raron

Chargebacks exists for (EU style) debit cards, too. It doesn't need to be simple just available, so if the merchant disappears with your money or someone uses your stolen card, there is a way you can get your money back. With bank transfers that's not possible (at least here).

> A payment should be a bank transfer. Anything more complicated is just something that is to be exploited by middle-men.

I disagree with that. Payments (especially online and contactless ones) should have some form of buyer protection, chargeback and a way to handle fraudulent transaction, lost / stolen cards, etc.

It can, in fact there is even an open standard for that:

https://en.wikipedia.org/wiki/EPC_QR_code

By the way credit card companies do a lot more than Wero, SEPA or any other similar instant payment solution (e.g. chargeback).

Wero is just another private company trying get their cut of payment fees. You can do the same thing with SEPA Instant Payment (or some member states outside of the Eurozone have their own similar thing).

I don't see why Wero should exists, their business model seems like "trying to get money for the same service you can get for free".

You could just jail the CEO or who was responsible for the security at that agency / company.

How big this cached data is? Wouldn't it be possible to download it after idling a few minutes "to suspend the session", and upload and restore it when the user starts their next interaction?

AFAIK they did a lot of illegal things in the Snowden-era, too.

> Thus succeeding at making the telecommunications vendors used for Top Secret US national security data less secure, the obvious goal of the US National Security Agency

NSA still has the secret Suite A system for their most sensitive information. If they think that is better than the current public algorithms and their goal is to make telecommunications vendors to have better encryption, then why doesn't they publish those so telco could use it?

> Truly, truly can't understand why anyone finds this line of reasoning plausible. (Before anyone yells Dual_EC_DRBG, that was a NOBUS backdoor, which is an argument against the NSA promoting mathematically broken cryptography, if anything.)

The NSA weakened DES against brute-force attack by reducing the key size (while making it stronger against differential cryptanalysis, though).

https://en.wikipedia.org/wiki/Data_Encryption_Standard#NSA's...

Also NSA put a broken cipher in the Clipper Chip (beside all the other vulnerabilities).

> Since then, public cryptographic research has been ahead or even with state work.

How can we know that?

> Who knows what is happening inside the NSA or military facilities?

Couldn't have NSA found an issue with ML-KEM and try to convince people to use it exclusively (not in hybrid scheme with ECC)?

I think you could use dm-integrity over the raw disks to have checksums and protect against bitrot then you can use mdraid to make a RAID1/5/6 of the virtual blockdevs presented by dm-integrity.

I suspect this is still vulnerable to the write hole problem.

You can add LVM to get snapshots, but this still not an end-to-end copy-on-write solution that btrfs and ZFS should provide.

Why does a routing protocol matter for the banking sector? With proper encryption the route the packets of transaction data takes should not matter at all.

Based on EU's public consultation it is not even true (but the number of responses is very small)

https://ec.europa.eu/info/law/better-regulation/have-your-sa...

The next SteamOS release will use Wayland by default for desktop mode, too:

https://steamcommunity.com/games/1675200/announcements/detai...

> I'm not seeing a lot of regrets from folks who moved to TLC and QLC NAND, and those products are more popular than ever.

That's interesting. Even TLC has huge limitations, but QLC is basically useless unless you use it as write-once-read-many memory.

I wish I have bought a lot of SSDs when you could still buy MLC ones.

It doesn't provide anonymity, which is a critical requirement for any (public) election system. It also doesn't provide security, as someone who can control the servers behind vote.com, can change anyone's vote.

This. A voting system and it security must be understandable to the average people. You can not do that with electronic voting. (Even if electronic voting can be done securely.)

Those exceptions are so vague that you can interpret anything into them.

How "free" is your freedom of speech or expression if everything can be an exception?

It's a proposal, so you can check out how it would work.

Anonymous age verification is technically possible, but it is as pointless as any other age verification system, it could easily be circumvented if someone older willing to help.

Probably there is a reason why nobody uses it.

https://en.wikipedia.org/wiki/The_purpose_of_a_system_is_wha...

The age verification proposal of the EU tries to do that, the government knows you used age verification (and I think the rough number of times you used it), but they don't know when or where you used it.

https://ageverification.dev/av-doc-technical-specification/d...

This is true for the official SEPA Instant Transfer and the standard EPC QR code format, too.

https://en.wikipedia.org/wiki/EPC_QR_code

Wero doesn't add any value over standard SEPA transfers, I don't see why does it even exists. PayPal at least has some customer protection scheme.

Jolla mishandled the funds they got for the tablets, it went bankrupt and bought up by a company connected to the Russian state. Jolla lied a lot during these events and tried to hide what happened, and I don't think that's an acceptable thing to do when the main selling point of your product is privacy and trust. AFAIK they recently got bankrupted again and bought by the original owners, but it's hard to rebuild trust.

> well, a concerted attack could easily subvert the baseband

In theory Pixel phones have IOMMU and GrapheneOS is using them, so even a compromised baseband doesn't result unrestricted access to the system.

I don't think this is about the current situation in the US.

Big US tech companies are infamous for not following the EU's data protection rules, and they wouldn't even able to, because some US regulations (I think PRISM, FISA and others) are incompatible with the requirements of EU GDPR. This dates back at lest to Snowden leaks and the invalidation of EU-US data protection agreements by Schrems judgments.

https://en.wikipedia.org/wiki/Max_Schrems#Complaints_with_th...

> The major advantage is now that the expensive and time-consuming part of provisioning a new mobile service (sending out a physical SIM card)

I don't know, choosing service package, signing paperwork, identifying and other KYC stuff (tens of minutes) for me was always much more time-consuming than the few seconds of reading the barcode(?) from a new SIM card and giving it to the customer (or putting it into an automatically addressed envelope).

I can't see any advantage of eSIMs except that it makes harder to change providers what they of course really like.

(Anyways the security of the whole PTSN is a joke and publications about cracking cell networks, why SIM cards are even a thing? I would suspect an customer-id@service-provider.country and a password would work, too. Maybe with a zero-knowledge password proof.)

> atomic clock time signal that (was/is?) broadcast nationwide

Probably DCF77 or WWVB.

> I think the actual antenna and hardware were relatively large since it's a long wave signal

Casio has some normal sized wristwatches that synchronizes to DCF77, it would definitely fit into a stove, microwave, or basically anything.

> clock sync for civilians has never been easier

I don't think civilian clock synchronization was an issue since a long time ago.

DCF77 and WWVB has been around for more than 50 years. You could use some cheap electronics and get well below millisecond accuracy. GPS has been fully operational for 30 years, but it needs more expensive device.

I suspect you could even get below 1 sec accuracy using a watch with a hacking movement and listening to radio broadcast of time beeps / pips.

At a quick glance Typst seems to be very limited compared to LaTeX, especially for more unusual languages.

> 2. There's no risk of surveillance. Reading data from the chip still requires you to read the MRZ, so you can't do that remotely.

There were many attack on that.

https://en.wikipedia.org/wiki/Biometric_passport#Attacks

> There's nothing a chip gives you that you wouldn't get from a normal passport

I think your fingerprints are stored on the chip and not on the printed part.

Not just the lack of transparency, they went bankrupt after the tablet fiasco (never refunded most of the people) and bought by some investment firm connections to the Russian state (not the thing you want from a privacy-friendly product / system) what they tried to keep secret.

AFAIK they have bought by some other company (again) since then, but they have basically nothing. Most of their Sailfish OS is actually closed source (like AOSP vs all the apps from Google), they don't have any hardware, they just re-flash some phone from Sony.

I had high hopes for them, but now wouldn't even touch them with a stick. Pixel with GrapheneOS seems to be a much better choice and maybe even closer to their original ideologies.