• 4 Posts
  • 357 Comments
Joined 1 year ago
cake
Cake day: September 25th, 2025

help-circle
  • I mean it depends on how many other people have the same fingerprint as you. It’s much more complex for the same browser on the same device to randomize the fingerprint but still allow most sites to actually work. If it gives unsupported resolutions, audio codecs, etc., then sites will break or at best be really harder to use. The idea is to make you look the same as everyone else rather than unique. It’s a balance between making you less unique and making more sites work properly. Without knowing how common that fingerprint hash is, it’s hard to say if it’s working. And a lot of things like disabling JavaScript or webgl to protect yourself from threats or setting your time zone to UTC-0 tend to just make you more unique since few people use those settings, or live in that time zone.





  • You’d be surprised how poorly most modern web developers (especially LLMs) understand cryptography and the importance of protecting secrets, often storing them in plain text in poorly protected code repos, etc. On a site with a large enough user base and access to that information, it’s absolutely possible to reduce the number of tries to hits to a manageable level for a distributed botnet that can’t easily be blocked.


  • You’d be surprised how poorly most modern web developers (especially LLMs) understand cryptography and the importance of protecting secrets, often storing them in plain text in poorly protected code repos, etc. On a site with a large enough user base and access to that information, it’s absolutely possible to reduce the number of tries to hits to a manageable level for a distributed botnet that can’t easily be blocked.


  • Problem is passkey generation, expiration logic, etc., is often not well protected, so if a hacker is able to get it, they may not be able to target a specific account, but they can target random accounts with semi-bruteforce since there’s no username to limit tries against or lock the account if there’s too many tries. Just use a botnet and start throwing probable keys at it and you’re likely to get a few.

    Also, with a password repository, I protect that as exceptionally as I can, but I can always change my passwords and would do so of that was compromised. But I’m not talking about the passkeys of an individual being stolen, I’m talking about a compromised site having very little way of determining of a hacker has gotten enough information to narrow brute forcing down to a relatively manageable level with a botnet and using that to access random accounts for personal information scraping. And the user may have no idea it’s happened to them since the bad tries never were associated with any login.


  • I’ve always thought they were a really bad idea. It puts everything into a “setting you have” factor and removes the "something you know as well as the need to match the factor to a username. And if the site is hacked, they can get a lot of information about how the passkeys are generated even if they don’t get access to secure info. It just simplifies the ability to hack a random account in many ways if not a specific one.



  • Sure, it’s no change for self hosters currently, but it’s one more step in moving towards a more closed platform overall. I do hope more FOSS client apps end up getting made sometime soon. I’ve been using Keyguard on Android for some time, which means the recent several breaking changes in the Bitwarden apps to the Vaultwarden backend haven’t hit me as hard, but I do still use the official apps for my laptop and desktop and Keyguard isnt fully FOSS, of course. I’d love to see some forks or brand new apps one of these days that are actually fully FOSS for both mobile and browsers. I’ve thought about doing some myself, but I have too many other projects and I also don’t have a MAC or want to pay the fees to make an iPhone version. And I abandoned my Android Developer account when they started the identity nonsense, so none of my apps are on the official store anymore and Fdroid and similar may not be viable soon, so it would only really be for myself and a few others who use alternate Android OS’s.





  • Yeah, but one of the main ways a city can drive revenue is to increase the cost of property. Fines like that are small and short lived. Plus the people they’re targeting are unlikely to ever be able to afford to pay them. It’s not like speeding, red light, parking, or HOV tickets where rich people just consider it pocket change and just the cost of having a car and so they don’t change their behavior like poorer people might. So revenue is often steady. Plus targeting neighborhoods of fixed assets that most people will never actually even see is way different from targeting vehicles that could belong to people outside the community and generally people keep a little nicer since they are much more publicly visible. It’s much more obvious who is forced made to pay, and it’s much more obvious those people can’t and so there won’t be revenue, only an excuse to arrest, evict, or whatever other punishment the law allows when people accrue too much debt from the fines.

    And property taxes are the primary tax revenue in Texas since there’s no state or local income tax and relatively lower sales taxes. I lived there for a while and the property taxes were nearly as much as the property I now own in another state that is valued at about 8 times as much.


  • I mean it’s obvious it’s to make it too expensive for people who purchased the poorly maintained housing they could afford to be able to afford to keep it and make way for real estate investors to keep the housing vacant for profit or developers and gentrification. My neighborhood has so much vacant property owned by investors, though most of it is the opposite, too expensive for a regular person to own and live in and it keeps the supply low and thus prices artificially high for people who need housing. If they can keep people out of the poor neighborhoods, too, then prices will skyrocket as people have fewer options. Great way for capitalists to “fix” a real estate slump I guess.


  • Yeah, I mean there are glasses that already exist that are designed to be less obvious they have cameras on them, but they aren’t sold en masse to the general public that way. You can’t avoid it. And modding for illicit purposes is always going to be an issue with any technology. But the majority of people don’t have those skills and it will be more obvious to people once they know what to look for, if the light is removed or covered up. At least it would create a socially awkward situation for the majority, just like not aiming your phone camera around inside a changing room isn’t a major issue because people know where the camera is. Knowing an individual pair of glasses has a camera isn’t as easy as knowing all phones have one, so more of an indicator is needed. Of course there are still people who film in changing rooms with their phones, but it dissuades the casual from creeps doing it.



  • Jul@piefed.blahaj.zonetoPrivacy@lemmy.ml•GrapheneOS bugs
    link
    fedilink
    English
    arrow-up
    3
    ·
    15 days ago

    Not those issues, but I think there are some performance issues. On my Pixel 10 Pro I’m seeing a lot of apps with screen flickering issues. I turned down the screen resolution and killed a few apps with the force stop option and this seems to have resolved it temporarily.

    The most annoying issues were in the Transit app which works way better than Google Maps for transit navigation in my city and another city I’m currently visiting. Also noticed it in Finch and a couple of games. I’ve seen it before in GrapheneOS, but never this bad or even at all on this particular device.


  • The problem has very little to do with Chinese Imports. The car companies all over the world are already collecting a ton of data. For example, there have already been many reports of how auto insurance companies in the US buy that data from multiple companies and use it to raise premiums for people who drive recklessly, among many other uses. Also, just having an always on transmitter in a car now makes it easy for companies like Flock to track your vehicle and that is explicitly for law enforcement, and their systems have already been proven to be easily hackable. If you think governments and malicious actors don’t also buy and/or steal that information, you aren’t paying attention.


  • TBF, JavaScript does allow for sites to be much more functional rather than requiring connecting to servers even for simple user interface updates, and it’s simpler to develop than some other, newer, technologies, but it also is the most commonly abused for tracking purposes since it has so much access to local data. I wish there were a way to allow local JavaScript to run, but block it from sending data or if browser makers would develop a comparable technology for manipulating the local page data/DOM that doesn’t have access to the internet. But that’s unlikely to happen since companies like Google, Microsoft, Apple, etc., have heavy influence on browser standards and rely heavily on monetizing tracking data.