Posts by Doctor Syntax

Will passkeys ever replace passwords? Can they?

Re: Lose your device, lose your access

This, of course is the sort of rubbish that's specifically advised against when it comes to good practice.

Re: Lose your device, lose your access

" I assume you use a different long, random password on every site and also different username...."

By and large, yes.

Of course the sites that want an email address as a UID are a bit of a problem. If they're important (i.e. my money's at stake), they get an individual email address - one reason to have a personal domain. Sites which want an email address just for marketing purposes to be annoying (hi, there, booking.com) get an individual email address which will be blocked between my usage or one that's discarded immediately as appropriate.

Sites which issue their own UIDs can be a bit of a problem too in that sometimes they follow a predictable pattern.

It's a curation problem but one largely due to individual services' predilection for annoyance. I can't imagine passkeys being different in that regard. Essentially the combination of UID and password is just a long string of characters as is a passkey with only the protocol differentiating them.

It's the practicality that matters. As things stand I keep passwords on a laptop with a master-password protected password manager. The laptop login is also password protected, of course. Those two passwords are all I need to remember. The laptop is synced to a NextCloud instance.

I only access whatever the passwords protect from my laptop so if I don't have the laptop available I don't need them anyway and the laptop is a big chunk to carry around so I don't accidentally not have it with me.

If what's being proposed is to replace the password manager by a passkey manager on the same laptop then I have to ask what's the difference (I'll come to that in a moment). Or is the passkey to replace the password that's currently protecting the laptop login? If the latter then it means I have to have the laptop and something else to hand. Given that it's already the case that I need the laptop plus a charged, switched on and in-signal mobile to do some things I know from personal experience that that's all too often a complete fail.

But if you're telling me it's "just" replacing my passwords by something with a more secure protocol and that my everyday usage is unchanged then I'm still going to have to take a look at how that protocol's being implemented. I have one end of that in the form of S/W in my laptop and each remote service will have its own implementation. Oh. Just. Great. We all know what happens next, don't we? Some scrote working for either my laptop OS provider or for the S/W used by one or more service is going to spot an opportunity for an improvement, optimisation or tweak (icon: looking for idle hands) and the whole thing gets screwed on a regular basis - shall we say every other Patch Tuesday?

Re: What happens when you die?

You can just imagine the project meeting.

"OK, but we need to plan the procedures for what happens if the customer dies, the device breaks etc. We'll have to have them in place for go-live."

"Don't be negative."

Re: Count me out

"If you worry a lot about devices getting stolen, all hardware keys have the option of a fourth known which can be a mandatory pin after touching."

Oh, good. It's been stolen but it's still secure.

But without it I'm locked out. What do I do now?

Re: Count me out

Though the "I lose the device and I lose access" part is already solved - put the passkey in a password manager that's synced (or in case of hardware keys have a second one).

Good theoretical solution. How do you implement it in practice so that you can have one lost or stolen but not both and yet have that second one available wherever you happen to be in an acceptable time-frame and without needing some sort of access which depends on having a passkey available?

Re: Lose your device, lose your access

"You have 2 Yubikeys, you create passkeys on both."

This belongs in the same universe as "assume a spherical cow".

Re: Count me in, please.

I take it your users are provided with some SPF on which to store their public keys.

Re: Single point of failure

I came here to say exactly the same thing. It's not so much that the device becomes a target for cracking.

We have now reached a point where it's expected that a mobile phone will be to hand, switched on, charged and receiving a signal at all times. It may be lost, stolen, have a flat battery, be in the car, a different room, whatever. Without that availability there's no guarantee of being able to make an online purchase, manage a bank account or whatever. (Being retired it doesn't actually have any functionality for employment purposes.)

The smartphone is rapidly becoming a single point of failure for life. Have we learned nothing?

Hardware barn denies that .004 seconds of facial recognition violated privacy

Data is being collected for long enough to be processed. As a general member of the public entering the place I'd have wanted to know what was being done during that time and in particular, could it put be in the way of some sort of harm or disadvantage? What if it made a false identification of me? What would then happen?

If they tried to answer "nothing" I, and, presumably the court, wouldn't believe them because in that case there'd be not point in having the kit installed.

Robot runs marathon in South Korea, apparently the first time this has happened

And faster than my daughter in Athens at the weekend - although she now says that'll be her last.

Undergrad thought he had mastered Unix in weeks. Then he discovered rm -rf

Re: Slap on the wrist?

"User permission management wasn't some new concept introduced in the 90s."

Of course not, but it all depended on what permissions were set. Write for group? or for all?

Re: We all learned the same way...: mv and move

So that's what happened to Data General.

“I could sit in comfort writing papers using LaTeX in emacs,”

Not my idea of comfort.

Re: RTFM

You didn't mention remembering them.

Re: We all learned the same way...

Big hint: mv can have the same effect and, yes, I discovered that the same way.

Re: Ah....backups....

A test restore can be invaluable for refining your backup creation. The first time we tried that in a DR centre we realised that /etc was so late in the backup sequence it took hours of restoration before we had anything we could even log into to check the files which had been restored. A simple change there made a big difference to the success of the second test.

Teen serial swatter-for-hire busted, pleads guilty, could face 20 years

Re: D-Link: "...all should be retired immediately."

EOL shouldn't just be for the device, it should be for the vendor.

Microsoft starts boiling the Copilot frog: It's not a soup you want to drink at any price

"If you're the human at the end of this AI-smart question and want to look smart enough to answer it, who are you gonna call? Copilot."

This one's easy to deal with. You throw it back at the "questioner". "You got Copilot to write that question? OK, get it to answer it. Next question, please."

"the photon torpedo of productivity and the phaser bolts of revitalized workflow."

I'm sorry, I'll read that again.

Mornington Crescent!!!

AI poetry 'out-humans' humans as readers prefer bots to bards

Re: I asked ChatGPT for a Dylan Thomas style poem about AI, and it's a weird lament...

Hmmm. The scansion's a bit arratic.

Re: Wordsworthless

Well played, sir.

Take the work of any poet - or, come to that, any prose - from a few centuries ago and there will be changes of grammar and vocabulary since it was written. The reader may no instantly grasp this. Unless the LLM has been trained on Shakespearean English it's going to come up with something that requires less thinking about for a modern reader.

Just the first 4 words of Shakespeare's Sonnet are enough to highlight some differences:

"Shall..." Oops. Wouldn't a modern writer be more likely to write - and a modern reader expect - "Should"?

"Shall I compare thee..." What? 2nd person singular pronoun? How is that to be understood? Growing up in rural Yorkshire that was a familiar expression from the older generation and the protocol was internalised (it's the same as the use of "tu" etc. in French) but archaic today. Would a modern reader instinctively grasp the intimacy of the phrase? Would and LLM select it and if so, automatically use "Thou" on the next line?

And that's only the easy bit before the mind-bending nature of the comparison that's being made, the thought that went into working it out than that would then be demanded of the reader even given that, for instance, a summer lease might be a more common concept in his time.

O2's AI granny knits tall tales to waste scam callers' time

An alternative would be to patch a couple of incoming calls together and let the scammers try to scam each other.

I sometimes used that approach with email scammers:

"That sounds most interesting. I'm too busy to deal with it personally at the moment. Could you please liaise with my colleague at $AnotherScammersAddress"

After all, they're in the same line of business so it's only polite to introduce people with common interests.

Re: Née Dell in a haystack.

Why? O2 are actually doing a good job on this. BT, OFGEM and OFCOM executives, however...

Re: Now there’s a challenge!

The real data would be knitting patternsetc. but I'm sure SWMBO could provide more training data on patchwork.

Give out a name and address? The whole idea would be to run them round so they never get that far and in any case, it doesn't have a name and address.

Swiss cheesed off as postal service used to spread malware

Re: Car parking meters

QR - Quiet Robbery

QR codes must be one of the best additions to the criminals' toolkit since Bitcoin. Time was then seizing a set of hous-breaking tools rated as a success.

Congress ponders underwater alien civilizations, human hybrids, and other unexplained stuff

Re: Been waiting, but it hasn't been mentioned, so...

The real paradox is that we're here.

Re: So let me get this straight ...

"However, given life has occurred here"

Were it not for the counter-example you'd have to consider so unlikely as to be impossible.

Consider the number of different systems integrated to compose life. You have the RNA-protein synthesis system which depends on having not only the RNA template but also the amino-acid specific transfer RNAs and the amino-acid/RNA specific activating enzymes.

I'll concede that the ribosome might not be necessary and could have evolved later and the same applies to DNA. You still need some mechanism to replicate all that RNA.

That's a lot of proteins, all of which have t be coded for in RNA. Given that RNA itself can catalyse peptide bond formation it's still a fearsome boot-strapping problem if you're powering it by thermal energy and an even bigger bootstrapping problem to find some naturally-occurring chemical energy source that can link to it. If you want to see it evolve beyond consuming whatever stocks of organic chemicals that non-life processes can provide you also need some form of photosynthesis to evolve.

You also have to have the planet not only become suitable for life at some stage in its development, it's got to stay that way whilst all this unlikely bootstrap happens. Given that photosynthesis is going to involve photolysis of water that's going to require a means of dealing with the release of something as thoroughly nasty as oxygen.

It's the improbability of all those things being strung together successfully that you have to set against the number of planets.

It's a big ask and, I think, reasonable to discount until a second example is found. It's also possible to understand the thinking behind the "life arrived in a comet" style of thinking about lefe on Earth - it's a throwing the problem over the wall solution.

Re: So let me get this straight ...

Maybe they should just be put out to gress.

'Unidentified Anomalous Phenomena' is a perfectly respectable term. Trying to explain such things is a perfectly respectable undertaking. What isn't respectable is doing so while ignoring Occam's Razor, even worse is going as far as possible beyond it.

Re: So let me get this straight ...

sentient alien life exists in our vast, nearly infinite universe.

FTFY

Sarcasm aside this is a statement for which we have evidence and, if you want to insist, you can remove the word "sentient" but with the word "alien" is in there there is no supporting evidence and something I find very unlikely.

Letting chatbots run robots ends as badly as you'd expect

"Why would anyone link a robot to an LLM, given that LLMs have been shown to be insecure and fallible over and over and over?"

This seems to be an unnecessarily specific question.

Google Gemini tells grad student to 'please die' while helping with his homework

Re: Are we being fair to the AI ?

The one that decided we all needed a course on "Empowering a quality culture: strategies for excellence", springs to mind.

I think you may have misunderstood the motivation. The course wouldn't have cost that much and leaving of your own accord they don't have to pay redundancy money.

Re: Is this news ?

Or very expensive ink.

UK energy watchdog slaps down Capita's £130M smart meter splurge

Re: Dear Smart Meter Zealots: Explain why they all....

Should not and cannot are two different things.

"Back in 2012, the government created a legal obligation for energy suppliers to make sure they completed the rollout of smart meters by the end of 2019. Subsequently, it pushed back the deadline three times, first to the end of 2020, then 2024, and then 2025. As of February 2023, the government launched a consultation on plans to have smart meters installed in 80 percent of homes and 73 percent of small businesses by the end of 2025."

They should, by now, realise that there's a substantial customer resistance, that they've got about as far as they're getting, that it was a Bad Idea and they might as well quit while they're behind.

I suppose what stops this from dawning on them is that it looks just like so many other HMG projects - behind schedule and over budget - that they think that with time and budget it will get there in the end if they really want it.

Musk also wants to fight Microsoft in legal grudge match with OpenAI

Can it be arranged so that both lose and someone with an amicus curiae brief win?

EU stings Meta for nearly a billion bucks over competition-trampling Facebook Marketplace

Re: Wait, what?

It's a usage that's been around for a good while. Is there anything else you were previously unaware of we can help you with?

Not so much missing as the usual PR trick of ignoring it in order to address a point that isn't there.

Mark Z does not like this

"You're not supposed to like it, Mr. Z. You're supposed to pay."

Lenovo China clones the ThinkPad X1 Carbon with an old, slow, local x86

If it's running Windows it will be transmitting a whole lot.

Re: Headscratcher?

And a reminder that we said this is where sanctions would lead.

Re: China wants locals to use more tech designed and built within its borders

"Here in the UK we outsourced everything and their dog"

And the way things are going we're outsourcing more and more food production in favour of solar farms, data centres etc. I trust it will be ministers, heads of quangos and tech CEOs who will be the first to give up eating.

Microsoft Exchange update fixes security flaws, breaks other stuff

Re: Channels

Three channels? We only had two.

TMMM should be mandatory reading for all Microsofties from the very top donw. Particularly the very top. Start by paying attention to the bit about the tar pit.

Cybercriminal devoid of boundaries gets 10-year prison sentence

One hopes that he will be refused any form of medical treatment for the rest of his life.

Fujitsu does not trust Post Office in use of Horizon data in future third-party prosecutions

Re: You'd think

The problems always start at the top.