Zamicol

6 ms·

1.
by Zamicol 4mo ago
More businesses need to hear this message. Google has proven time and time again they cannot be trusted as a service provider, exactly because of this problem.
2.
by Zamicol 6mo ago
Very impressive work. Well done on the blog. This reminds of of the sort of work Nayuki does: https://www.nayuki.io
3.
by Zamicol 6mo ago
That is excellent. I'm putting that in my notes.
4.
by Zamicol 1y ago
I'm glad someone is saying this. This makes zero business sense to me.
5.
by Zamicol 1y ago
{ "pay": { "msg": "There are also other options.", "alg": "ES256", "iat": 1748248973, "tmb": "9PcBWntvjAktwfiPp8WxgOyQOwc1h6Lo1Un
6.
by Zamicol 1y ago
The Cat in the Hat Comes Back engineering. Can't fix problems in a project? Increase the scope to make more problems elsewhere. Soon tentacles emerge, everything has problems, and your project doesn't look as relatively bad.
7.
by Zamicol 1y ago
It doesn't, and the problems have only become more problematic over time, but it's the least bad hypothesis that's broadly accepted. I suspect a generational succession is required for new paradigms to be contemplated. There
8.
by Zamicol 1y ago
Bingo.
9.
by Zamicol 2y ago
On this exact issue my work did extensive testing and researching various standards. Although we found browsers were out of alignment with standards on all sorts of matters, we found broad compatibility with upper case. (Of course, meaning
10.
by Zamicol 2y ago
> Base45 does not use all 45 characters Huh? I don't necessarily care about an exact "base45", I care about QR code alphanumeric, which just so happens to be a (generic) base 45 character set. For QR code, two characters a
11.
by Zamicol 2y ago
The big lesson from 1936 Turing: Anything can run DOOM... ...as long as it's Turing complete.
12.
by Zamicol 2y ago
> base45 is less efficient Not according to my math: Numeric: 1000/1024 = 98% Alphanum: 2025/2048 = 99% Byte: 191/256 = 75% Kanji: 13/16 = 81%* Alphanumeric is the most efficient QR code encoding mode. (
13.
by Zamicol 2y ago
The problem with using base10 is that it cannot encode a URL. Alphanumeric is the simplest QR code encoding mode that can encode a URL. Also, when I do the math alphanumeric is the most efficient QR mode, although just barely.
14.
by Zamicol 2y ago
I was going to reply to point that out. I'm not surprised you're the one to point it out first!
15.
by Zamicol 2y ago
>You'll create an open-source alternative to a popular cloud service that charges too much, saving fellow hackers thousands in subscription fees while earning you enough karma to retire from HN forever. I'm curious!
16.
by Zamicol 2y ago
There's dozens of us!
17.
by Zamicol 2y ago
> One of your comments about the absurdity of centralized authentication will spark a 300+ comment thread and lead to a new open standard for federated identity. Hmmm...
18.
by Zamicol 2y ago
> A cryptography enthusiast who created Coze and spends their days defending proper base encoding practices while reminding everyone about the forgotten 33rd ASCII control character. The nerd humor was hilariously unexpected. > Your d
19.
by Zamicol 2y ago
That's correct.
20.
by Zamicol 2y ago
Coze uses base64 encoding for binary values such as `tmb` and `sig`. `tmb` isn't a problem since digests are designed to be short, but signatures for some primitive might be very large. When compared to encoding a value directly in bin
21.
by Zamicol 2y ago
We picked the name Coze as a play on words on JOSE ("Cypher JOSE", when Jose is typically pronounced in Spanish, "ho-zay". The English word coze meaning a friendly chat was too perfect for the name of a messaging specif
22.
by Zamicol 2y ago
We addressed these concerns while developing Coze, a cryptographic JSON messaging specification. The specification details how we chose to address these concerns. https://github.com/Cyphrme/Coze
23.
by Zamicol 2y ago
Password hash functions are intentionally designed to be extremely slow (at an exponential scale). While this makes perfect sense for password hashing, it is nonsensical to have such an intentional, configurable slowdown mechanism in KDFs.
24.
by Zamicol 2y ago
I wrote the blackout system for Comcast TV scheduling. My understanding was that blackouts were used mostly for sports where games need to be available in one area and not others. Contractually, they were required to use zip codes, so I us
25.
by Zamicol 2y ago
Password hash functions are designed to be slow, are designed to be use with salts, and may have low entropy inputs. Hash functions themselves are general purpose and don't protect against low entropy inputs (low entropy passwords). T
26.
by Zamicol 2y ago
Password hash functions are designed to be slow, are designed to be use with salts, and may have low entropy inputs. Being slow is a waste for (true) KDFs, salts aren't relevant (although nonces may be), and are designed for high entr
27.
by Zamicol 2y ago
Unfortunately the industry defined Bcrypt as a KDF for some time, even though it is better named as a "password hashing function". Cryptography has a history of being bad at picking good names for new work. In addition to (true)
28.
by Zamicol 2y ago
If China is undermining the West by lifting up humanity, for free, while ProprietaryAI continues to use closed source AI for censorship and control, then go team China. There's something wrong with the West's ethos if we think con
29.
by Zamicol 2y ago
I canceled my paid sub stack subscriptions because they started to send me unsolicited political advertisements. That crosses a red line for me and I will not support their business.
30.
by Zamicol 2y ago
You're right that WebAuthn was much more public, but passkey was not. I personally tried to stay apprised of passkey's development. After asking several developers and poking around the best I could, I was told several times that

More ›