenticator is compromised, then the attacker now has the key that controls access to all the keys.

If one link of the chain is broken, it's game over. While this is a good effort, my point is that not considering the entire system as a whole simply transfers problems from one part of the domain to another.

It doesn't actually. If the authenticator expects passwords, then this simply moves the problems you cite to another part of the system. These are the sources of compromises on the modern web. It's a neat system - but it doesn't solve the key issue.

That's a misconception - I don't see where this helps with phishing.

Attackers don't bother stealing physical tokens - way too hard. It's much easier to ask for token re-issue using compromised info. See for example https://www.techlicious.com/blog/phone-porting-scam-can-empt...

While I applaud the hard work the W3C group has put into this, and the excellent spec, I can't help but think that they are solving a problem that doesn't exist.

Attackers are much more likely to assume a user's identity and thus acquire the user's certificates for such a system. That's how most compromises today happen.

The central issue is verifying a claimed identity - not just at enrollment time but also on every use. The spec waves that off to 'Authenticators' (see below). But that's not a solution. If user authorization to certificates are based off passwords, for example, then what prevents an attacker from taking compromised data about me and using that to get access to passwords?

Don't get me wrong - this is good work. But I just think everyone seems to be focussing on the wrong end of the stick.

=======================

User Verification

The technical process by which an authenticator locally authorizes the invocation of the authenticatorMakeCredential and authenticatorGetAssertion operations. User verification MAY be instigated through various authorization gesture modalities; for example, through a touch plus pin code, password entry, or biometric recognition (e.g., presenting a fingerprint) [ISOBiometricVocabulary]. The intent is to be able to distinguish individual users. Note that invocation of the authenticatorMakeCredential and authenticatorGetAssertion operations implies use of key material managed by the authenticator. Note that for security, user verification and use of credential private keys must occur within a single logical security boundary defining the authenticator.

Certainly. If it's an opinion, then that's fine. This issue is different - it's about manipulation, the willful presentation of known fake information as real news. That is not allowed in the print media by law (libel/slander) - so why should it be allowed on digital platforms?

Not quite. No one is asking for personal content to be judged.

But if there is a one-to-many pattern of information sharing (e.g. an organized attempt to share content) to unrelated parties, then that content should be vetted for veracity. Either FB does it, or they surface it for others to flag it.

FB never revealed the content of these ads, so no one other than FB knows.

Quite true and an interesting proposition. Especially with regard to transparency - if we all can see the data FB sees on what ads were targeted to whom - then that might help as well, as outsiders can watch for dark patterns. In addition, I think they need to use AI to verify if posts and ads can be fake before allowing it to go live.

Of course, doing so would mean fewer clicks. The more extreme the info, the greater the clicks.

This is at the heart of Zuck’s dilemma - to curb this problem in a meaningful way means reduced revenue.

What's interesting is there have been more than the usual number of downvotes for this thread. I wonder if using IP info admins can determine if these downvotes are clustering from within an org?

Yes, if they knew about it and didn't do anything, then that's willful negligence.

They are not helping their image - the latest is a rejection of GDPR for non-European customers. Seriously? Way to demonstrate commitment to user data protection FB.

This level of arrogance is a precursor to strict regulations. They are practically asking for it at this point.

Someone can still write an app to distribute on FB, and can use its platform's ability to foster virality to make it take off. That's a core feature of FB. The change you're talking about, if indeed it was made, may reduce the speed of vitality a tad, but wouldn't really affect the ability for an app to spread virally.

What's not being said is that the Russians likely had the data too for use in the 2016 elections.

See https://www.theguardian.com/uk-news/2018/mar/21/facebook-row... and the testimony Christopher Wylie gave before the UK House of Commons Select Committee. He's the CA whistleblower. It's a very illuminating watch - https://www.youtube.com/watch?v=X5g6IJm7YJQ

So to recap:

[1] Kogan writes a FB app for CA to create psychographic profiles of users. This data allows people to be targeted by how naturally susceptible you are to rumors and fake news.

[2] Kogan then accepts a position at St. Petersburg State University (so essentially Russian money) and moves there

[3] Russians subsequently magically gain a new superpower they didn't have before - the ability to target users on FB who are susceptible to manipulation towards extreme viewpoints.

Can you point to the particular new limitation that will have this effect? I can't find anything in the announced changes that do this. The key attraction of FB - viral marketing for an app - is something that FB wouldn't touch I think.

None of these changes will do anything to fix the basic issue. All the following aspects were derived from watching the testimony Christopher Wylie gave before the UK House of Commons Select Committee. He's the CA whistleblower. It's a very illuminating watch - https://www.youtube.com/watch?v=X5g6IJm7YJQ

The problem is the foll:

[1] CA wrote a trojan FB app to derive psychographic user data for FB users. This let them determine for example how susceptible you were to misleading or fake news.

[2] They then used FB targeting to target these specific people at scale, pushing extreme fake news such as "Obama moving troops to Texas to ensure 3rd term". This is military grade psyops applied at unprecedented scale.

[3] These people, as they were susceptible to manipulation, would then convert at unusually high rates. He says 5% or higher conversion. Conversion was measured as an action like donating money or signing up for a mailing list.

In this way, the entire democratic process was corrupted. The issue is not that there were dirty tricks in the 2016 election. The issue here is that the existence of FB's app platform allows the detailed psychological profiling of millions of people on scale, and then allows them to be targeted at scale using that profiling. This is a clear and present danger to democracy.

Even with these changes, a rogue app such as CA's would be allowed on the FB platform. FB has no visibility into how app data can be used offline.

The Dalai Lama represents Vajrayana Buddhism, which has tended to be more peaceable. Myanmar and Sri Lanka - two Buddhist countries that have persecuted minorities within - are of the Theravada school. https://en.wikipedia.org/wiki/Southern,_Eastern_and_Northern...

Some Buddhist monks in these countries are the chief propagators of the hate - in Myanmar, the head of the 969 Movement that's driving the Islamaphobia is the monk Wirathu.

See https://en.wikipedia.org/wiki/969_Movement

You can see Wells’ genius even in such a short clip. To think he was only 20!

Those are for Bitfunder and the like, where the issues are more about fraud than about the correct classification of coin offerings. There is no enforcement action against Coinbase for example. If the SEC was that confident in its position, then they would have gone after Coinbase, and we would have heard about it on CNBC first. This is a tacit admission from the SEC that they don't have much of a legal basis to stand on for such enforcement.

This is a press release - nothing more. A CYA from the SEC in case something blows up tomorrow. It's not a cease and desist letter to the exchange operators - so on balance, this is good news for them. I think the SEC is not confident that the courts will support their position, and so the next best option is.... a press release.

That's right, but it is usually minimal. This is a very dilutive round. But they need the cash, as the general MO is to try and drive competition out of business by pushing prices down. So not much of a choice here.

Investors found that particular religion with Google. Losing money hand over fist till they put in adwords. They had to fight investors to put in one of the most profitable models on the planet. Ever since then, the game has changed. Investors now believe fervently, and founders realized investors may not know everything. Everyone else who came after drafted in Google's wake (I'm looking at you Zuck)

Basically, it's like Indy Jones with the leap of faith - there's a an inordinate amount of hope in the future.

https://thumbs.gfycat.com/PoorImperfectAdouri-size_restricte...

Thankfully, the world is afloat with cash looking for a home, and so we can continue with this game for a while. At least, I think the portal will stay open till the round closes. Which is enough mostly.

BTW, traditional economics can well model this using advanced options equations, but the answers won't come close to justifying the valuation they got.

I don't think it was the conversion that was the issue, the gleeful schadenfreude of the article notwithstanding. Mueller is armed with subpoenas after all. This makes it easier for Mueller at best.