arnarbi

Joined 14 years ago

Karma
1,547
Submissions
485
Member since
Apr 30
Icelandic. SWE @ Google. Security, authentication, authorization. Work on WebAuthn, FIDO & passkeys.

[ my public key: https://keybase.io/arnar; my proof: https://keybase.io/arnar/sigs/lf4Zbpd04PZPXu_eZyGhPVoef2BuJ0p5VUuzV8ZXD4I ]

View on Hacker News

Recent submissions

Comment · 26 days ago
Very cool. Is it controlling the plugs via direct Bluetooth connection? Or zigbee via a hub, or wifi (direct or via service)?

I always assumed, probably incorrectly, that there would be too much jitter in the actual timing so I had built a few prototypes of e.g. an esp8266 controlled relay, where you would give the MCU a duration rather than separate on/off commands. But I guess that was wildly over-optimizing. In your case, how stable is the delay from the app sending a command until the switch operates?

I'd add voice mode for color printing in total darkness.

Comment · 2 months ago
Nordic nod of approval
Comment · 3 months ago
I think it’s a little different.

The restaurant fee isn’t a fee for something “extra”, it’s just a blanket extra charge on everything.

It’d be like the airline sold you a ticket for $500, but as you step off the plane at the destination they say “actually it was $550”, because it said so in the fine print.

Comment · 3 months ago
Comment · 5 months ago
Scorched Earth was also my first hacking target. Found out that your cash balance and weapons inventory was all stored in a mysterious .ini file and you could just edit it.
Comment · 6 months ago
Best "friendmaker" hobby I know is sailing.

It's in general a very newcomer friendly hobby, which is both important as a newcomer yourself as well as for meeting new people once you are into it. It's naturally collaborative so you have to communicate, not very intense so there's a good amount of chill time, and in the cases where small-talk doesn't turn up interesting topics you can always talk about sailing itself.

Comment · 7 months ago
It's more like workers on a large oil tanker using bicycles to move around it, rather than trying to use another oil tanker.
Comment · 8 months ago
> why they're attributed to AI?

I don’t think they mean scrapers necessarily driven by LLMs, but scrapers collecting data to train LLMs.

Comment · 1 year ago
We did not, no. Just wrote up the report and moved on.
Comment · 1 year ago
Back in college (~2008) we implemented this with a 7 foot tall back-projected screen and a couple of Wii remotes after seeing Johnny Lee’s video. The nice thing with that screen was that you could stand so close to it you couldn’t really see the edges.

We had as many people come test as we could, and we found that 90% of them didn’t get a sense of depth, likely because it lacked stereo-vision cues. It only worked for folks with some form of monocular vision, incl myself, who were used to relying primarily on other cues like parallax.

Comment · 1 year ago
It is not based on TB but it is heavily informed by those efforts. See here: https://github.com/w3c/webappsec-dbsc#what-makes-device-boun...

However, DBSC as an API and protocol is similarly agnostic about key storage. There is no attestation and the User Agent is fully responsible for selecting key storage that provides the best protection.

Comment · 1 year ago
Comment · 1 year ago
Services can certainly make this safer by providing means to get more restricted credentials, so that users can deputize semi-trusted delegates, such as agents vulnerable to injection.

The important point being made in this discussion is that this is already a common thing with OAuth, but mostly unheard of with web sessions and cookies.

Comment · 1 year ago
Comment · 1 year ago
This is a very good point, and one the DBSC team thinks about a lot.

In the short term it's about economics: Infostealer malware today scales really well because it can a) exfiltrate cookies quickly and clean it self up, mostly evading any client based detection, and b) sit on large stashes of long-lived cookies and carefully "cash them in" in ways that evade server side detections.

A short-lived cookie forces different behavior for b, which we think will make it more detectable server side, and binding in general will force malware to act more locally, which will make it (far) more detectable locally.

In the long term, DBSC also is designed so that the session management and key registration is somewhat decoupled from that short-term cookie business. If and when we can sign more often (perhaps every request), I believe the DBSC API will still be useful for websites to manage the session key and lifetime.

Live from the official Hacker News API

A modern reader for Hacker News · SvelteKit + Skeleton