PythonicAlpha

> Having said all that, I would encourage more people to talk to their representatives regarding these issues. It goes without saying that unless the people have a voice then their desires won't be heard.

I can't emphasis this enough. The trouble is, that far to many people stand by and are silent.

When (repeated) lying is tolerated in official positions and to official organs of the state, the whole nation itself is in grave danger. In this case, the whole world is in grave danger.

I guess, you wanted to write "American company"?

>2.) the German economy is not really strong

The German economy is strong compared to many other nations. Currently the German economy is the strongest in Europe.

The German economy was also for many decades before the Euro the strongest of Europe, that was one reason for the strong currency (German Marks).

The sayings of the "weakness" of the German economy was and is a political claim that was made to reduce the workers costs in Germany.

You must also distinguish between productivity (which always was high in Germany in the last decades) and attractiveness to the financial sector (stock etc.). And the second thing is, I guess, what Krugman/Muenchau really meant. And yes, Germany was not so attractive for some time, because growth and ROI where not so high as in the US for example.

But I think, that are two different things. One is about productivity and strength of industries and the other is about the capitalistic demand for more and more growth.

Gates is a bad example, but many come up with such examples.

The difference between what he owns now and than is not as huge as the difference between somebody whose parents could afford Harvard and somebody who is raised in Harlem, because he has not the same starting condition.

There is a saying: The first million (billion, 100k, ...) is the most difficult one.

I don't say, that philanthropy is bad.

What I mean: Philanthropy does not help, when the reasons of poverty are not removed. Biggest philanthropy will not help, when it is the result of extreme redistribution of money. The philanthropy of the monks in the middle ages did not help, because the monks where part of the system of inequality, where few owned all and the rest had to live on .... sometimes philanthropy.

Can you clarify, what you mean by "differentiator between current and new token requests"? Currently I don't exactly know which attack form you mean and how it could be prevented by such a "differentiator".

(an example would be nice)

Must be some American specialty. At the end, Bill Gates sees Philanthropy as (part of a) solution. This must have something to do with the US-American history and background? I heard that opinion so often and we are in deed in an era of big philanthropists (like Bill himself). But I (no American, and maybe missing some genetics for it) can not see any solution in it. The biggest philanthropists today are in the US, but also the US is one of the countries, where inequality rises fastest. So, by this viewing alone, there must rise some doubts about it.

Also, you could compare philanthropy with the "foreign aid" that western countries give to poorer ones for decades now. Did it help? In many cases, it made things worse, because the money did not help the people to help themselves, but made them addicted to the aid.

The point is also that philanthropy -- as it might silence the own conscience -- is often the overflow of the overflow. We give, because we have more than we need and than we give what we need least. But what people really need, is not somebody that throws pennies in your hat, so you can buy some old bread -- but what they really need, are equal chances -- to be able to visit the same universities, to have the same jobs and to earn the same money as other people with the same talents.

You might argue: But Bill also fought his way from "rags to riches" -- no, that is not right. Bill already was born in a well being family and visiting visited Harvard College. With such a background, it is much easier to come from rich to riches, as if you come from Uganda slums (or even Harlem).

I already understood your point, but your argumentation is a little to black and white at times.

This is a circular thinking: Password managers are superior to this approach, because this approach is not compatible to password managers, the "more general" solution.

It is like saying: "We need tv sets because tv sets are the only (valid) means of entertainment."

Not only one time tokens, but with limited life-span. So after a while the token expires and is useless. This is a must for such a scheme.

I agree, that eMail as transport media is far from optimal, but it is the only general available media currently.

I still think that from the point of usability a passwordless solution is better for many applications, where security is not the top priority.

Because so many applications in the web force you to have a password, security in general is at risk. Most people get tired of passwords and use either bad passwords or just one for all. And those passwords are endangering those applications that are really security sensitive.

I would rather like to see, that only a few services (like banks, ...) want to have a password and the others just authenticate their users with less intrusive means.

I don't think, that such a scheme can work, when somebody else is using my laptop. Sometimes the simplest attacks are the most effective.

Yes, you are right. But the distinction that should divide trolls from non-trolls (at least, as much, as the big corporations wanted) was mainly, if a company produces something related to the patent. And that is in my opinion the worst classification you can find (it is handy of course for the big corporations).

Yes it is. But still Gmail sessions are long-lived. I also would not stretch this system to eMail-access. Blame it on Gmail, that they do not enforce more security.

Not only pharma: What about ARM? As much as I know, they even don't have a chip factory. They just deal with their chip-designs (I am not sure, if it falls under copyright or the patent system -- but it is just a chip design, some ideas and such they are selling).

That is just the problem with the name "patent troll" ... it is misused by many companies to direct the focus of the people away from the inherent problems of the patent system to the narrower view of "patent-trolls". That leads to the notion, that you just have to remove the those to have a perfect system. A notion, that is simply false.

In the view of the big corporations, a patent system without those "trolls" would be fine, of course.

But wait, which are the entities, that are trolls? Not only universities, but also small inventors, that have good ideas and depend on the possibility that big corporations buy their inventions and thus they could be realized, since many inventions are just beyond of the financial capabilities of single inventors or smaller companies. There are many cases where patented ideas are simply stolen, because the corporation don't want to buy the idea from the inventor. When they sue subsequently, they are now insulted to be "patent trolls".

Even with the patent trolls problem (that exists) solved in a fair manor, it would not solve the problem of low (up to no-) quality patents.

Yes, I also think that it could be achieved. The problem as everywhere is the adoption. When two or three big companies would stand behind it, it could be easily implemented and I really would like to see a scheme like that.

There are of course some questions, that also would need to be solved. For example: What if an other person has access to my computer -- than I still would need some kind of master-password that had to be remember-able. Also there must be methods, to transfer my keys to an other computer or to "copy" for example onto mobile devices.

The example of the SIM-card for banking just shows, that the "big security" is really a hard problem. Two-factor is one idea, but it is always a game where the attackers are hunting the defenders (or vice versa).

I think these two methods are more similar as it looks. It should be noted, that the tokens are only temporary tokens, that should be valid only several minutes. So the eMail system is not a storage, but a transmission medium. You also could use SMS or any other scheme that guarantees that only the valid receiver will get it.

Of course your proposal is superior, but the infrastructure is not available yet. For web-apps with low security demand, I think the discussed scheme would be sufficient (since we already have security implications because of password reset schemes -- and real secure schemes are seldom. In Germany there even where attacks to two-factor authentifications via mobile of banks ... the attackers just ordered a second sim-card in the name of the legal user and intercepted the snail-mail).

>The system will probably have to give a way for the user to change email address while the user still has access to the old email address

Any reasonable web-application today has (or should have) a possibility to change eMail address.

That is a real problem. But the same problem exists on many websites today, when you forget your password and have your eMail changed.

That is the reason, you should try not to change your eMail to often and when, keep the old adress until it gets cold.

Of course, what you normally should do: Change your eMail-address in the application before you switch.

AND: Never use your ISPs eMail-address (unless he will let you use it after you canceled your contract).

For your #1: For sites with low security demands that will be Ok. GMail already does it. When I enter GMail it always gets me logged in by an cookie and that lasts for a month or so, only after that period, I have to enter my pw again. Of course, when you do some security relevant changes (like changing passwors ;) ... just kidding ... changing eMail adress), a reauthentication is needed.

I don't think that this scheme is for any site ... banking sites just want to be more secure... but it is very much better, than setting pw="123" on all websites, you don't care to much.

BTW: I also described a similar idea some time ago in a blog post: http://strategieneu.blogspot.de/2014/06/email-only-registrat...

After I wrote it, that such ideas where discussed at HN even some time ago.

I guess, he knew why he made one person say that.

Groucho Marx said:

   I don't want to belong to any club that will accept people like me as a member

Sartre sharply found out, that to be an independent thinker "about" society, he must not be entangled to much "into" society.

You are welcome.

  we can basically conclude that society is preyed upon by forces that have no counter.

That is, what distresses me also! It is more and more uncovered, that there is no moral anchor anymore in our societies -- and where reference is made to a higher being (as on the Dollar bill), situation is even worse. In Germany, we have a "christian" party with "christian" explicitly in its name -- but that is also the party, that is most ensnared with lobbyists and corporation interests and cares the least about people. It is just a tradition, to brainwash the people.

As much I see today, there are no good guys at all in the world.

There are only some guys, who try to be good, but so many fail.

That is likely the tragedy of freedom: There are no emotional arguments for it.

It seems to me, politicians and other people have long sought for the most emotional arguments to wipe away the wings of freedom -- and thus making the victims of pedophiles, bombing and kidnapping victims again!

(BTW: In Germany, pedophiles where also used as argument for internet censorship. Organisations of those victims protested against these attempts, because they clearly saw, that this legislation did not help (and where never intended to) those victims or help to prevent anything.)

Thanks for the answer. Yes, I was aware, that the focus of iostreams was not on performance. But at least I would have some hope, that since less runtime-parsing would be needed (at least in standard cases), a performance benefit could arise. One of the disadvantages of printf is that even in simple cases (e.g. "%s: %d") rather much parsing is needed.

Very interesting, that printf has that big impact on execution of standard programs. Printf is very powerful (and one of the reasons for the success of C -- for example when you compare it with the standard library existing in Modula 2 or (old) standard Pascal), but that power also comes with a cost.

It would be interesting, how the situation is in C++ with its newer stream based output, that is more based on compiler support (as much I know). Does anybody have experiences with it?

I fall in love with the Model M working at my first job with IBM workstations. The feeling of the typing at the fingertips is just the best. The sound is just of second nature. I know no other keyboard that has that precise and sensitive force-feedback (meaning: the buckling happens just at that point, when the key is recognized -- so you can exactly feel (and hear) it).

-- written with my own Model M