Atemu

joined 5 years ago
MODERATOR OF
[–] Atemu@lemmy.ml 1 points 2 years ago (2 children)

Chromium was developed specifically to avoid a monopoly...

[Citation needed]

[–] Atemu@lemmy.ml 2 points 2 years ago

The main advantages of Signal over WA is that Signal minimises the amount of metadata Signal has access to and promises to not store or analyse the little remaining metadata.

The data (as in: the actual message content) should be similarly secure in both.

[–] Atemu@lemmy.ml 4 points 2 years ago

How did you generate this password? Which wordlist did you use?

I'd first extract all words with the starting letter from that list and simply take a look at them; whether any of them jog my memory.

Are you still logged into any BW client on any of your devices (or have such a state contained in a backup)?

[–] Atemu@lemmy.ml 3 points 2 years ago

you could start by using every word in the English dictionary that starts with that letter (would take you years)

On a mainframe from the 80s maybe.

The number of words is quite finite and the number of words in commonly used wordlists even more so. On the order of thousands maybe.

Given that they claim to know the starting letter, that should narrow it down to hundreds.

Even at multiple seconds per check that'd only be a few minutes.

The other wrench in this problem is that Bitwarden vaults are not readily able to be brute forced. I won't go into the specifics, but passphrases are not stored in "plain text", but rather in "hashes", which is kind of like a "fingerprint" of a file in that every file has a unique "fingerprint".

A simple hash does nothing to slow brute force. It's the underlying mechanism to do any password verification at all and usually rather quick.

State of the art for master-passwords are PBKDFs such is argon2i which are basically a hash hashed again and that hashed again and so on such that you must do a high number of hash calculations in order to verify a password; each depending on the previous.
You choose the number of iterations in a way that is still relatively quick to do in human terms but rather lengthy in computer terms (hundreds of ms to a few seconds). Every time you enter the master pw your computer runs through this PBKDF and you probably don't even notice.

This does indeed "slow down" brute force attacks a good bit in relative terms but in this case the difference is inconsequential in absolute terms.

Bitwarden won't let you constantly slam your vault stored on their servers with brute-force password attempts.

I don't know about BW limitations in this regard but depending on whether @WtfEvenIsExistence@lemmy.ca is still logged in on any of their devices, they might be irrelevant because you don't need to interact with any of BW's servers even once to crack your own password. BW works offline if you have logged in once which implies that the pubkey, salt and whatever else is required to verify the password and unlock the vault are available locally.

[–] Atemu@lemmy.ml 1 points 2 years ago (1 children)

No OEM to my knowledge provides BLOBs publicly.

LineageOS instead extracts these from the official ROM.

RE and/or shimming only need to happen when those BLOBs become incompatible with newer versions of Android.

The actual task of a maintainer is to configure the rather generic AOSP/LOS to work with the device's specifics and integrate device-specific components.

For a few simpler examples, it must be configured which of a device's SIM slots (if any) are eSIMs, which brightness values the device's light sensor is expected to return, where the device has a fingerprint sensor (if it has one), the dimensions of the notch cutout and many other such things.

[–] Atemu@lemmy.ml 1 points 2 years ago

Wow, tmps didn't support user xattrs before?

[–] Atemu@lemmy.ml 7 points 2 years ago* (last edited 2 years ago)

IIRC a Google engineer once explained that exact matches do always work but can be confusing because they also apply to non-text elements. If an img alt text contains an exact match, that will show up as a result eventhough a text search on the site won't find the phrase.

[–] Atemu@lemmy.ml 26 points 2 years ago* (last edited 2 years ago) (1 children)

Results for exact term "cats and dogs". If no or few results are found, we'll try to show related results.

Basically useless.

[–] Atemu@lemmy.ml 21 points 2 years ago (3 children)

You don't want to combine zram swap and physical swap. When zram swap is full, you'll get LRU inversion because it won't ever evict from zram swap.

Either zram-only or physical+zswap.

[–] Atemu@lemmy.ml 1 points 2 years ago (1 children)

That would be devastating for battery life.

[–] Atemu@lemmy.ml 1 points 2 years ago

Working proprietary software that respects your privacy is better than not-quite working FOSS IMHO, especially in an OS targeted at regular folks rather than exclusively at nerds like us.

view more: ‹ prev next ›