Personally I like Passkeys, and I enroll them in both my KeePassXC vault and on my two hardware keys (a primary Yubikey which I carry with me and a spare one at home).

It doesn’t absolve one from neglecting proper security best practices (don’t login on a system you don’t trust, logout / clear cookies when done, etc), but a Passkey on a hardware key is much more difficult to phish or extract if you’re using someone else’s computer.

Until they only allow specific AAGUIDs to enroll passkeys that don’t include the one used by KeePassXC (fdb141b2-5d84-443e-8a35-4698c205a502) or KeePassDX (eaecdef2-1c31-5634-8639-f1cbd9c00a08) because they don’t consider them secure enough.

https://aaguid.nicolasuter.ch/

If the game doesn’t a demo or a refund period, then I don’t see a problem with it.

lmao, that mod labelled you as a “reddit agent” when you’ve been on the fediverse for 3+ years and 5.69k comments 🤣

You’d have a better experience with using LUKS encryption on your live bootable environment.

Most private trackers have a point system where you accumulate points that you can exchange for upload credit, as a mean to provide an incentive to keep less popular torrents active.

That way you can build up your ratio without downloading stuff you don’t want.

BitTorrent is a good middle ground between decentralization, adoption and user-friendliness. I think the transport layer is pretty solid, and there’s no need to stick an anonymity layer at the protocol level, as the preferred method might change over time.

Combined with a VPN to handle the anonymity part, I think it’s solid and modular enough.

I like how some projects will allow free non-commercial use, but otherwise require a commercial license or an open-source maintenance fee to use commercially, like Inno Setup, WiX Toolset, etc. It’s honor-based with no real enforcement (so no dealing with serial number, or activation systems), it’s also not an outrageous amount of money and it keeps the project afloat.

It’s the only sensible strategy, don’t give them anything to look at.

Sounds like the joke was too subtle :(

damn that’s good

One way would be to generate a unique private key on the secure element / TPM and its public key stored on the server for validation. Each API request would need to be signed with a relatively short expiration time. That way the code never contains sensitive content such as an API key, an exploited device only holds in RAM a signed certificate that is valid for a short period of time, and the certificate can be revoked/blocklisted on the server if compromised.

I guess you could use a desktop and a virtual webcam if you switch the user-agent.

Yeah that part is bullshit…

Tell them it your own custom domain in Google Workspace.

¯\_(ツ)_/¯

I don’t see really anything of concerns that stands out

I wouldn’t mind if they also mirrored their videos on Nebula.

Targeted ads are once again not just a nuisance, but a security risk.

Hopefully it all point to a VPN IP address or Tor exit node lol.

Imagine how worse it would be if they were competent on top of it all.