• 0 Posts
  • 31 Comments
Joined 1 year ago
cake
Cake day: August 17th, 2023

help-circle


  • It was also a relief of command, not a court martial, not non-judicial punishment, not a demotion or and not a punitive action. It happened because it affected the image of the force, but not necessarily anything that is terribly bad. Relieving someone of command can be a precaution or a temporary measure, not always leading up to anything drastic. He will probably get additional training and a small mark on his record that will go away in a short time as long as the trend doesn’t continue. He may even still get to keep his command or just move somewhere else to command.


  • In some instances of private/public key systems, this is done. It’s mainly for the purpose of ensuring the recipient knows who the sender was and also ensuring the sender knows who the recipient is.

    Quick primer: If you encrypt with your private key, everyone knows it was sent by you. If someone encrypts with your public key, they know you will receive it. Use your private key and someone’s public key together and you know only that person got it.

    In practice, lately another step is added to negotiate a third temporary/session key. This ensures keys aren’t used forever, and if compromised a new one can be generated. This is more secure than encrypting twice, because you never know what data is sensitive and picking the wrong one requires the attacker to start from scratch.


  • I used to exercise quite a lot, I know what the runners high feels like and how being sore and able to use motion and stretching to alleviate the soreness felt so good. I could easily lose myself when I exercised.

    I don’t get that anymore. I have bad joint pains, I never get that high feeling anymore, and everything is a distraction. I want to go back, but whatever happy chemicals used to work no longer do and what’s left over makes the whole endeavor feel the opposite.





  • Nothing stopped the person from calling road service to wire the car up, save for the fact that a child was involved.

    But there was. And ensuring the kid is safe takes top priority, and the last thing anyone wants to hear is another case of emergency responders dragging their feet while another kid dies. Smash your way safely into that car, THAT is what they are trained to do.

    Firefighters deal with a lot of shit and receive lots of training. I would argue that most firefighters know about the issues being laid out, and policy, not lack of knowledge, dictates a process to be carried out. I really don’t think this is a situation they should be vilified over if it saves lives.

    Edit: If it wasn’t clear, nobody is complaining about getting off work and finding out their car is dead, and having to call the fire department to show up with the jaws of life.










  • Close, but you are still trusting the device you own. If I were to compromise that device, I could capture that key and use it. Again, this is my limited understanding, but a zero trust solution works in such a way that the actual keys are not stored anywhere. During setup, new temporary keys are generated. A keypass binds to the temporary key for use of authentication. The temporary key can be revoked at any time for any reason, whether it’s due to a breach or routine policies. It can be as aggressive as it needs, and the implication is that if someone else (either you or an attacker) got issued a new temporary key then the other would not receive it. Using an incorrect temporary key would force an initialization again, using the actual keys that aren’t stored anywhere.

    The initialization process should be done in a high trust environment, ideally in person with many forms of vetting. But obviously this doesn’t take place online, so there is the risk that your device is not trusted. This is why the process falls back on other established processes, like 2FA, biometrics, or using another trusted device. How this is done is up to the organization and not too important.

    But don’t get too hooked on the nuances of passwords, keys, passkeys,etc. The entire purpose is to limit trust, so that if any part of the process is compromised, there is nothing of value to share.

    Disclosure: Worked in military and this seems to be a consumer implementation of public/private key systems using vector set algorithms that generate session keys, but without the specialized hardware. It’s obviously different, but has a lot of parallels, the idea in this case is that the hardware binds to the private/public keys and generates temporary session keys to each unique device it communicates with, and all devices can talk with members of it’s own vector set. Capturing a session key is useless as it’s constantly being updated, and the actual keys are stored on a loading device (which is subsequently destroyed afterwards, ensuring the actual key doesn’t exist anywhere and is non recoverable, but that’s another thing altogether). My understanding of passkey systems is solely based on this observation, and I have not actually implemented such a solution myself.


  • From my understanding it’s the concept of trust. Basic passwords are complete trust that both ends are who they say they are, on a device that is trusted, and passing the password over the wire is sufficient and nobody else tries to violate that trust. Different types of techniques over time have been designed to reduce that level of trust and at a fundamental level, passkeys are zero trust. This means you don’t even trust your own device (except during the initial setup) and the passkey you use can only be used on that particular device, by a particular user, with a particular provider, for a particular service, on their particular hardware…etc. If at any point trust is broken, authentication fails.

    Remember, this is ELI5, the whole thing is more complex. It’s all about trust. HOW this is done and what to do when it fails is way beyond EIL5. Again, this is from my own understanding, and the analogy of hardware passwords isn’t too far off.