• 0 Posts
  • 29 Comments
Joined 11 months ago
cake
Cake day: July 31st, 2023

help-circle




  • That has to do with how hashes work.

    Hash is if you want someone to be able to check if he’s got the right password but not able to know what it actually says.

    Imagine my password is “shark”. Let’s say I use a hash algorithm so that it becomes “2gtth5”. If I log in. I enter my password. My browser* uses the same algorithm, so the text I entered is “2gtth5” now. The server looks up my hashed password, checks if it’s the same and then it lets me log in. The benefit is, the server doesn’t know my actual password, it only knows that the hash is “2gtth5”. This means if the database gets compromised, people only see “2gtth5” but not my actual password. And because it’s a hash, they don’t know how to get back from “2gtth5” to “shark” and therefore my password is not compromised.

    Now imagine if I knew the hashing algorithm used and I have a list of possible passwords. There might be “shark” in there. So I can take the password list, make a hash out of every password and see if it matches. Because my password is in there, the hash for “shark” will match the hash “2gtth5” in the compromised database and they now know my actual password. This is a far bigger problem.

    Everytime you see that someone “hacked” a database and password hashes got compromised, this is what happens. They use rock you and a few other lists to see if they can “crack” the hashes (this just means checking the hashes and seeing if one of the password from the list matches).

    This is specifically what those lists are for. They are used by bad actors to make use of the hashed passwords they stole.

    Glossary:

    • hash: representation of some text
    • cracking a hash: trying to get the actual text from a hash
    • salted hash: a hash with fake characters in there
    • algorithm: basically the way your program works, either the code or a scientific representation of the way it works

    *Someone in the comments corrected me on this. The server does the hashing not the browser.








  • I already commented this on another post about chat control but I still stand by what I said before so imma be a dick and put the original comment here as well:

    Imagine there’s one phone type with one security level. And now they introduce a second phone. It has less security. Now everyone has to switch to the weaker phone.

    Soooo, now who gets the stronger phones? Government employees? The military? Politicians? Agencies?

    The less the strong phones you give out, the more authoritarian the measure. But the more the strong phones you give out, the higher the chance of misuse or mishandling. You will now have a black market for secure phones, giving them out to criminals. You will now have people with strong phones having a higher right of privacy, giving them more protection against the state itself.

    Now let’s add more factors. Someone loses their stronger phone. We now have a potentially untraceable strong phone. The government is losing control over those. Now you have 5 different tiers of secure phones. But people are people and the more complicated, the more things can go wrong. Now let’s add in slightly more authoritarian states like Hungary. There’s a good chance they will instantly start spying on journalists. Or give opposition parties the weaker phones by accident.

    Now add in foreign agencies. China’s digital government agencies are very efficient. Imagine they get the keys to the weaker phones. Great, now China can effectively monitor 99% of the EU. And now even if an EU member has a strong phone, they just listen in his wife’s phone, and they get the information anyway. Now what about if a spy from North Korea gets the keys and starts finding bank information on the stronger phones? They now have new super annoying ways of stealing billions of dollars from the EU and covertly as well if they do it right.

    As you can see, making some people’s security weaker on purpose is a lose lose game. It never works. There’s way too many cooks in the kitchen in the EU for this kind of stuff to stay in line, and there WILL be misuse, one way or the other.




  • Imagine there’s one phone type with one security level. And now they introduce a second phone. It has less security. Now everyone has to switch to the weaker phone.

    Soooo, now who gets the stronger phones? Government employees? The military? Politicians? Agencies?

    The less the strong phones you give out, the more authoritarian the measure. But the more the strong phones you give out, the higher the chance of misuse or mishandling. You will now have a black market for secure phones, giving them out to criminals. You will now have people with strong phones having a higher right of privacy, giving them more protection against the state itself.

    Now let’s add more factors. Someone loses their stronger phone. We now have a potentially untraceable strong phone. The government is losing control over those. Now you have 5 different tiers of secure phones. But people are people and the more complicated, the more things can go wrong. Now let’s add in slightly more authoritarian states like Hungary. There’s a good chance they will instantly start spying on journalists. Or give opposition parties the weaker phones by accident.

    Now add in foreign agencies. China’s digital government agencies are very efficient. Imagine they get the keys to the weaker phones. Great, now China can effectively monitor 99% of the EU. And now even if an EU member has a strong phone, they just listen in his wife’s phone, and they get the information anyway. Now what about if a spy from North Korea gets the keys and starts finding bank information on the stronger phones? They now have new super annoying ways of stealing billions of dollars from the EU and covertly as well if they do it right.

    As you can see, making some people’s security weaker on purpose is a lose lose game. It never works. There’s way too many cooks in the kitchen in the EU for this kind of stuff to stay in line, and there WILL be misuse, one way or the other.






  • Famous enough that there’s a steady fan base listening to my music (a thousand people internationally sounds great to me) but nothing more than that. I want that genuine fandom, where people actually enjoy being in a niche and no one stalks you and generally people don’t know you wherever you go.

    Not even for the money, but just to feel appreciated and to know I have a positive impact on people, that’s all I want.

    If it’s only the two extremes? Yeah I’m totally cool with a quiet life.