johnswentworth's Shortform

johnswentworth

This is a special post for quick takes by johnswentworth. Only they can create top-level comments. Comments here also appear on the Quick Takes page and All Posts page.

So, the Hackening.

I have yet to hear any sensible-sounding takes on what to do about it, at a personal level. Mostly people repeat the usual shibboleths about refreshing your passwords, which doesn't seem to engage at all with any model of the new threat regime. Anybody have actual models about what the new threats will look like, how well various actors will keep up with them, and what to do defensively at a personal level?

It feels very disempowering that where I live, most banks don't even provide other MFA options than through SMS (no third party authentication app yet, or Yubikey support). There's been a few news about financial services getting hit and having downtimes, and the cyber regulations are quite weak^[1] , so they can get off without providing breach notices to the public.

There's even some apps that restricts the type of password you can use, e.g. <16 characters.

It's really concerning.

^{^}
I'm assuming this though, I did work in cyber a bit but haven't really t... (read more)

1aksara8h

Could you explain a bit more about passkeys vendors - by those do you mean e.g. Apple's Keychain, 1Password, Dashlane, etc? And any best practice to protect these apps outside using MFA and Yubikeys?

3roha13h

Personal preparation for emergencies/disasters/crises seems generally sensible to me, and even more so now that AI-enabled cyberattacks can plausibly cause extended outages of critical infrastructure, such as water and power supply. As @jefftk wrote for example here and there, the cost of preparation is relatively low and the benefit can be very high. Prepping often received ridicule, particularly before Covid-19 hit, and there may be a remaining stigma around it in some circles, but I think at least basic measures have become quite mainstream. Many nations and organizations provide guidelines that can serve as inspiration. They often include location-specific aspects such as some particular sources of risk and information about official alerts. Here are some examples written in English: * US: https://www.ready.gov * UK: https://beready.campaign.gov.uk * Canada: https://www.getprepared.ca * New Zealand: https://getready.govt.nz * Finland: http://72hours.fi * Norway: https://www.dsb.no/en/Safe-everyday-life * Sweden: https://www.mcf.se/en/ * Red Cross: https://www.redcross.org/get-help/how-to-prepare-for-emergencies.html

johnswentworth's Shortform

11

Ω 5

johnswentworth's Shortform

11

Ω 5