It's only an issue if you have password authentication enabled, which shouldn't be the case on a production system.

The very first things I do whenever I set up a server are copy my SSH keys across, verify they work in a new SSH session, then disable PasswordAuthentication in the SSH config.

In addition to needing password auth enabled, a user has to have a literal asterisk as a placeholder password hash in /etc/shadow, and PAM must be disabled or not installed. All these things combined are very rare on production servers. This is the case on Alpine Docker containers, but it's very rare to SSH directly into a Docker container, since Docker containers are supposed to be small and only run one thing.

If you really need password auth on a production server, you should really be using two factor auth, and simply setting up a 2FA module without even using it would help (since it needs PAM).

i guess this is not much of an issue for people who don't live near airplanes

They're using a math technique similar to how audio fingerprinting (e.g. can identify a song from someone humming it) works. Also, I could be wrong but it might actually be a clever way to use the built-in gesture recognition features of some of the newer wifi 7 chipsets (yeah, they have that).

They're not using it to pick up audio (obviously), but the way the math works would be similar: When someone moves their hand this way, that's a 90% match for the letter A. That sort of thing. So when you capture a series of movements, you can associate that with the person typing a specific word.

What I'd like to know is how specific this technique is to the keyboard/person in question. As in, if it was trained on the researchers/volunteers and thus only works on the researchers/volunteers.

I suspect that it's likely got the same problem as keyboard audio fingerprinting tech: It only works if you train it ahead of time for that user on that specific keyboard.

I wasn't able to read the whole article, but the abstract implies that they're reading the WiFi "waves" to predict key strokes. This is an extension of WiFi "person detector" technology. I'd love to see the whole article and learn if I'm afraid of this or not.

😱😱 😱 😱 😱 😱 😱

i'm so glad i don't have to do security at my new workplace rn. :p

holy shit that's bad.

Fortunately Homebrew’s git comes before Apple’s in my $PATH.

In my case, mostly in Homebrew.

on the one hand:

locate certifi/__init__.py|xargs cat|grep ^__version__|sort|uniq -c

for people who are even considering development without ai assistance this is a good indicator that's it's not possible any more. you need to use it in one way or another because code can be read so so many times now.

For regular users the risk is largely from the services they're using being compromised. If you upload your data to some cloud service and it gets hacked, then your data ends up pwned too.

how much should the end user worry tho? most of these seem like costly sophisticated attacks that, i think, would not be worthy to spend on a regular joe or are directly related to sysadmin people. for example the php vulnerability is really widespread but not that important for the end user except for leaked data.

when life imitates art

One of eMudhra's certificate authority private keys is the number 4.

Not a number that starts with 4, or the number 4 followed by a few hundred random digits, just, 4...

Nonsense. Why did you post this?

Frog inna pot

You never had any fucking freedom in regards to these services. The article is a bug-scare and is just trash. You might as well rail against their requirements to include numbers and special-characters in passwords--"oh, that's infringing on my freedoms! Just yesterday you accepted my password of "password", but now it's no longer acceptable? Wow fascism! Telling people they need to have numbers and special-characters! This is a slippery slope. People rise up and don't put any numbers or special-characters in your passwords!" I can't deride enough the point of view that originated this article. It's the most brain-dead boomer point of view I've yet seen. An epitome of manchild that's endemic to tech.

In some countries we are already actually forced to use banking on or phones. People like it a lot, but older people are struggling or forgetting about it and enduring. I hate it because of this exactly, the way older people is getting left behind.

Yes, ideally that's what should happen.

In practice, I've seen way too many times big corpo getting away with anticonsumer practices because their mainstream audience is willing to put up with it.

Specially when they introduce it slowly (say.. they start by allowing a reasonable but fixed number of keys ..then they lower the limit but start putting a small fee for each additional key.. then they lower the limit to 1, increase the fee, etc).. they'll test the waters and try to reach a level that enough of the mainstream would accept to maximize the money they make.

Right, then they’re opersting outside of the bounds of the Internet and should be appropriately shamed.

You can have an infinite number of tokens with a single YubiKey, but that's not the concern.

The issue is that a website can limit how many different passkeys you are allowed to register to a single account of their service.

So it does not matter if your device can provide infinite keys when the service only accepts one.

The standard allows an infinite number of tokens

I think the concern is more about the freedom for the user to be able to decide what keys to use and how.

In particular, the author seems to want to share 1 account with multiple people, and enforcing "User-Present User-Verified Non-Copyable Hardware-Backed passkey" as the only accepted method for a service would allow for services to start restricting account sharing more effectively.

They talk about yubikeys in the footnote, which isn't the best place to talk about them. They do not rant about how passkeys are bad because they are secure, they neutrally explain all the cool features and then they explain attestation, which is the only part they don't like. Also, they don't say that they use Windows, Android, macOS and iOS themselves and bemoan the oligopoly; they say most people use these operating systems instead of librecomputers, and bemoan the oligopoly on behalf of other people who don't know better, or use windows because [general excuse for why people who aren't the author use windows]. It is perfectly consistent to think of the author themselves as well informed about what linux they as an individual can install. I think we can blame the author for not making the article about how to install libre software, but taking that it is about passkeys as a given, it explains which part of them is harmful to software freedom. Maybe they even should have said that using android is to voluntarily subjugate oneself. But the article is about what the author wants other people to do, even if they aren't explicit enough about that rejecting passkeys while using chrome is a temporary solution. They are the type of person that believes temporary solutions have value.