Client side verification is just security by obscurity, which gains you very little.
If someone is capable of MITM attacking a user and fetching a password mid-transit to the server over HTTPS, they are surely capable of popping open devtools and reverse engineering your cryptographic code to either a) uncover the original password, or b) just using the encrypted credentials directly to authenticate with your server without ever having known the password in the first place
deleted by creator
The word ‘decipher’ is doing a lot of heavy lifting. I’m wondering if they socially engineered or just found it written somewhere in the house?
You can plausibly brute force up to 4, maybe 5 words of a seed phrase. It takes longer than a normal password because every seed phrase is technically valid, so the only way to know if your brute force is successful is to generate thousands of addresses at each of the different derivation paths you may expect funds to exist at.
The same seed phrase is used for Bitcoin, Ethereum, Monero, etc, but each currency uses the seed phrase to generate addresses in a slightly different standard. Additionally, each wallet uses a slightly different variation of that. Within each wallet is a notion of accounts, and within each account you could have dozens of addresses. You need to generate each of those addresses, and scan each cryptocurrencies blockchain to see if those addresses have ever been used.
Realistically one of three things happened: his seed phrase was written down and they found it, it was password protected or on a drive with weak AES encryption and they cracked THAT instead, or finally, he used a hardware wallet and they exploited a firmware vulnerability to lift the PIN and transfer out funds and/or read the seed from the device
You are acting like someone checked off a “log passwords” box, as if that’s a thing that even exists
Someone configured a logger to write HTTP bodies and headers, not realizing they needed to build a custom handler to iterate through every body and header anonymizing any fields that may plausibly contain sensitive information. It’s something that literally every dev has done at some point before they knew better.
I watched all of that and I still don’t get it
Does Google Cloud not count as “own hardware” for google?
That’s why the bars are so different. The “cloud” price is MSRP
That’s not really machine learning though. If you wanted to go way back, AI research goes back to implementations of hebbian learning in computer science back in the 1950s as a way of emulating human neurons. I was merely pointing out that AI was a computer science “dead end” until restricted Boltzmann machines were revisited by Hinton et al back in 2008 or so, and that 99% of the growth in the field has happened since the early 2010s when we reached a turning point where deep learning models could actually outperform classical statistical models like regression and random forests
in the coming decades
Given that in the past 15 years we went from “solving regression problems a little bit better than linear models some of the time” to what we have now, it’s not unfounded to think 15 years from now people could be giving LLMs access to code execution environments
Pagers operate at a lower broadcast frequency than cell phones. Longer wavelengths (low frequency) are less impeded by walls and interference.
This is only true for steam keys sold on other platforms afaik
Homeowners aren’t signing contracts where they agree to use exactly 450MW of power at a constant rate 24/7 for the entire year. The problem with “Free market” utilities is that they are reliant on private sector contracts like this to fund expansion
From a business perspective, if the grid can handle the residential load 99.9% of the year, paying these businesses to cut usage during that other 0.1% of the time is a LOT cheaper than expanding their service to add one more decimal place of uptime that sits idle for the entire year
Cloud platforms like AWS/Google/Azure do something similar, where you can rent unused servers for pennies on the dollar with the expectation they can be reprovisioned by someone else on a seconds notice
Top to bottom, then left to right.
What (widely popular) race could possibly be a better metric of endurance than the marathon?
It’s not uncommon to see certain sites to only work on chromium because the dev used the filesystem APIs that don’t exist on FF
Yes but if it’s first instinct is “go left” on 1-2, it’s pretty apparent the reward function could use some tuning
It’s not necessary but there is no reason not to.
Pros:
Cons:
venv/bin/python3 instead of just python3 in the run line of your dockerfileWhen you teach a child what a dinosaur is, you have to do a lot more explaining than when you try and teach an adult what a dinosaur is in french - the child isn’t just learning a language for those 10 years.
COVID has long lasting effects across your entire body, it impacts your immune and cardiovascular systems for years after you get it.
Risks of heart attack, stroke, etc are increased 2.5x in the year after infection, increasing exponentially with the number of times you have been infected. In fact, the risk of pretty much ANY health problem skyrockets following a COVID infection.
No it doesn’t, if they intercept an encrypted password over HTTPS they can resend the request from their own browser to get access to your account
What is the problem with that? The password is secure and only shared between you and the site you are intending to communicate with. Even if you sent an encrypted password, they wrote the client side code used to generate it, so they can revert it back to its plaintext state server side anyways
How would you verify it then?
If not sending plaintext passwords was best practice then why do no sites follow this? You are literally posting to a site (Lemmy) that sends plaintext passwords in its request bodies to log-in