twr

> You're required to set a password on your Authy database before you can start adding tokens to it.

That's not true. Passwords in Authy are for backup, which is optional. Backup synchronizes offline TOTP secrets between paired devices. Only the offline TOTP secret is encrypted; the token name is not.

"Authy Account" secrets, the ones created by the Authy API, used by Coinbase, Cloudflare, et cetera, are always stored remotely, and can be restored without-password to anyone with possession of your phone number and email account.

I wrote about this a little over here:

https://news.ycombinator.com/item?id=12603380

It's widely acknowledged by the paranoid. The reason why so many services started requiring a phone number at signup is that it's an extremely effective anti-spam technique. Of course, the paranoid people aren't necessarily wrong either.

dnsbl.info reports that 69.43.165.11, MX for mail.rsync.net, is blacklisted by ips.backscatterer.org:

http://www.backscatterer.org/?ip=69.43.165.11

I suggest fixing your SMTP server configuration [1][2] and maybe listing your IP on dnswl.org. (edit: I see you did the latter.)

[1]: http://www.backscatterer.org/index.php?target=bounces

[2]: https://web.archive.org/web/20140215064312/http://spamlinks....

If you don't have a recovery email address actively assigned, then you should be locked out.

That's what adding a recovery email is for: to deliberately weaken your account's security, in exchange for convenience.

If you disable recovery, then -- no surprise -- you won't be able to access your account if you lose access.

This post may seem unkind, but keep in mind that some people deliberately do not add recovery methods, in order to prevent secondary-takeover access; and that the above poster's request would fundamentally drastically weaken the security of those users.

Comcast assigns a /56, /60, or /64 depending on the router configuration (/56 is for business class). That's 16 * 16 * 18,446,744,073,709,551,616 IPv6 addresses, respectively, not 8.

> # this was a mistake...

That's not an unfixable mistake: sda3 is at the end of the partition table, so if it's deleted, sda2 can be safely resized offline. For example,

  parted /dev/sda rm 3
  parted /dev/sda "resizepart 2 -0"
  resize2fs /dev/sda2 # for ext2/3/4

And then you can create a swap file or volume on sda2, so long as it isn't on btrfs.

awk is probably better in this case, since you can save only the raw values (and other columns that you deem important):

   awk '/Reallocated_Sector_Ct|Current_Pending_Sector|Offline_Uncorrectable|UDMA_CRC_Error_Count/ {print $2,$10}'

So I spent some time playing with the Authy app.

Here's the drop:

1) Dave has an active Authy account.

2) Dave configures 2FA for Coinbase using Authy.

3) Coinbase, rather than asking Dave to manually enter a TOTP secret, registers a 2FA token on Dave's Authy account via the Authy TOTP API.

4) Mallory takes over Dave's phone number.

5) Mallory resets Dave's Authy account at https://www.authy.com/phones/reset.

6) Mallory gains access to Dave's email account (using SMS recovery?).

7) Mallory confirms the Authy reset email.

8) Mallory logs into Authy using Dave's stolen phone number.

9) Mallory now has access to all of Dave's Authy API tokens (Coinbase, CloudFlare, etc).

10) Mallory can try guessing the backup password for Dave's other non-API tokens. Assuming Authy transmits the entire encrypted blob (I'm guessing it does), offline brute-forcing is possible.

tl;dr: Don't use Authy for services using the Authy API.

Authy's developer FAQ implies that ownership of the original phone number is sufficient to restore API-created tokens (e.g., Coinbase).

> What happens when a person loses their phone?

> Authy automatically synchronizes all accounts. If a user loses his phone when he buys a new one he'll be able to access back all of his account's by registering the app using the same phone number he previously had.

https://docs.authy.com/developer_faq.html

> there is no intrinsic reason why code from one vendor ... should be more or less secure that from the OS developer

If you're writing a cross-platform application, it's often easier to be confident in platform-agnostic parsing code that uses the platform sandboxing primitives, versus yielding parsing to the operating system, which may decode in a different execution context, and be less secure compared to the application security policy.

Ubiquiti router owners (I know there are a few on HN) can enable this option like so:

  ssh <router>
  configure
  set service dns forwarding options stop-dns-rebind
  commit
  save

/var/log/dnsmasq.log should contain the resolution failures after that. e.g.:

  Sep  1 21:48:41 dnsmasq[26479]: possible DNS-rebind attack detected: www.dropboxlocalhost.com

Using xsv (https://github.com/BurntSushi/xsv):

  cargo install xsv
  xsv search -s ZIPCODE <zipcode> -d $'\t' UCMR3_ZipCodes.txt
  xsv search -s PWSID <pwsid> -d $'\t' UCMR3_All.txt |
    xsv search -s AnalyticalResultsSign = |
    xsv select FacilityName,Contaminant,AnalyticalResultsValue |
    xsv table

John Adams' Thoughts on Government (published in 1776) seems appropriate here as an example of anonymous communication, one that helped formulate the very notion of US democracy. It was written during a revolution, too.

Yes. In fact, the Chromecast setup apps suggest disabling isolation if it cannot be connected to. Broken multicast support also prevents setup.

NoScript does more than block JavaScript, but if that's all you're interested in, uBlock Origin can block inline and external scripts on a global or site-specific basis.

https://github.com/gorhill/uBlock/wiki/Dynamic-filtering:-qu...

djb, Adam Langley, Dave Wagner, Thomas Pornin, among others.

No. Sorry. I should have linked to the NASB translation, which was the source of his (literal) quote.

https://www.biblegateway.com/passage/?search=1+Corinthians+1...

Pike literally quoted a passage from the bible:

https://en.wikipedia.org/wiki/1_Corinthians_13

I won't argue that it was in good taste.

It's quite possible to comprehend, admire, and appreciate the labor and discoveries of renowned scientists and technologists, without sharing in the motivations and beliefs they possessed.

Science is intertwined with the accomplished legacies of hated figures whose beliefs were shaped by prejudice, yet whose works became recognized and included in established theory.

Computing fields tend to venerate their idols with a religious-like fervor, unfortunately.

> but surely even they understand source code you're not allowed to run or modify is not "open" in any meaningful interpretation of the term :)

"Run" or "modify" are not requisites in the common understanding of "open source"; legality of viewing is. "Open" to them usually means it can be distributed (to them) and read without breaking the law.

> "Closed source" is the standard term. Since you seen to not like that term, you could go with "proprietary".

Your definitions go contrary to the understandings and usages of every non-F/OSS person on the Internet.

For example, both "closed source" and "proprietary" are used to mean source-code-not-available in gaming circles.

Perhaps the open source movements should seek intuitive definitions of terms rather than invent vague nomenclature that only makes them unable to communicate with normal users.

Specify

  https://github.com/username/repo/archive/v0.1.1/foo-0.1.1.tar.gz

for the URL.