monko

joined 1 year ago
[–] monko 3 points 9 months ago

Totally! Browser and device fingerprinting are commonly used as first-line defenses against ATOs (account takeovers). There are other kinds of fingerprinting, like those that can learn about your installed hardware and drivers. Really, I'm learning about more fingerprinting methods all the time. That said, decisions are usually made based on several different information sources. These include variables like:

  • GPS geolocation
  • IP address/location
  • Time of day
  • Device ID, OS version, browser version, etc.
  • Hardware profiles, including CPU and GPU architecture/drivers
  • User behavior like mouse movement, typing patterns, and scrolling
  • Whether the user is connecting via a known VPN IP address
  • Cookies and extensions installed on the browser

There's even some buzz around "behavioral biometrics" to identify individuals by how they type, but this is still not the sole method of identification. It's mainly about flagging bots who don't type like humans. However, learning how an individual types can help you determine if a subsequent visitor is the actual account owner or a bad actor.

In my experience, fingerprinting and adjacent identity proofs are rarely used in isolation. They're often employed for step-up authentication. That means if something doesn't match up, you get hit with a 2FA/MFA prompt.

Step-up can be pretty complex if you want it to be, though, with tons of cogs and gears in the background making real-time adjustments. Like you might not even realize you've been restricted during a session when you log in to your bank account, but once you try to make a transfer, you'll get an MFA prompt. That's the UX people in action, trying to minimize friction while maintaining security.

[–] monko 13 points 9 months ago

No shame in that! It is actually pretty well-written, and it has some engaging points. I'm not "anti-rationalism" or anti-this-guy or anything like that. LessWrong did more for global altruism than I ever will.

I'm just pointing out that a person who has dedicated their entire public persona to an ideology (or lack of one) is probably not joking when they start evaluating romantic partners with supposedly objective percentages.

[–] monko 1 points 9 months ago (4 children)

I wouldn't call 10% of the time "often," but let's entertain the idea that it's a popular concept regardless. We'll say 100% of people are like this. And they're constantly trying to trade up. What does that look like? Would most relationships be based on mutual trust and compassion, or would they be cynical cycles of mercenary evaluation?

Meanwhile, though you seem very rational, even the most rational person isn't free from their subjective experience or perception. It begs the question: how much do you trust your partners' assessment of you, or themselves, to stay the same for years to come? I can promise it will not. In this paradigm of value-over-commitment, all relationships (even poly ones) are doomed to fail.

When you make a proper commitment to someone (or multiple someones), you're not shirking the negative possibilities by leaving your "trade-up threshold" unsaid. You're saying, "I accept the good with the bad."

And no, I'm not saying people should stick with an abusive partner or someone they don't like or love. I'm saying that the "trade-up" model is an oversimplified view that places the onus of being "good enough" on another person while shedding the fundamental responsibilities of growing both as individuals and together.

Sure, "happily ever after" is a fantasy, but working toward a lifelong partnership isn't—unless, of course, you've got one foot out the door from day one.

[–] monko 5 points 9 months ago (6 children)

Sorry, I didn't mean to poke at your anxieties! I was remarking on the arbitrary nature of the original post.

While you're probably right that Eliezer is open to dating poly people, the post in question definitely appears to take a monogamous stance—that is, the question of whether to exchange one person for another of "higher value."

Saying that you're cool if

one my partners meets someone else they want to date at least as much as me, they do

is different from

I'd trade up if I found somebody 10%/25%/125% better than you

which is what the original post said.

[–] monko 14 points 9 months ago (10 children)

If they meet someone they want to date more than you, why would they keep you around? You're 75% less ideal. What are you bringing to the table, besides a lower average score for the polycule?

[–] monko 1 points 9 months ago (4 children)

I'd anticipate that most providers will do something similar. I just mentioned Apple because they've been pushing their "cloud backup" hard while still using SMS as a fallback.

I'd be interested to hear which provider, if any, has managed to get around the usual (vulnerable) channels for recovery.

[–] monko 6 points 9 months ago (4 children)

Not sure exactly what you're getting at, but any authentication model must be designed with the assumption that a user can lose all their devices, passkeys included. That's where fallbacks come into play. Even with Apple's system, you can recover your keychain through iCloud Keychain escrow, which (according to their help page) uses SMS:

To recover your keychain through iCloud Keychain escrow, authenticate with your Apple ID on a new device, then respond to an SMS sent to a trusted phone number.

While SIM swaps aren't super common, they're not the most difficult attack. Passkeys are strong against direct attacks, for sure. But if I can reset your account using a text message sent to a device I control, is it really that much more secure?

[–] monko 23 points 9 months ago* (last edited 9 months ago) (2 children)

Yudkowsky is well-known for his work in AI. He occasionally makes jokes, but it's usually about AI (not relationships). I know that on his profile, it says something like "when I don't use punctuation, it's a joke," akin to Reddit's /s.

And yeah, he left off a period on the first post, though not the other two. But that said, he rarely makes multi-part jokes. It's pretty clear to me, having read his posts and articles for a while, that he means this.

To further clarify that this is a "rationalist" of the highest order, consider that he wrote a half-a-million-plus word fanfic of Harry Potter, but with Harry studying science instead of magic: https://en.wikipedia.org/wiki/Harry_Potter_and_the_Methods_of_Rationality

[–] monko 5 points 9 months ago* (last edited 9 months ago)

1 - Good concept, lame protagonist. Execution was mediocre but it sold well enough to give us

2 - which was pretty great. I played a bunch of the co-op multiplayer, though it should've been a freeroam thing instead of mission-based. 2 was easily the best, although

3 - introduced some novel concepts that, while awesome in theory, ended up making the actual story bland. The idea of a "be anyone, do anything" game is awesome on paper, until you realize that means every character you play is just a cardboard cutout that might use the same voice lines as several others.

Legion has a special place in my heart, though, because I love the idea of an "inverted Nemesis system" even if it was botched. I sincerely hope one day we'll get a title with this concept at its core, but with a greater degree of simulation and diversity. Imagine a game where it's fun just to see how events play out, even if you're not a part of them (not unlike Shadow of War/Mordor).

Unfortunately, Legion's implementation is a shallow illusion. It's not completely unfun, but the joy of obtaining new operatives drops off quickly when you realize they're just not that interesting, and they never will be.

[–] monko 32 points 9 months ago* (last edited 9 months ago) (14 children)

Glad this is being discussed. Having worked adjacent to the authentication market, I have mixed feelings about it, though.

There are a few problems with passkeys, but the biggest one is that no matter what, you will always need a fallback. Yes, Apple promises a cloud redundancy so you can still log in even if you lose every device.

But that's just Apple's ecosystem. Which, for what its worth, is still evolving. So the passkey itself is phishing-resistant, but humans still aren't. Fallbacks are always the weakest link, and the first target for bad actors. Email, or sometimes phone and SMS, are especially vulnerable.

Passkeys in their current iteration are "better" than passwords only in that they offload the fallback security to your email provider. Meanwhile, SIM swapping is relatively ready easy for a determined social engineer, and mobile carriers have minimal safeguards against it.

Usability? Great, better than knowledge-only authentication. Security? Not actually that much better as long as a parallel password, email, or SMS can be used as a recovery or fallback mechanism.

I'm not saying passkeys are bad, but I'm tired of the marketing overstating the security of the thing. Yes, it's much more user-friendly. No one can remember reasonably complex passwords for all 100 of their online accounts. But selling this to the average consumer as a dramatic security upgrade, especially when so many still run passwords in parallel or fall back to exploitable channels, is deceptive at best.

[–] monko 59 points 9 months ago

What if we reduce the cost of living instead, lol jk gotta feed the landlords

[–] monko 27 points 9 months ago (3 children)

I also choose this guy's wife.

view more: ‹ prev next ›