CyberRage

some information can be viable for longer than that, there are some extreme cases where 2~3 minutes would not suffice

what is your point exactly?

really bizarre response, if you don't have something good to say, don't.

IMO good algorithms can only get you so far, even if you use modern high resistance hashing if your user uses 'password1234' it will be cracked, as computation power grows we need to use stronger and stronger passwords, this is a losing game especially for the average Joe.

Modern solutions move away from passwords to MFA and/or digital/physical tokens which there we can control the security level with high precision.

Users are the weakest link as the author stated.

pointless because these modern algorithms support "Adaptable work factor" what it means is that you can control computational work to your likings

you can set the option to compute a billion rounds for each password.

I specifically didn't mention WebAuth...

U2F(Yubikeys utilize it) and TOTP are both great options.

even push to login is quite common these days.

You have great options.

Passwords are simple to implement and easy for users to adopt

For a long time security wasn't a top priority for many companies if we are frank about this.

Today we have standardized implementations and guidelines, we have many additional options like TOTP or U2F which are pretty robust.

Nowadays if someone wants to implement good user identity/authentication they can.

Seems like a rant to me.

Passwords are used because they are convenient and intuitive.

Once you use a 'password manager' you basically have a glorified key generator/storer

We already have so many alternatives from GPG keys to FIDO/FIDO2 solutions

Security isn't always the first priority when running a website/app, it is the sad but honest truth(coming from security expert with over a decade of experience)

It is not because:

1. TOTP is time based, after 30 seconds it means absolutely nothing, you cannot recreate the 'secret key' from that number

2. with TOTP everything is well-known. TOTP will usually generate a 6 digit 'secret', this makes managing it very predictable:

6 digits = 1,000,000 options(including all zeros) we can easily calculate a good security margin

like: 5 attempt - 5/1,000,000 = 0.000005% chance of success Very predictable security margin

for passwords it's a huge unknown, it entirely depends on the user password quality

There is one incorrect statemement that really bothered me

TOTP and passwords are not the 'similar' because TOTP is a secret generated from the 'key' and is only valid for a short time period

this make usage of that secret vastly more challenging for attackers, especially at scale.

I've seen real attacks where passwords are stolen, it is impossible to keep track of that. However for TOTP since the attacker has to login NOW, you can very easily detect anomalies of a new IP addr with many successful logins for different accounts

Or to put it differently, when you capture a password it is always valid credential but for TOTP, it requires more advanced infrastructure(automatic logins, save tokens)

and even then the token will eventually expire, with password you can generate infinite tokens

I see a ton of linux malware as part of my job but it's a different kind to windows malware(which I also reverse/research) in Linux the focus is on server/enterprise so things like webshells, miners, data scraping are very common

Vast majority of malware doesn't use any exploits, let alone something like a zero-day

Most of malware, logically, abuse common features within the operating system

same is true for windows... zero day exploits are hard and get patched rather quickly in all major operating systems

It is always the abuse of legitimate features which are the problem

'this is not true in numerics' - shows no evidence...

GPUs are gaining traction in FP workloads, it can be seen clearly with CPU/GPU data-center market share

Moore's law is pretty much over, we can't simply print more performance these days, we are going to see major shift to accelerators which would require some rewrites, otherwise you're going to be stuck

Honestly HPC moved to GPUs for most of the heavy FP compute

for CPUs INT perf is king, even in HPC/enterprise

heavily depends on the workload

Some workloads can be accelerated via AVX-512 as shown here by Anandtech:

https://www.anandtech.com/show/17601/intel-core-i9-13900k-an...

See how AMD CPUs with AVX-512 enabled some a massive boost even with similar/less cores

I would agree that most typical workloads don't benefit much from AVX-512, it requires software support and good use-case(wide parallel SIMD)

quite a bit actually

making two displays work properly with correct aspect ratio and refresh rate

buggy UI components that needed restart from terminal

Many features aren't fully accessible from the UI AFAIK

I actually tend to interact with Linux machine mostly via terminal because UI is so unreliable from my experience

If there's one thing that Linux does very poorly IMO, it is GUI (technically desktop environments but you get the point)

Honestly, I can't see how GNU-Linux is going to ever replace something like Windows.

The core issue is that Linux wasn't designed around regular consumers but rather around pros/techies

This is why Android or even ChromeOS were able to penetrate consumer markets far more while being based on the same Linux kernel

Google prioritized easy, intuitive UI that any person can pick up easily without any prior knowledge

no terminal commands, no need to understand file-systems, no config-changes, no debugging errors

Apple has proved this is as crucial as the quality of the kernel/OS itself

"from an unprotected template" do you even read? stop trying to find some random internet page to justify yourself, have you ever seen a biometric implementation? I have.

Really? can you back this up? I can. I work in the cyber industry for a decade now. I've seen the data, I've seen attempt to bypass both. Biometrics are by far better for the vast vast majority of people.

Do you even listen to what you're describing here? trailing someone, trying to extract fingerprints? this isn't a Jame Bond movie.

Cyber attacks are common because they are completely digital\anonymous by nature.

Secondly, humans can't remember\generate truly secure passwords, unique for every account they own. they usually rely on a tool like a password manager.

PM are definitely better than weak passwords but are actually weaker than biometrics. they are a central point of failure and have been attacked in the past.

For the average Joe, biometrics are more secure since he is not using such tool anyways.

Well it depends on how you define replicate, I'm not aware of a technology that can perfectly recreate someone's face\fingerprint.

a photo\mask isn't perfect and actually in some instances they fail to work vs sensors because of that.

It is more of a question of how robust is the authentication method.(can a photo\mask fool it? which can happen sometime but usually require pretty high quality sample)

I don't get the point... If someone steals your fingerprint, he stole your fingerprint.

As I explained you can't get the fingerprint from the device\key, it is simply not there.

This isn't the problem of the implementation\technology if someone stole your fingerprint. it didn't lead to your biometrics compromised

What's easier to do? stealing someone's fingerprint or cracking\guessing their password.

Definitely the latter.

That's governments for you(btw not only CA but other places as well) I would definitely be more worried about that than my biometrics on my phone.

Let me follow up and say. why do people go nuts over biometrics?

Password based biometrics is the last place I would look at for biometric compromise.

We leave biometric traces everywhere, all the time. do you cover your face and wear gloves in public? hmmmm...

But they are... Firstly, with how it works. even if you use the same finger to generate hundreds of keys, they should all be different because we are using noise\randomness within the algorithm itself. different sensors will generate different outputs and therefore it is pointless to worry about the key used stolen.

I think what you want is secret keys completely detached from the user. we have that as well with hardware tokens.

I mean you don't have to give it away if you think Google is storing databases of fingerprints for the lizard masters to track you down.

FIDO simply wants to make authentication stronger, you can use hardware keys that have a key burnt into them which is unique and much harder to brute-force than passwords.

Again according to how biometrics are described in whitepapers\industry, we extract features from the fingerprint\face sometimes very little compared to the actual biometric and use it to derive a key. that key cannot be reversed to get the original features and different algorithms use different features.

Oh gosh... your raw bio-metrics are never stored anywhere...

The signal from the sensor is used as a "seed" to generate key using robust cryptography

Different sensors will output different "data" based on the sensor type.

how FIDO has anything to do with google in particular? log in with google is not FIDO authentication...

From a theoretical point of view or practical?

Username is simply an ID. Password is how we truly verify who the user is.

Bio-metrics are just convenient because they are unique and hard\impossible to replicate.

MITRE has published their latest Attack evaluation with all leading security vendors tested against two simulated APT groups.

The evaluation tested both detection and prevention capabilities

Well considering CATL is launching commercial sodium-ion batteries. I would tend to think otherwise.

There's also other interesting investments in air breathing cathode batteries.