Hacker News: urgent_skittle

New comment by urgent_skittle in "Passkeys are a trap"

urgent_skittle — Mon, 12 Oct 2026 23:22:55 +0000

The "something you have" means "something you physically possess and can't be copied". Logging in with username, password and an email OTP is 2-step authentication, not 2-factor, as multiple people can have access to the email account from different places at the same time.

New comment by urgent_skittle in "Passkeys are a trap"

urgent_skittle — Mon, 12 Oct 2026 23:02:14 +0000

TOTP also does not imply a second factor, it's just a time-based password calculated from a shared secret that can be stored anywhere, for example in your password manager alongside the username and password. And worse than your password, of which only a hash should be stored at the service you have an account with, they store the shared secret too (which can thus be leaked from their side), so TOTP is never fully hardware-bound, it always exists in at least two places. Passkeys _can_ be fully hardware-bound, with the secret only existing in the secure chip of your phone or hardware security key for example, not at any moment in its lifecycle exposed to user, service or potential attacker.

> Amazon (..) still requires TOTP when logging in with a passkey from an unrecognized device.

I noticed Amazon does that and it annoyed me greatly.

Ask HN: How secure is desktop Linux? Is it stuck in the nineties?

urgent_skittle — Sun, 28 Apr 2024 17:05:30 +0000

When I switched from Windows XP to Linux, it was considered the more secure OS. On Windows, users were still running with admin rights by default.

I've used CrunchBang Linux, Lubuntu and Linux Mint since then, and while the security of dominant consumer OSes—now Android and iOS—has improved significantly in the past 15 years, not much seems to have changed on desktop Linux.

Where on my smartphone I can grant an app access to only the one photo I need it to have access to, on Linux, for all I know every program that is running under my user account may have uploaded all of my personal files to a malicious actor a thousand times over.

Where on my smartphone I can deny an app access to my location, on my laptop any application can easily get my external IP address and a list of wifi access points and bluetooth devices.

I read Windows and MacOS have adapted to the age of always online computers as well. Why are Linux distros not keeping up and applying the principle of least privilege?

Comments URL: https://news.ycombinator.com/item?id=40190009

Points: 10

# Comments: 16

New comment by urgent_skittle in "Organic Maps"

urgent_skittle — Sun, 03 Sep 2023 00:23:01 +0000

> I just tell it what countries (or states / regions) to download, and it downloads them.

This is exactly how Organic Maps works. You don't _have_ to zoom in on every region you plan on visiting to download it, you can just go into the menu and select a whole country or parts of it.

New comment by urgent_skittle in "Discovering that a Bluetooth car battery monitor is siphoning location data"

urgent_skittle — Tue, 27 Jun 2023 13:18:01 +0000

Sounds like this New York Times article:

https://www.nytimes.com/interactive/2018/12/10/business/loca...

Edit: or actually I was thinking about this article, One Nation, Tracked:

https://www.nytimes.com/interactive/2019/12/19/opinion/locat...

Which is one in a series they did after some employees of a data broker or digital ad company (if I recall correctly) leaked a dataset to the New York Times because they actually were concerned about this kind of dataset existing.

New comment by urgent_skittle in "New F-Droid repository format for faster and smaller updates"

urgent_skittle — Sat, 04 Mar 2023 19:11:25 +0000

Indeed, and I was talking about the boot image, but some still refer to it as the recovery, i.e. LineageOS. I see LOS have changed their download pages now and correctly call the boot image boot.img instead, that's good. So anyway, just download the boot image alongside the ROM instead of extracting it, and rerun Magisk install before rebooting after an OTA, and it's all very doable. Not as easy as before, but not too hard either.

New comment by urgent_skittle in "New F-Droid repository format for faster and smaller updates"

urgent_skittle — Sat, 04 Mar 2023 03:57:30 +0000

Sounds very familiar. I switched to Foxy Droid, an alternative F-Droid client, years ago partly because its search functionality is miles ahead of the official F-Droid app. The popular and newer Droid-ify and Neo Store are forks of it I think, so should offer the same improvements.

Top results for 'ssh' in Foxy Droid: ConnectBot (SSH client), SshDaemon (ssh server), RSSAid (RSSHub... nothing to do with SSH), Easy SSHFS (Sshfs with ssh client), Trigger (open doors via SSH), FiSSH (SSH authentication via fingerprint), TeamBot (SSH client), SimpleSSHD (SSH server), etc.

New comment by urgent_skittle in "New F-Droid repository format for faster and smaller updates"

urgent_skittle — Sat, 04 Mar 2023 03:43:01 +0000

You make it sound harder than it is. Most (if not all) ROMs offer the boot image as a separate dowload, often referred to as the "recovery"; LineageOS is one of them. You only need to patch and flash it once, after that you can just open Magisk after the OTA update has been installed but before rebooting, and choose the "after OTA update" install option.