Probably based

  • 2 Posts
  • 35 Comments
Joined 2 years ago
cake
Cake day: June 21st, 2023

help-circle
  • Remembering (and inevitably) forgetting passwords for all your different accounts is inconvenient, frustrating, and arguably less secure than a randomly generated password unique to each account.

    Additionally, it can be tempting to reuse passwords for multiple accounts, which is trouble when a less-than-reputable service that you used that password on is breached, since that password wasn’t unique.

    If you use an open-source, tried and true password manager (Bitwarden, Vaultwarden, KeePassXC) and keep a passphrase unique to that password manager only, you avoid the problems above which are way more likely to occur than Bitwarden passwords getting breached in plaintext, or a security vulnerability to the KeePass database.

    Plus, most password managers offer support for passkeys, which are easier to register/use than passwords. They usually only require a “verify with passkey” button on a given website.

    Bottom line, password managers are probably (definitely) more secure than any other reasonable solution that anyone has come up with.


  • probably not true in most other langauges. although I’m not well versed in the way numbers are represented in code and what makes a number “NaN”, something tells me the technical implications of that would be quite bad in a production environment.

    the definitive way to check for NaN in JS would probably be something like

    // with `num` being an unknown value
    
    // Convert value to a number
    const res = Number(num);
    
    /*
     * First check if the number is 0, since 0 is a falsy
     * value in JS, and if it isn't, `NaN` is the only other
     * falsy number value
     */
    const isNaN = res !== 0 && !res;
    










  • Google cannot see any message content of Signal notifications through FCM. It’s more like a “heads up” to the Signal app, telling it “hey, there are new messsges. wake up and check what they are.”. The Signal app then checks for messages and does all the decrypting and whatnot itself.

    While it’s possible that the timing of FCM telling the app to check for notifications could be used to correlate activity, that’s an edge case that if you are concerned about can be easily avoided by just using the background WebSocket or a fork of Signal like Molly that allows you to use a third-party UnifiedPush provider to check for messages in the background, instead of FCM.