6,920 karma · joined January 1, 2010
1. Less than a hundred people in the world are working at this problem, 2. A significant fraction of those happen to work at competing hyperscalers, 3. Those hyperscalers repeatedly show themselves not to take user privacy seriously
A couple years ago I adapted a quite similar concept for the PUCO 8: https://www.lexaloffle.com/bbs/?pid=106664 My version allowed players to re-use letters though. Yours is much more interesting and challenging.
I remember being pretty proud of my compression system that let me fit several thousands of words on the cartridge.
Take a look at the article. The issue is more complex.
Most projects are not created under those conditions.
> The Pass-ta-key attack is effective when the relying party does not strictly require user verification. Many relying parties configure WebAuthn’s userVerification parameter as preferred rather than required to support diverse devices and user experiences, making them susceptible to this attack.
So it’s possible for a relying party to mitigate this attack by requiring user verification and checking that the proper bit was set.
Later on, the article outlines an issue with the way that Chrome interacts with Windows Hello during passkey registration and another issue where Chrome dumps the TPM’s master key in process memory, but these are endpoint concerns and have since been patched
for new installations going forward, why not put the folder in XDG_CONFIG_DIR and an optional symlink from ~/.cargo that can be opted in