ShadowPouncer

As someone who types dvorak, and who is just waiting for the /dev/tty dvorak / colemak specific keys to arrive for their new full size keyboard… This really shouldn’t be tempting, damn it!

The biggest potential issue is if your local password can be used to login remotely.

I am definitely coming to the conclusion that in the long run, we’re going to end up using something that looks a fair bit like Webauthn / Passkeys for most things that care about security, with something as additional local authentication.

There are technical reasons why passwords / passphrases are useful, but there is a lot of research that shows just how horrible they are both from a security perspective and from a usability perspective.

Biometrics are… Convenient, but only useful in low security applications*, and are almost impossible to use for things like unlocking your phone after it reboots**.

A separate physical object would work really well in some cases, like a desktop computer, but it wouldn’t work at all for something like your cell phone. Or even a laptop. The object would be stolen along with the device it secures.

I’m really not sure what the long term answer even looks like, but I do hope that it’s not passwords or the like.

*: You can’t easily change any of your biometrics, but you can most definitely capture someone’s biometrics, and then duplicate them to gain access to something. It wouldn’t be practical to do this every single day, but just to gain access to something once or twice? Easy enough.

**: The short version: Your PIN / Passphrase / Password / Pattern get fed into a hashing function of some sort, like PBKDF2, which eventually spits out something that can be used to decrypt the key used to encrypt all the data on the device. But this requires a static value, and biometrics are all about fuzzy matches to other patterns.

I… I need more than one of these. :(

The pillow, the stone, and the blanket.

Terry Pratchett gave the world so many wonderful things, this definitely being one of them.

I wish that we still had him, even if he would hate what the world is becoming.

Yeah, this really doesn’t look even remotely surprising to me.

Absolutely everyone involved should already understand that they are not building something that they know how to build.

Sure, they have plans, and they can build to exactly those plans… But even then, there is no guarantee at all that they will then achieve net positive fusion energy. Because nobody has done that in a controlled reaction.

But it’s also not like the rest of the world is sitting still. Other projects exist, and sometimes those projects are going to learn things that will impact the design of ITER.

For that matter, even if they have the plans, some of the pieces are things that nobody has ever built on that scale before, which means that nobody really knows how to build them until they try.

This is a really good example of a project that you can not accurately estimate.