140 karma · joined December 1, 2012
> echo test1 | md5
it will output another random 'hash' each time. But within one session it knows that md5 should produce the same output. Running > echo test1 | md5
multiple times, or even > VAR1="test1"; echo $VAR1 | md5
produces the same output for me within the same session, while > echo test2 | md5
results in a different, but also session-consistent hash. > ls -lh
-rw-rw-r-- 1 username username 125M Jun 5 2020 model.ckpt-0.data-00000-of-00001
-rw-rw-r-- 1 username username 787K Jun 5 2020 model.ckpt-0.index
-rw-rw-r-- 1 username username 2.4M Jun 5 2020 model.ckpt-0.meta> cat /etc/shadow
do actually work...
I have seen reports that it will happily hallucinate a plausible but wrong answer to all sorts of different prompts, intermixed with many mostly correct answers. It's interesting to think about how to place trust in such a system.
[1] https://www.fjallraven.com/uk/en-gb/about-fjallraven/materia...
[1] https://en.wikipedia.org/wiki/Momentum_investing
[2] https://papers.ssrn.com/sol3/papers.cfm?abstract_id=2961979
Can you provide a source for this claim? Thanks.
edit: ok, someone already tested it, and it does not seem to help that much: https://github.com/jaesik817/adv_attack_capsnet
Until last week, when I decided that I need to use the account again. I simply clicked the recovery link on their 2FA login form. Had to enter my account details and my phone number. Within 15 minutes (as stated on the website) a member of their service team called me. I explained the situation (lost 2FA app). Not a problem, the service agent told me. He then sent me an e-mail (to my AWS-associated mail address) with some random characters, which I had to read back to him. After that he simply removed 2FA, and I was able to log in with my username/password. For me the experience was quite pleasant, but had someone else have access to my e-mail account and knew my AWS username/password, he might have been able to take over my account, bypassing 2FA. I don't quite know how to feel about that.
EDIT: Ok, this probably only works if your phone number is also already associated with your account. So an attacker additionally would need access to my phone number, making things quite a bit more secure in my view.