I immediately emptied my account with BBVA (a major bank with $37B yearly revenue) after their app asked me to validate my identity by entering "the fourth character of your password". Subsequent attempts asked for different ordinals. This was in 2023.

That just means the hash is effectively the real password. If an attacker gets a hold of the hash that you transmitted, they can use that to authenticate to the server.

All that you gain by transmitting the hash, is that the attacker will need to modify the client's request to inject the stolen hash.

If the client (website or app) runs on the attacker's own devices, this is trivial. I suppose it is a valid obstacle if we are talking about an ATM or similar locked-down client.

Don't store the hash the client sent you. Hash the hash on the server side.

Which makes the hash the password and the hash of the hash the hash. You achieved nothing. If you truely don’t want to send the password, there are of course ways. But it’s a heck of a lot more complicated than this and no one is doing any of it because… Passkeys is what you end up with.

You can (and should) do the same with passkeys. Like SSH keys, they're just text.

Save a passkey in Bitwarden, then export your vault as JSON. You'll see a nice plain text JSON block with your passkey that you can print, or backup, or import into whatever replaces Bitwarden.

Bitwarden browser extension, and I imagine most other password managers, will only offer to auto-fill a password if the site matches. There's a setting to choose the exact rule, but the default is matching the domain name.

So if you get sent to goog1e.com, your password manager won't prompt you to enter your Google passwords. Though of course, you could still manually paste it in if you got somehow convinced that it's a legit site.

> Some people here are defending Mullvad's political position.

It is not Mullvad's political position. It is the political position of one of its co-founders, using his own money. The other co-founder openly disagrees with that position.

Personally, I feel _much_ better about relying on a company whose two co-CEOs have diametrically opposed political stance, than I would about a company with a singular one.

> It is not Mullvad's political position. It is the political position of one of its co-founders, using his own money.

And where do you think "his own money" comes from? Mullvad.

Are you using a VPN? Youtube will be a jerk to those IPs. I need to set my exit node to either Poland or Albania to watch YT. (The latter incidentally is supposed to act as an ad-blocker due to local legislation banning some types of ads, but I have my own ad-blockers so I cannot confirm.)

No. The simple relay thing only works if you can trust that they aren't comparing notes. But if I could trust them not to do so, I would already trust them when they say that they do not log your identity.

ZKPs allow you to be the relay between Chase and Pornhub, and you know exactly which data is shared between the two. Chase would obviously have no idea whether you used the certificate for Pornhub or anything else; and Pornhub will know that their request was validated by _a_ trusted ID provider, but not necessarily which particular one out of a group (issuer-hidden ZKPs).

I think it's just a pretty consolidated space? Kind of like ebook management, which was dominated by Calibre for so many years (this changed recently).

But unlike ebooks, media centre management is a fair bit more complex since it involves supporting many different media formats and many forms of acceleration or transcoding.

So the big projects - Kodi for local media and Jellyfin for streaming - have a lot of inertia because they tend to support whatever you throw at them.

What did the ebook space change into?

> Why not switch it around?

Because a malicious human will gladly copy/paste LLM text and sign it with his "I, a human, definitely wrote this academic paper" key?

Fair point, for text it is far harder to prevent signatures being applied to generated text vs images at the moment of capture and most approaches I can come up with to remedy this can either be bypassed (edit histories can be output by models similar to humans) or will be controversial. Taking a page out of the anti-cheat textbook, mainly written for gaming, there are methods which might hold in the medium term. Less a fan of kernel level myself, though it might be worth exploring as there has been massive investment by the games industry into making it somewhat robust, but the approach Valve has taken with VACnet could be an inspiration worth exploring that is less invasive into peoples systems. Keystroke analysis, etc. could be relied upon as a basis for signatures, harder to spoof for current day LLMs over generating edit histories.

I will fully admit that at a point in the future, maybe not too soon, models may be trained to bypass that too, at which point we are back where we started. As a skeptic of the extend that capabilities are emergent in LLMs vs specific to training data, I am somewhat hopeful that unless models are specifically trained for evading such human detection solutions, they'd struggle to do so, but it could still end up as a byproduct of improved, lower latency computer use focused training. Not emergent as the term is used in regard to models because that is still output performance improvements clearly traceable to very specific training data, but incidental as the goal of said training data was not to bypass.

For what it's worth, I find human authorship being verifiable to simply be the more crucial problem over watermarking model output, so if research is to focus on one, I'd rather it the former. Maybe both signing human authored content and watermarking LLM output are both only possible in the near term, I hope not but fear it that might be the case. If so, we as a society will have some major challenges ahead (beyond all the ones we'd have anyways).

Alternatively, we could also just start scanning everyones eyeballs...

I've been thinking for a while that all of this is just trying to grasp tighter the last bits of sand escaping between our fingers. The end game, perhaps, is trust. Do you trust or know the source? If you don't, assume it was AI generated. If you do, accept it as authentic based on whatever they disclose, but know that it's possible they aren't being totally honest or were themselves fooled in some way, depending on the context.

Then build our assumptions and how we operate around those trust levels in the digital realm.

Well, the end game is that AI is better at thinking us, and having a human brain involved is a net negative. The goal is to let the AI do the toil if thinking for us, and we can get the rewards.

I tried to switch to nushell full-time but couldn't stick with it.

Ironically, the main friction point were not old-fashioned tools (which `from ssv` usually handled nicely) but the 'new generation' of core CLI tools like eza or fzf. They have really nice visualizations, but they do not output structured data as a middle step, so all the colours and lines only play havoc with nu's parsing.

Since I need to "ls" a lot more often than I need to do data manipulation, the tools won and I went back to zsh. Still keep nu around for the occasional config/data file wrangling though.