He / They

  • 4 Posts
  • 494 Comments
Joined 1 year ago
cake
Cake day: June 16th, 2023

help-circle



  • When it’s being employed properly, it’s absolutely an important tool, but the way they’re presented to most users, such as on-device biometric data stores (e.g. Apple’s secure enclave, or a TPM verification), aren’t the proper implementations. Nor is using biometrics as your primary auth method.

    It’s supposed to be “something you have and something you know and something you are”, not “have or know or are”.

    NIST standards for biometrics require the biometric data be stored on a secure remote server, and that the scanner device check against that during auth. Putting the biometric data on the device means that you’re losing a big part of your non-repudiation.

    And it’s even worse when you’re using a secondary factor (biometric) as your primary or only factor (e.g. a phone unlock), that grants access to your other factors like password store and OTP tokens.

    Biometrics are never supposed to be a single-factor auth method when used properly, but that’s how most people use them now, and it degrades their security.

    If your phone requires a passcode, a TOTP grant, and a biometric scan, by all means, please do employ biometrics, but if it’s going to be your only factor, DO NOT.

    Or, for simplicity to the average forum reader:

    Never use biometrics. It’s just not worth the tradeoffs.





  • This reminds me of similar questions around both Atomic Heart and Hogwarts: Legacy, and I think there are a couple differences in both cases.

    In the case of Atomic Heart, part of the controversy was related to the sexualized robots that bear a traditional Ukranian hairstyle, and how subservient they are towards the player, as well as the way the USSR was depicted in general in the game. Taken together, a lot of people saw that as reflective of the current and common attitude of Ukraine being a subject state of Russia. So the monetary support for the devs were potentially directly benefiting people with questionable views.

    In the case of Hogwarts: Legacy, the connection to a bad actor is even more clear cut, wrt JKR. Abstaining from purchasing it was roundly discussed as a boycott of her and her views, even if she had minimal connection to the game itself (we know she did financially benefit from it, as she stated it herself on Xitter).

    I think this is one too many steps removed for me to condemn it in the same vein. Yes, Russia will benefit in tax revenue from it, but the studio isn’t state-owned or something; it’s no different than buying something made (in whole or part) in China giving tax money to the CCP to further Uighur genocide in Xinjiang, or tax money in the US going towards genocide in Gaza via military aid.

    I’m not saying you’re a hypocrite if you choose to not buy this but still pay US taxes, because ultimately the consequences that you face for those 2 actions is very different. I might say it’s hypocritical to buy Chinese goods though, given they are still trading with Russia and supplying them materials.

    Personally, I’m not going to treat all people as proxies for their government; that’s too close to collective punishment.




  • I never said afford to protect it, just to comply with the requirements for doing the checks and storing it. Passing SOC2 or PCI-DSS (if you’re doing verification via payment card) or whatever certification they decide to create to attest to this stuff, doesn’t make you more secure in reality, but if you can’t afford to do those attestations in the first place, you’re out of the game.

    This is just another way to ban “harmful” content.

    That is true, but it’s not the whole picture. KOSA applies a Duty of Care requirement for all sites, whether they intend to have adult (or “harmful”) content or not.

    So your local daycare’s website that has a comment section could be (under the Senate version that has no business size limits) taken to court if someone posts something “harmful”. That’s not something they or other small sites can afford, so those sites will either remove all UGC or shutter, rather than face that legal liability.

    The real goal of KOSA (and the reason it’s being backed by Xitter, Snap, and Microsoft) is to kill off smaller platforms entirely, to force everyone into their ecosystems. And they’re willing to go along with the right-wing censorship nuts to do it. This is a move by big-tech in partnership with the Right, because totalitarianism is a political monopoly, and companies love monopolies.



  • This is a tough and complex issue, because tech companies using algorithmic curation and control mechanisms to influence kids and adults is a real, truly dangerous issue. But it’s getting torn at from all sides to force their own agendas.

    Allowing large corporations to control and influence our social interactions is a hugely dangerous precedent. Apple and Google and huge telcos may be involved in delivering your text messages, but they don’t curate or moderate them, nor do they send you texts from other people based on how they want you to feel about an issue, or to sell you products. On social media, companies do.

    But you’ve got right-wingers clamoring to strip companies from liability protections from user-generated content, which does not address the issue, and is all about allowing the government to dictate what content is acceptable from a political standpoint (because LGBTQ+ content is harmful /s and they want companies to censor it).

    And you’ve got neolibs and some extremely misguided progressives pushing for sites that allow UGC (which is by definition all social media) to have to check ages of their users by implementing ID checks (which also of course treats any adults without an accepted form of ID as children), which just massively benefits large companies who can afford the security infra to do those checks and store that data, and kills small and medium platforms, all while creating name-and-face tracking of peoples’ online activities, and legally mandating we turn over more personal data to corporations…

    …and still doesn’t address the issue of corporations exerting influence algorithmically.

    tl;dr the US is a corporatist hellscape where 90% of politicians serve corporations either willfully, or are trivially manipulated to.

    PS: KOSA just advanced out of committee.






  • I think the first game did a better job of making the player feel like they were starting at 0, and working upwards from there, which is my preferred RPG progression.

    In 2 I sort of felt like I was already a badass from the start. Might have just been my perception, but I remember in 1 finding the harpies scary and challenging when you’re escorting the ophidian head on the cart to the capital. In 2, you run into a bunch of harpies right after the first camp, and they were just like nothing.