elderlybanana

Yes, TOTP is a secret + computation, and generating it is trivial once you have the secret. The security difference is that the TOTP secret is separate from the user’s password and the output is short-lived. Each of the two factors address different threat models.

In my experience, juniors don't know how to do a secure setup, and busy seniors are often willing to cut corners to complete business-critical tasks. Application secrets management needs a better default setup. The standard for application auth should be more similar to an IAM system.

The dev community needs to find a better default than .env files for secrets. While there are plenty of alternatives, they generally all require knowledge of some third party system, which most people, for many reasons do not have the time or interest to learn, and some 3rd party secret to unlock the rest.

We need better default abstractions around secrets management. The authentication step to fetch secrets should be pushed to something ephemeral, probably biometrics. Ideally, devs should almost never interact with secrets in any way. They should use secure and convenient MFA methods to authN/Z their access to services, and secrets management happens out of sight. And this should all happen automatically with default tooling.

It is fairly easy to authenticate between services without secrets in the context of a single platform like AWS using IAM policies and roles, but I think we need to solve the more general case for secrets management abstraction across platforms and services. OSs, browsers, and dev tooling are becoming more mature with respect to auth methods. Secrets management should be mostly the domain of a select group of people, like any number of other complex computer systems details.

Maybe reading about passkeys imminent death on HN?

My favorite chili oils take the chilis just beyond a perfect maillard "sear" and venture very slightly into burnt territory. Many peppers have a natural bitterness when dried, and that slight bitterness added from the barely burned flavor brings out some extra, magical, umami depth. Adding some acidic elements makes for some incredible dishes.

I have found that smoked chilis lose their smokiness with high heat though. I wonder if doing a lower heat extraction might retain those smoky flavors. Sounds like the multiple extraction/blend the author talked about would be worth a shot to get both.

I think understanding this distinction is going to be one of the main challenges for mainstream WebAuthn adoption over passwords as the default authentication method.

> It sounds like you want to trivialize a problem that has existed for way longer than computer science and systematically relies at some point on human memory if you want a certain level of security and secrecy.

Assuming the "problem" you are referring to is authentication, this is not necessarily true. "Something you know" is just one auth factor of several. Using a thumbprint (something you are) to grant access to a private key stored on a device to sign a challenge does not rely on human memory, and is probably more secure than using a password in most cases.

An argument can also be made that using a password manager implies that you are specifically doing the opposite of relying on human memory for authentication.

That said, I also disagree with the premise of the original comment that "Passwords should be dead soon and this article should be irrelevant soon after." They will be around for a while, although I hope passwordless mfa can soon replace them as the default choice.

In response to this post, I just open sourced a starter project to a variation of this idea: https://github.com/secretlessai/audio-mnist. I've been interested in doing image classification techniques like CNN on audio data for a while.

A couple years ago for a weekend project I made a simple "audio-mnist" dataset from handwritten digit audio recordings. I never got past a few days worth of work, but open-sourcing it has been on my mind for a minute. This post kicked me into action. Getting some more data, basic CNN examples, etc. could provide a nice starting point for a lot of research and tools.

There is still separate code I'd have to find and make intelligible to create the recordings and split the audio.

Anyway, in case anyone finds part of this process interesting or useful.

Incredible work, this is the most exciting AI dev tool I've come across!

Do you have a strategy to supplement ChatGPT to handle post-2021 updates to languages and libraries? I tried it on a NextJS repo and it came up with something that looked like it would have been correct a few versions ago, but I had to make some manual changes. Certain fast-moving ecosystems might frequently have this issue.