manitcor @ manitcor @lemmy.intai.tech

It's your internet, own it.

---

Read more

Posts

273

Comments

386

Joined

2 yr. ago

Moderating

---

too tired? from what im seeing the vast majority of people just don't care. they are fine with thier internet becoming more expensive and handing everything to these companies. most simply think this is the only option.

first someone has to have the idea, then someone has to pay for it.

availability of some equipment may also present issues.

Last car I bought was a 2015, infotainment in it is a disaster but completely ignorable/replaceable. If cars keep going the way they are, Ill drive what I have into the ground.

1. Babyfood containers are NSF plastic meant to be microwavable
2. They only tested babyfood containers and a pouch
3. these containers are made out of the same plastics used in many microwaveable products

I'm not microwaving plastic ever again.

ipv6 and reverse proxied. yes.

expected, but not a sustainable growth, there is a finite number of conversions here.

reddit's been less accepting of truth year over year for 16+ years

having a conversation in a shitpost?

thats a paddlin

keep "beta" in mind here. its all volunteer made, originally by just a small group. its going to be clunky initially. so was reddit.

profit + commons = not your commons

as evidenced by reddits recent moves.

im going to call that a corporate plaza with volunteer employees.

you won't even give them that in this kind of system. you will get a user hash that is based of your signature, the system your using's key and some mux of time and entropy input. This hash will be how they track you in a database and as systems evolve could even be a way to communicate with the user directly (like email) without knowing or holding any PII/NPI

Anything you assign to them would be data they have (maybe a common display name). Anything truly important that needs to be up there can be encrypted with different techniques that would allow the provider to work with your data without ever having to access or decrypt your data.

so the idea of them "needing to have something" to function is true, but fundamentally, they don't need as much to operate in this system and its possible to have standards that enforce security on your more sensitive details that are sent. Imagine the security of your data, on thier system, still being ruled by your security. Even if hackers get in and copy the entire database its effectively useless.

this is not dissimilar to how high security setups work for organizations now, really what this is is a scaling up of the kind of things IT administrators are already doing when locking down production among other systems (its a very common login pattern for Linux based systems for thier SSH terminals).

The big difference here is that your password changes from a password to a digital signature bound to time, hardware and the user. If the user so chooses they can always put a many levels on top of that that they want, be it passwords, additional keys, biometrics, what-have-you.

Since your credentials never leave your device data breeches do not compromise your account or access to it (only the data the provider failed to protect). This also enables even higher levels of security through the whole credential chain, want to end-to-end-encrypt your data and encode it with your own cipher while storing it in the providers database? This is not only possible it will end up changing how we develop some applications. As a developer I just want to give you the utility, if I can ensure strong encryption that I NEVER have access to, its a whole boat of liability I don't even have to worry about.

In short we are taking the mechanics of auth and making it entirely cryptographic with keys without any worry about compromising a simple text input box. The possible combinations of certificate data and system parameters alone increases the difficulty of a breech through login significantly.

It will not stop everything of course, and the usual risks around a bad release, a failed audit and an admin bypassing things knowing or unknowingly are all still problems.

The other thing this enables, should it get that far, decentralized replacement of Google/MS/Amazon auth systems many of us MUST gate our sites with, youll be able to accept logins from multiple systems without ever having to write any new code. As the standard becomes adopted and supported firing up a site with all the usual traditional logins combined with the more-modern cert-style setup will no longer be a game of dealing with app setups and IAM, you can just load and go.

Example of difference here: I could paste my public key to my prod systems here on lemmy and it would not change a thing about access to my systems, no one with the key or any of my signatures could do anything. With certificate based auth we know both sides of the transaction as well so MITM is not a thing in most scenarios.

it's fine, im sure everything is fine now

it already has been abused, you came here a bit late and missed the fireworks, there was a massive expulsion of badly behaving instances by many of the instances wanting to remain connected. I was actually quite surprised and impressed at the speed at which admins collectively decided and acted across the network. I actually suspect the ratio of mods:users to be higher here. The ratio of admins:users def is.

The system mentioned by Established here is called VRF, there is also technology called Self-Sovereign Identity aka DiD (a w3c standard)

To keep it simple, essentially we are moving to authenticators using systems that are similar to how a website identifies itself and secures your connection. For the user it will still be mostly the same, unlock device, unlock data (which I bet in some cases will STILL be password during the transition) do your thing. As time goes on and things like identity keys that we carry with us become a thing (think like a fancy version of the electronic door cards).

In general it will be much easier and less an issue to get into most systems and all of your accounts become more secure as we move away from having any data on the provider that could be used to reconstruct your password. Ofc all of this is still a bit away from being fully realized, expect rollouts to become more serious by the end of the decade.

I don't disagree though as a 16+ year reddit user, I can't say I haven't seen exactly this on more than one site in the past (including reddit). I'd also suggest that not every instance is "just like reddit" what might fly there will get you banned or censured on some instances, moderated on others.

might want to run your own instance or switch to one that aligns with you, does not prevent posting here and if you find one with modlogs on you too can see the actions.

oh its a mod action, i can see it. first post, new to lemmy gets removed. seems pretty normal imo, shitposting is a risky place to try to FP that topic.

these days password managers clear the clipboard, still the clipboard is not secure which would be why some still block it.

really its an indication we need to drop User/Pass auth once and for all.

they slowed things down in an attempt to try and get more scabs, they even reduced the limits to apply to take over a community, still haven't found enough people. MCoC is now on full auto, is not replying to anything and is just taking over subs and re-opening them with no moderators other than MCoC

id more presume lack of time, its a shitpost community after all.