• 6 Posts
Joined 3 years ago
Cake day: January 21st, 2021


  • Prom is fun. You get to hang out with all of your classmates, ask someone out. A subset of people are always going to go overboard, but keep in mind that you don’t see the “normal” cases. Most people just walk up to someone and ask them out. They find a date from the school or go alone.

    I’m from Canada so I don’t know if the US is wildly different, but here it is a bit of a big deal, but I think part of that is what makes it fun, you sort of build a bit of hype around what would otherwise be just another school dance.

  • Yeah, that is what I meant by “strength of the hash”. Probably should have been more clear. Basically the amount of resources it takes to calculate the hash will have to be spent by the attacker for each guess they make. So if it takes 1s and 100MiB of RAM to decrypt your disk it will take the attacker roughly 1s and 100MiB of RAM for each guess. (Of course CPUs will get faster and RAM will get cheaper, but you can make conservative estimates for how long you need your password to be secure.)

  • It is a good technique to be sure, but I haven’t found it useful in my everyday life. In practice 99% of my passwords are stored in my password manager. I only remember like 3 passwords myself. For those I want them to be easy to type as I do it semi-regularly (whenever I turn on my computer or phone, my phone sometimes re-verifies, …). These may be slightly easier to remember but end up being much longer. I find that I don’t have issues remembering the 3 passwords that I actually regularly type.

    In fact I recently switched my computer passwords to be all lowercase, just to make it easier to type. I’ve offset this reduced entropy by making them longer (basically shift+key is similar entropy to key+key and easier to type, especially on phones or on-screen keyboards).

    The recommended 6 words produces incredibly strong passwords. The equivalent with all lowercase would be 16.5 characters. Personally I went for 14 characters and in my threat model that is very very secure. But this will also depend on your attack model. If it is a disk encryption password or other case where you expect that the attacker can get the hash then it will depend on the strength of the hash and possible attacker’s computing power. If it is protected by a HSM that you trust you can get away with short PINs because they have strict rate limits. Any decent online service should also have login rate limits reducing required entropy (unless the leak the hash without resetting passwords, then see the above point where the attacker gets the hash). All of my memorized passwords fall into the category of needing very strong security but I still found that remembering a random character password that only only took about a week when entering it once a day.

  • Technically yes. But the method is by far strong enough that this isn’t an issue. This is sort of always the issue with calculating entropy. We say that password has less entropy than 8(A>Ni'[. But that is baking in assumptions about the search space. If password is a randomly generated string of lower, upper, numbers and symbols it is just as secure as the latter. (808 ≈ 1015 candidates) but if password was generated as just lowercase characters it is far less secure (268 ≈ 1011 candidates) but if it was a random dictionary word it is not very secure at all (≈ 105 candidates) and if it was chosen as one of the most popular passwords it is even less secure. How can one password have different entropy?

    The answer is basically it matters how the attacker searches. But in practice the attacker will search the more likely smaller sets first, then expand to the larger. So the added time to search the smaller sets is effectively negligible.

    What may be more useful is the “worst case” entropy. Basically the attacker knows exactly what set you picked. For the password case that is 1 because I just picked the most common password. For the rolling method described above it is 65^6 ≈ 1023 because even if they know the word list they don’t know the rolls. You may be able to go slightly higher by building your own word list, but the gains will probably be fairly small and you would likely get far more value just by rolling one more word on the existing list than spending the time to generate your own.

  • I don’t know why everyone is so negative. The gameplan seems pretty clear to me.

    1. Make expensive fancy product. This is effectively a “devkit” that companies can use to start experimenting with AR software.
    2. Make lower cost product. There are now a few decent apps available and early adopters will be willing to buy it to be one the leading edge.
    3. Now there is a bigger market, leading more companies to be willing to develop apps.

    Apple is hoping that this is enough to break the chicken-and-egg cycle. Enough to get a few powerful apps such that more regular consumers will be willing to buy which again increases the addressable market which makes it more attractive to companies.

  • I am a touch screen enjoyer. At least in theory. I like having time to browse, look at pictures, easy access to customization options and most importantly no feeling of pressure. I am not spending a cashier’s time and potentially blocking someone behind me (at least there is usually less of a line for the self-ordering).

    However there are negatives for sure. My biggest annoyance is that these devices are often annoyingly slow and unresponsive. They just display a tiny bit of text and images, they should switch between screens at 60fps, not 2s per click. Also if I know what I want it is often faster to tell the cashier and let them enter the order (on their more expert-optimized and less laggy keypad).

  • I don’t know about YouTube but the chunks are often a fixed length. For example 1 or 2 seconds. So as long as the ad itself is an even number of seconds (which YouTube can require, or just pad the add to the nearest second) so there is no concrete difference between the 1s “content” chunks vs the 1s “ad” chunks.

    If you are trying to predict the ad chunks you are probably better off doing things like detecting sudden loudness changes, different colour tones or similar. But this will always be imperfect as these could just be scene changes that happened to be chunk aligned in the content.