Create accountLogin

Recent searches

No recent searches

Search options

Only available when logged in.
toad.social is one of the many independent Mastodon servers you can use to participate in the fediverse.
Mastodon server operated by David Troy, a tech pioneer and investigative journalist addressing threats to democracy. Thoughtful participation and discussion welcome.

Administered by:

Server stats:

335
active users

toad.social: AboutProfiles directoryPrivacy policy

Mastodon: AboutGet the appKeyboard shortcutsView source codev4.3.7

#Immature

0 posts0 participants0 posts today
Public *
Inside the Red Head's Head

Hand Basket

My current audiobook is making me feel like an immature child and it is giving me the giggles.

I am listening to Recursion by Blake Crouch. I’m about 2/3 of the way through and I am really digging it. I keep thinking I know where it’s going and then it curves off to someplace totally unexpected. That’s not what this post is about though.

This post is about how I am a nine year old goofball. One of the characters is named Helena. Every time one of the two readers says the character’s name I insert the words hand basket immediately after it.

Helena (hand basket) said hello.

Helena (hand basket) did something.

Every time I do it I feel like I am going to giggle. What a goof. Sometimes I think that I am going to stop it and I do… briefly. I stop inserting hand basket but instead I insert the word bucket.

Helena (bucket) walked down the hall.

Helena (bucket) opened the door.

Yeah, I am a child. A goofy, lame, immature child.

#audiobooks#books#childish
Replied in thread
Public *
Erik van Straten

@ryanrowcliffe : thanks for your kind response.

I fully agree that if software (instead of the user) checks the website name (domain name) before submitting *any* credentials, is a perfect solution for most of the "fake site" attacks (except infosec.exchange/@ErikvanStrat).

Unfortunately passkey implementations are insufficiently mature for the masses (I'm not talking about my *personal* situation). And I do like passkeys, but they must work flawlessly before I'm going to advise anyone to use them.

People who never used a pw manager will *not* install one to use passkeys. On their tablets and smartphones (marktshare increasing) they'll use Apple's or Google's.

During my research I found at least three ways to fully unexpectedly lose access to part or all of one's Android passkeys:

1) The unexplicable and fearsome Android screen reading "Your encrypted data is locked on this device" (Google it or see infosec.exchange/@ErikvanStrat) when trying to use passkeys. This is a long time bug that, afaik, has not been fixed.

2) For privacy reasons, setting up a passphrase for Chrome sync is a good idea. However, if you ever want to change or remove that passphrase, Google directs you to the bottom of chrome.google.com/sync (see the screenshot below). Tapping "Delete data" will delete ALL of your passkeys (on all your Android devices) without warning. Note: this text notably is the "fix" made by Adam Langley in response to my post to seclists.org/fulldisclosure/20 (after wasting a long time after my bugreports to the Google and Chrome team): before it read "This won't delete any data from your devices".

Note: it appears to be a misconception that passkeys are synced from your device(s) to the cloud. They're cloud-based and sync to your devices. Google stores the encryption keys and, afaik, generates them on their servers. Furthermore, bugsolving is hampered by the fact that both Google and (separate) Chrome teams have to handle them.

3) If you have more than one Android device, you may run into the situation where your passkey's private keys are encrypted using *different* encryption keys. They will sync fine to other devices, but are unusable on them (see my FD post). I've not tested this for quite some time, so this issue may have been fixed (if Google did, they didn't bother to notify me).

Google online help is horrific: infosec.exchange/@ErikvanStrat.

Edited 12:10 UTC to add: a somewhat acceptable translation from Dutch to English of my writeup "Passkeys for laymen" can be seen by opening www-security-nl.translate.goog (it appears to work in Chrome, looks like a phishing link and has a certificate with a zillion of different domain names 🤔). The original article, in Dutch, can be seen in security.nl/posting/798699/Pas.

🧵1/2

@agl

Screenshot of the bottom of the page of https://chrome.google.com/sync in Chrome on Android (while logged in to my account). It reads: This will delete your Chrome data that has been saved in your Google Account. This might delete some data from your devices. This will also remove your sync passphrase. You can create a new passphrase. [button: Delete data] Synced: 17 minutes ago
#Passkeys#Immature#ImplementationFlaws
Public
Jonny Clark

My good deed for the day - releasing a young swallow that got lost indoors.
They’re getting in lots of practice in preparation for their migration to Africa but this one needs more work 😏
It’s a privilege to get this close to a wild bird 😎
It was none the worse for its indoor adventure 👍
#nature #NaturePhotography #wildlife #bird #birds #swallow #barnswallow #youngster #immature #rescue #release #wwt #WWTCastleEspie #CountyDown #NorthernIreland @RSPB

A bird in the hand
ExploreLive feeds
About