eMGm4D0zgUAVXc7

Given that banks usually MUST validate their customers' identity card the opportunities for tracking your users with this must be superb.

I'd frankly prefer "insecure" user+pass over all of these guardrails which are 90% about control over the users and 10% about security.

> It's very hard to make a privacy case against FIDO.

With username and password, I have full control over my privacy in a very easy to understand fashion: If I randomly generate them I know I cannot be tracked (as long as I ensure my browser doesn't allow it by other means).

With those keys I have a opaque piece of hardware which transfers an opaque set of data to each website I use and I have NO idea what data that is because I do not manually type it in. I need to trust the hardware.

Sure, I could read the standard, but it very likely is complex enough that it is impossible to understand and trust for someone who has no crypto background.

And I also have no guarantee that the hardware obeys the standard. It might violate it in a way which makes tracking possible. Which is rather likely, because why else would big tech companies push this if it didn't benefit them in some way?

Source: The people who sell YubiKeys.

Do you only have 2-3 backups of your workstation?

I have much more backups of my workstation etc., should I now buy dozens of crypto hardware key thingies and constantly switch them around to match the backup disks?

For those who do offsite backups: Is an offsite backup possible across the Internet? Or do you have to physically drive the key to the offsite location?

When I create a new account somewhere, does that mean I have to move N backup keys out of their drawer to the workstation and register each of them on the account?

And how to even create a backup and keep it in sync?

With backup disks, it is a matter of shutting down the machine, removing one disk from the RAID1, and you have a backup (the removed disk is the backup). Or doing "dd if=..." if you don't use raid.

Is something as simple possible with those fancy crypto toys? Or is some arcane magic required to copy them?

Is this perhaps all as usual: An attempt to get more control and tracking of users, disguised as "security"?

If they try to print more Bitcoin by changing the software that does NOT automatically mean that the majority of Bitcoin users will install and run that modified software.

The non-"print more money" version will reject its blocks.

So even if they throw 90% of hashpower at it then it will not be the consensus because nobody uses a version of Bitcoin which accepts the blocks it mines.

> Not solved by the blockchain though..

Uhm, why not?

As far as I see, the price of Bitcoin has actually even hyperDEFLATED.

It started below $1! Now it is at $40000.

> I personally haven't seen any problem solved by the blockchain thus far.

Solved problem: Hyperinflation caused by excessive governmental money printing.

Yes, I know you may not consider this as a "problem", but tell that to the millions of people who have had to watch their life savings being erased to zero value.

Yes, the Bitcoin price may be jumpy, but we aren't yet seeing kids playing with bricks of trillions of Bitcoins because they'd be so worthless that you can give them to your kids as toys.

That DID happen with fiat currency:

Enter "hyperinflation" into your favorite picture search engine.

I personally own a 1 billion bill of a previous currency of my country which I bought for the equivalent of $5 on eBay.

Thanks, but why does the post show two screenshots juxtaposed:

- one labeled as "2FA Authenticator permissions disclosed on Google Play"

- and the other as "2FA Authenticator permissions requested"

They even made "disclosed" and "requested" bold to stress that there'd be a difference, and in fact the former list of permissions is shorter than the latter?

You said that some permissions are "ignored". Is that the explanation?

Where is a list of all Android permissions which are "ignored", i.e. not told to the user when installing apps?

From the screenshots it looks like the permission to install software is part of whats lacking to be disclosed.

That has a rather big security impact, why does Google ignore it?

I can't believe Android is that insecure :(

I am *very* surprised that the list of requested permissions on Google Play does *not* have to match the actual permissions which the app gets when installed.

I would have thought that the list on Google Play is computed from the binary so it cannot be fake.

Is it really true that you can just leave out permissions in this list and then just get them once people install your app?

What is the expected efficiency of this?

> The only viable response is to accept it's going to happen and have meaningful discussions elsewhere.

That is precisely why I said Hackernews is doing itself a disservice:

This makes people leave the site, like you just proved by suggesting it.

I'm not criticizing this particular submisssion but rather the fact that there is now *every* single day a thread where people hate on crypto.

What is the benefit for the community if a place which used to be about acquiring knowledge now spends their time on hating the same thing over and over again every day?