Terence Eden’s Blog / is on Nostr

Regular blogging from Terence Eden (npub1x59…gect)

If you reply to these posts, your reply may appear as comments on my blog.

Blog: https://shkspr.mobi/blog/

Last Notes

2024-07-01 11:34:05

**Password Resets in an Age of MFA**
https://shkspr.mobi/blog/2024/07/password-resets-in-an-age-of-mfa/
Recently, WordPress got in contact with me to say they suspect that my password was exposed in some sort of data breach. Well, it's a day ending with a "y" - so of course some scumbag has pilfered my digital identity.
WordPress mandated that I change my password. But was that really necessary?
Firstly, the password was uniquely generated by my password manager<a href="#fn-51014-password" class="jetpack-footnote" title="Read footnote.">1</a>. It isn't re-used anywhere else. So there is no chance of hackers breaking in to my email, bank, or OnlyFans account<a href="#fn-51014-OF" class="jetpack-footnote" title="Read footnote.">2</a>.
Secondly, and more importantly, I have 2FA app which provides me with a TOTP code every time I want to log in. Even if the evil ne'erdowells have my username *and* password, they can't get in without the MFA code<a href="#fn-51014-2FA" class="jetpack-footnote" title="Read footnote.">3</a>.
So, should I change my password?
To understand this, it's worth considering the risks - both of action and inaction.
Changing a password isn't without risk.<li>Perhaps some long-forgotten app or service relies on that password. If I change it, what will break?</li><li>Do I trust my password manager to give me a strong password?</li><li>What if the original email is a phishing attempt and I end up giving the baddies my credentials?</li><li>Can I be bothered spending the time maintaining this old account?</li>
As for the risk of inaction.<li>Using my details, a miscreant might convince WordPress to disable MFA on my account. </li><li>If there was a breach, my MFA seed secret might also have been stolen.</li>
On balance… yeah, obviously I should change my password. It is a 30 second job with a decent password manager. But, I might argue, there isn't much *urgency* in doing so.<li>A strong and unique password means there is no risk of collateral damage to other accounts.</li><li>The use of MFA adds an extra layer of protection which buys you time.</li>
Thankfully, we've moved on from the outdated advice to [regularly change your password](https://www.ncsc.gov.uk/collection/passwords/updating-your-approach#PasswordGuidance:UpdatingYourApproach-Don'tenforceregularpasswordexpiry ). Now we only have to change them when there's been a breach. Which, coincidentally, is every 30 days…
The future ain't what it used to be!<li id="fn-51014-password">It was <code>w@&7%GUznK#9^}<S5</code> if you must know. <a href="#fnref-51014-password" title="Return to main content.">↩</a></li><li id="fn-51014-OF">Lots of weirdos want to buy videos of me recompiling Linux while in my pants. Who am I to judge? <a href="#fnref-51014-OF" title="Return to main content.">↩</a></li><li id="fn-51014-2FA">It is currently <code>194 685</code>. <a href="#fnref-51014-2FA" title="Return to main content.">↩</a></li>
https://shkspr.mobi/blog/2024/07/password-resets-in-an-age-of-mfa/
#2fa #CyberSecurity #MFA #passwords #totp

2024-06-30 11:34:23

**The complexity is the attraction - reflections on trying to use crypto**
https://shkspr.mobi/blog/2024/06/the-complexity-is-the-attraction-reflections-on-trying-to-use-crypto/
A few weeks ago, someone wanted to send me some crypto. After spending [months studying for a Blockchain exam](https://shkspr.mobi/blog/tag/certified-blockchain-professional/ ), I usually avoid such things. But, hey, $20 is $20.
So I signed up for a wallet, installed an extension, verified my credentials, saved a seed phrase, and - without too much technical fuss - had some crypto transferred to my account.
So far, so good. Compared to a traditional financial institution it had some advantages - there were no KYC checks or ID verification requirements. But the disadvantages were obvious - I had to install a different app on my phone and link it to my computer. The UI for the app and extension were awful. A huge amount of technical jargon was thrown my way - and there were dozens of technical pages to read through all stuffed with yet more jargon, memes, and insider jokes.
It felt sloppy and unprofessional. But, hey, $20 is $20.
Then I tried to withdraw the crypto into something useful. You know, money that I can use to buy goods and services. This, it turned out, was impossible.
I had to install a *different* extension. Then I had to decide which bridge to use. I popped into [Discord chat](https://shkspr.mobi/blog/2023/07/discord-is-not-documentation/ ) and said "Hey! I'm new! Which bridge should I use?"
The answer won't surprise anyone who has dealt with cryptocoins.
"[DYOR!](https://coinmarketcap.com/academy/article/what-does-dyor-mean )"
Here's the thing - I don't *want* to do any research. When I want to change money with Wise.com, I just click a button and the cash is converted.
One of the classic web design books is literally called "[Don't Make Me Think](https://amzn.to/45CWjXG )!" People are busy and tired and stressed and confused and just want their damned money.
I asked again "How do I judge which site is safe and which service I should use?"
The responses were filled with technical jargon, links to 3rd party sites, a list of acronyms, and assumed a huge amount of pre-existing knowledge. When I said "I've only just got started - how do I withdraw money?" I was told to watch a 3 hour YouTube video and / or install yet another extension.
That's when it struck me.
Cryptocurrencies are perfect for people who want to *feel* smart.
Some people like learning. That's great! But rather that learn something useful, they create ever more complex systems. They become the gatekeepers of rarefied knowledge. A lore so vast and tangled that they can smugly laugh at the smoothbrains who just don't get it. [HFSP!!](https://www.coingecko.com/learn/hfsp-in-crypto )
Right now, in the UK, I can send £0.01 to anyone for free. The transfer is instant. But, more importantly, it is *simple*. I don't need to learn anything. My friend sends me their account details, I click a button, paste their info, hit a button, and done.
I don't need to know how the underlying infrastructure works. I don't need to understand how the global financial system works. But, with crypto, I need to understand staking, gas fees, bridges, offramps, DeFi, and a dozen other things. This is stupid. It makes insiders feel smart because their have embraced the self-created complexity, and allows them to feel smug that normal people aren't as smart. That's it. That's why some people love crypto.
PayPal solved crypto's fundamental usability problems *decades* ago. Click here to send money to an email address. Done.
Fifteen years of cryptocurrencies and the usability is still dreadful. Why? Because the people running it are *addicted* to complexity.
https://shkspr.mobi/blog/2024/06/the-complexity-is-the-attraction-reflections-on-trying-to-use-crypto/
#bitcoin #blockchain #crypto

2024-06-25 11:34:08

**Who can reply?**
https://shkspr.mobi/blog/2024/06/who-can-reply/
Vague thoughts as they enter my brainbox.
The [BlueSky social network](https://bsky.app/ ) has introduced "Reply Gating" - it looks like this:
You can write your hot take on Taylor Swift and *not* be inundated by weirdos replying to you. Nifty!
This is nothing new. Twitter has it. Facebook has the concept of "audiences" to restrict who your post is visible to.
And, of course, blogging has this! There is a comment form at the bottom of this page - and I moderate it. If you post something stupid, I don't have to subject my audience to your inanities. I can (and do) block users from commenting.
ActivityPub doesn't have this (yet). It's much more like a public mailing list. I can block or mute you - which stops me from seeing your abuse - but doesn't stop anyone else from seeing it.
Should ActivityPub have something similar? Yeah, I reckon so. I'd like to be able to say "Anyone I know want to go to the pub tonight" and only have mutuals reply. I want to prune away spam or repetitive replies. It would be helpful to have a conversation in public that other people can't interrupt.
The UI would be complex. And the social model needs a bit of work. And there are some technical challenges around syndicating *which* replies should be included.
But, ultimately, social media should respond to the needs of its users.
https://shkspr.mobi/blog/2024/06/who-can-reply/
#ActivityPub #mastodon #SocialMedia

2024-06-12 11:34:44

**VR Review: Moss 2**
https://shkspr.mobi/blog/2024/06/vr-review-moss-2/
Did you enjoy the game [Moss](https://www.oculus.com/appreferrals/TerenceEden/1654565391314903/?utm_source=oculus&utm_location=2&utm_parent=frl&utm_medium=app_referral )? This is a sequel which is *identical* to the original. The graphics are identical, the gameplay is identical, the puzzles are identical. There are a couple of slightly new mechanics and a new playable character (also a mouse). But it is fundamentally more of the same.
So I suggest you read [my review of the original](https://shkspr.mobi/blog/2024/02/vr-game-review-moss/ ).
Seriously, there isn't much else to say here. The story is a jumble of ethereal nonsense. The enemies are defeated by rather dull button-mashing. And collecting all the collectables doesn't really do anything. It is gorgeous, and beautifully animated. If you're happy with an expansion pack for the first game, you'll be happy with this.
The puzzles are a little repetitive - but they make good use of the VR system; you'll often use your hands or have to peer behind something.
It's fairly gentle and - although the enemies can be a little frustrating - there are plenty of tutorials. You'll need to remove your helmet to watch them though!
https://shkspr.mobi/blog/2024/06/vr-review-moss-2/
#GameReview #metaverse #oculus #vr

2024-04-06 11:34:00

**Fixing broken suspend on Pop_OS**
https://shkspr.mobi/blog/2024/04/fixing-broken-suspend-on-pop_os/
My Linux laptop used to suspend perfectly. I'd close the lid and it would go to sleep. Open it up, it would spring to life - presenting me with a password screen. But, some time in the last few months, it has stopped doing that.
If I close the lid, it keeps running. This is unhelpful.
If I manually run the suspend command - systemctl suspend - the laptop blanks the screen then immediately turns it back on at the lock screen. It doesn't suspend.
I know that suspend physically works - becasue running any of these other command *does* properly suspend the machine. But powering it back up goes straight to the desktop - no lock screen!<li><code>sudo /lib/systemd/systemd-sleep suspend</code></li><li><code>sudo echo "mem" > /sys/power/state</code></li><li><code>sudo acpitool -s</code></li>##
[The Fix](#the-fix)I found what was [causing suspend to fail](https://github.com/systemd/systemd/issues/21991#issuecomment-1005020257) by running:<li><code>sudo systemd-analyze verify systemd-suspend.service</code></li>
That spat out any errors in the suspend service. Highlighted in red was:systemd-suspend.service: Failed to create systemd-suspend.service/start: Unit nvidia-resume.service is masked.
That was odd, because I don't have an Nvidia graphics card.
Looking in the relevant directory:cd /etc/systemd/system/systemd-suspend.service.requires
I found:<code>nvidia-resume.service -> /lib/systemd/system/nvidia-resume.servicenvidia-suspend.service -> /lib/systemd/system/nvidia-suspend.service</code>
I deleted the nvidia-resume.service and nvidia-suspend.service files.
For good measure, I also checked what Nvidia stuff I had installed:<li><code>apt list --installed | grep -i nvidia</code></li>
I used sudo apt purge to remove the remnants of any Nvidia stuff. Probably installed by mistake.
After that, suspend worked fine.##
[What "Fixes" Didn't Work](#what-fixes-didnt-work)I went down a bit of a rabbit hole, following lots of suggestions from various people on the Internet. None of these helped me - but they may be useful pointers to you.
I tried [disabling everything in /proc/acpi/wakeup](https://www.vegard.net/how-to-suspend-pop-os/). I couldn't get PXSX to be disabled. But even with everything else off, the suspend didn't work.
[Killing Bluetooth with rfkill block bluetooth](https://github.com/pop-os/pop/issues/2356#issuecomment-1987290124) didn't work. Nor did disabling WiFi.
I have [an updated Kernel](https://www.reddit.com/r/pop_os/comments/ukyl7s/suspend_is_not_working_in_2204_lts/) 6.8.0. I'm not sure of the ramifications of swapping to an older one.
Running [sudo kernelstub -a mem_sleep_default=deep](https://github.com/pop-os/pop/issues/1368) and then rebooting didn't make a difference.
Switching from Wayland to X11 didn't fix it. Nor did unplugging the laptop from power. No external peripherals or screens were connected.
The whole system - including Flatpaks and Snaps - was updated.
This [shell script](https://www.reddit.com/r/pop_os/comments/vr7uco/network_manager_wake_requested/jxxm0e4/) works. But there's no way to tie it in to having the power button pressed or the lid closed.
https://shkspr.mobi/blog/2024/04/fixing-broken-suspend-on-pop_os/
#linux #popOs #ubuntu

2024-03-11 12:34:41

**Can you trust ProtonApps.com?**
https://shkspr.mobi/blog/2024/03/can-you-trust-protonapps-com/
I've recently signed up to the privacy-preserving service [Proton](https://proton.me/). All the email, calendar, drive, VPN, and other services seem to hang off the proton.**me** domain.
I wanted to download the Android apps to my phone - without using the Google Play Store. The [VPN app is on F-Droid](https://f-droid.org/en/packages/ch.protonvpn.android/) but none of the others are. So, because I'm lazy, I Googled "Download Proton Mail".
I landed on https://protonapps.com/.
It *looks* like a genuine site. But is it? .me is signed by Let's Encrypt, whereas .com is signed by Amazon. There is **no link** from Proton.me to ProtonApps.com. There's nothing I can find that shows it is genuine.
But, let's assume for the moment, that it is legitimate. What happens when you try to download the Android apps from it?<li>The <a href="https://protonapps.com/protonmail-android">email app page</a> links to the <a href="https://github.com/ProtonMail/proton-mail-android/releases">ProtonMail repository on GitHub</a> - there's no link from the .me site to their GitHub. But I'm reasonably sure that's them.</li><li>The <a href="https://protonapps.com/protonvpn-android">VPN app page</a> leads to a <a href="https://github.com/ProtonVPN/android-app/releases">different GitHub organisation</a>! I don't know why they're different organisation. It isn't linked to from the the .me site, nor from the <a href="https://protonvpn.com/">https://protonvpn.com/</a> site (yet another domain!)</li><li>The <a href="https://protonapps.com/protoncalendar-android">calendar app page</a> links to <a href="https://protonmail.com/download/CalendarAndroid/ProtonCalendar-Android.apk">ProtonMail.com</a> - is that them? The .com redirects to the .me, but anyone can set up a redirect.</li><li>The <a href="https://protonapps.com/protondrive-android">drive app page</a> and the <a href="https://protonapps.com/protonpass-android">Pass app page</a> do both link to Proton.me!</li>
So there are multiple domains - Proton.me, ProtonApps.com, ProtonMail.com, ProtonVPN.com - and there are at least 2 different GitHub organisations.
How do you tell which ones are legitimate? I signed up and paid on the .me page - so I have high confidence in it.
The [official Proton Mastodon account](https://mastodon.social/@protonmail/112053863641320051) says the ProtonApps.com site is legitimate (and the Mastodon account is verified by the .me site). But you can't expect users to chase through a dozen different pages and enquire on social media just to verify which page is safe.
This is my plea to *all* developers - simplify your customer-facing infrastructure to make your domains consistent & trustworthy.
https://shkspr.mobi/blog/2024/03/can-you-trust-protonapps-com/
#OpenSource #privacy #Proton