I wish someone could tell me how bad is SMS for 2FA in reality, because every time I hear about it it's worded as if someone could gain access to your account JUST by stealing your SMS, which is exactly what TWO factor authentication would prevent from happening.
I've been under the impression a lot of scary articles about it are talking about single-factor recovery methods that use SMS, such as password reset systems.
I also think it's weird how e-mail never seems to be counted as a form of 2FA. If everyone used e-mail as 2FA, then I'd only need to secure my e-mail account.
If my passwords are saved locally in my computer, isn't the computer "something I have"? Holding a phone number in a complex system of telephony is the most weird "something you have" you could come up with.
You've basically backed into the logic of passkeys as well. It's all about _provably_ having the thing you have. Basically everyone is storing their passwords on their computer anyway, if at all, so the computer is the thing they have. Why not make that the factor instead of a string?
>Passkeys are a new way to sign in to apps and websites. They’re both easier to use and more secure than passwords, so users no longer need to rely on the names of pets, birthdays or the infamous “password123.”[1]
Hmmm... is THIS the vectors people are considering when they make these things? I mean, it makes sense, but it does put it a whole different perspective.
Am I correct to think that these aren't real problems if you use passphrases instead of some cliched password?
Because you can steal my phone and get through the lock screen to access all my stuff with the passkey, but you can't get my master password out of brain lest you put a probe in it.
Passphrases and a browser extension, basically. The Passphrase can still be stripped off the wire and used later while passkeys are phishproof and single use.
As someone working in telecom, we often hear customers telling us that their bank account has been wiped clean. How did they get there? Sim swap. A bad actor manages to transfer the phone number into a sim card they control.
Now they have potential access to all accounts where you use 2FA.
But that's just one of the FA's? In fact you could argue any 2FA account is 3FA.
For example, to break into John's account at bank dot com you need to know:
1. John's username.
2. John's password.
3. The code the bank sends to John's SMS.
I guess for a lot of extremely important things the username is public information, so that one is easy to get, but you still need the password besides the SMS.
Where are these bad actors getting the users' passwords from?
It seems you already need to have a leaked password for this SMS attack to mean anything, which I assume isn't something that happens very often. From how often I heard about SMS 2FA being bad, it sounds like it's worse at locking your account than 1FA, and that's what doesn't make sense to me.
The Windows standard file open dialog allows you to paste a http(s) link in, which will be downloaded and opened from the Temp folder. This works with all applications that use that dialog.
It opens instantly. It shows just the image by default (no toolbars, scroll bars, menu bars, or status bars). I can disable linear interpolation with F3 and show width/height of an image with F2. It zooms with the scroll wheel, pans by dragging, and it lets me go to the next, previous, first, and last image of a directory instantly, and doing that won't resize the window.
I suppose the key difference is that some people want just a read-only image viewer that traverses a directory, while others want a photo viewer, or image metadata editor, or photo management system. I haven't used Windows' default image viewer in ages, but I recall when I used it, rotating an image actually rotated the image, as in it changed the orientation header of JPEG files and rewrote the files. This is why I have trust issues. If even image viewers can't just view the image, how can I possibly trust the software that drives cars, flies planes, or does the banking?
Not really the difference in context of IrfanView which is also just an image viewer.
I tried JpegView, but it’s lacking several features I use in IV, and stuff I commonly do in IV is harder to do, so for me IV is a clear and easy winner. Performance is a little better, but not in a way I’d actually care about (mainly superfast skipping through images is slightly faster)
It does support batch rename, though. And generally I want to resize images while looking at them, and not go elsewhere for that. But only when I want it to, no automation.
>I used to use it back on Windows 95 because it was a faster way to view JPEGs than opening Internet Explorer.
That's an amazing sentence. We should frame it and put it in a museum. Actually someone should make a book filled just with quotes like this, call it "Life Before the Gigahertz" or something.
I see so many comments these days bemoaning how slow modern software has gotten, but no one seems to remember/have been alive for the time when just rendering an image would take multiple seconds.
Just goes to show that our expectations scale with the available technology.
And now decoding a jpeg takes the blink of an eye, but we wait five seconds for a widget to render. When it does, we click somewhere else, because in that exact moment the layout was reflown.
Every time I turn on my computer dnfdragora is like "there are 35 new updates!"
Oh yeah? But my computer is working. Those updates could fix problems that I don't have but could break stuff I have as well. I'm not updating until they release Fedora 40. (my nvidia driver stopped working when I upgraded to 39, again...)
To begin with who thought these notifications were a good idea? Just appear meekly on the system tray when you have something to say. The only time a popup is acceptable is if it says "yo, your computer is on fire." Anything less is unnecessary distraction.
I want my software as-is, changing only when I want it to change. The other day a Windows update removed my "show desktop" button from the task bar to insert a copilot button. Who asked for this? The taskbar changes when I say it changes! I started using the program because I liked the way it was. If it wasn't the way it was I wouldn't have started using it, so why change?
To make matters worse, I don't think there has ever been a time a software updated that I said "they finally added X!" It just never happens. It's insane. Things really only get worse with time. Ten years ago GIMP didn't have nondestructive editing. It still doesn't. I'm still waiting for it. They said it will come in GIMP 3, for years. I feel like that update is just never coming. We're at GIMP 2.99.18 now. Can you believe it? 2.99.18. Who even reaches minor version .99?!
This is viable when your app works completely offline.
As soon as it has a server to talk to things changes. It becomes rather expensive to maintain a server that has to support any previous client, or to support all the users who don't know how to update.
In practice auto-update is the best default. Android lets you turn it off. On iOS I don't know.
I can do anecdata too. Photoshop added content-aware fill, and then generative fill. These have been useful additions for me, saving time that was previously tedious stamp-tool work.
You missed the point. It’s not about whether updates are good or bad, because yes anecdotally it could be either. It’s about whether they are consensual. And whether constant harassment that you can’t opt out of counts as consent when you give up or misclick
>adds a great deal of UX complexity to the end user
Considering there are people who don't understand the bitcoins aren't INSIDE a physical wallet, that ship has sailed and made a revolution or two already.
Notepad has 16 toolbar buttons in the same amount of width that GTK can only fit 10 toolbar buttons. The height of the tabs and status bars are also MUCH shorter. It's completely ridiculous and makes every GTK app look bad to me. Not just Geany, but Xed, Pluma, Gedit, the image viewers, the file managers, the system settings dialogs, etc. I have a mouse. I can point at things. I'm not using my thumbs or toes to operate a desktop app.
Qt's licensing sounded a bit weird. At first I thought your app HAD to be open source to use it. But once it was clear to me that you can sell apps made with Qt so long as you dynamically link without having to pay royalties or anything, the choice was clear. If I have to program an app for Linux, I'm using Qt.
And so far the only problem I found in Qt is that it uses the system's "native" GUI by default (i.e. it uses Gtk on Linux). This means that the Ok-Cancel buttons are Cancel-Ok instead of the correct order. Who puts Ok buttons at the right side? Now if I want to quickly close something, I'm clicking at the corner of the window which is the easiest point to click at, and on the top right I have close (which cancels) and at the bottom right I don't have cancel but Ok which COMMITS which is the opposite of what a thoughtless rash speedy click is supposed to do. Ok should be at the left so you can't commit things by accident. The only reason to put it on the right is if you're designing for tablets so the ok button is closer for right-handed users. This isn't how a decision for a desktop-oriented design.
Unrelated, but is it my imagination or all string algorithms would benefit from UTF-32 over UTF-8?
UTF-32 always uses 32 bits per character, so you can easily paralelize it because you can easily tell where a character starts in a bit stream.
UTF-16 can have 16 or 32 bits, so if you have a sequence 2 characters of 16-32 bits, or in UTF-8's case, a sequence of 3 characters that are 8-16-16 bits, they won't fit neatly in a box. You can't just say char_ptr + 32 to land on the 32nd character, making it much harder to paralelize.
In addition, UTF-32 can cause issues on the network due to byte ordering (little endian vs. big endian). There’s really two encodings, UTF-32LE and UTF-32BE.
For all of these reasons, the world has largely standardized on UTF-8, plus for historical reasons UTF-16 in the JVM, CLR, Windows, and JavaScript.
I think you forgot { position: relative; } on .manipulation2
I like that it actually shows on the tab what the favicon would look like, but on my screen resolution the tab looks HUUUUUUUUUGEEE. Also I don't know if you know this but a single favicon.ico file may contain multiple different resolutions. Perhaps support that?
I've been under the impression a lot of scary articles about it are talking about single-factor recovery methods that use SMS, such as password reset systems.
I also think it's weird how e-mail never seems to be counted as a form of 2FA. If everyone used e-mail as 2FA, then I'd only need to secure my e-mail account.
If my passwords are saved locally in my computer, isn't the computer "something I have"? Holding a phone number in a complex system of telephony is the most weird "something you have" you could come up with.