levymetal

5 ms·

1.
by levymetal 2y ago
> Isn’t session token theft as much of an issue as JWT token theft? Why is there a difference in security just because in one case it’s a JSON blob that says user_id:4,is_admin:false and in the other it’s an opaque string? Surely session
2.
by levymetal 4y ago
> Part of me wonders whether the move to electric vehicles from ICE will resemble the move from CRT to LCD televisions. Less robust… EVs are far more robust than ICEs from a mechanical level, as the number of moving parts is reduced by o
3.
by levymetal 4y ago
The other thing that worries me is how integrated modern headunits are. It used to be that when your headunit broke or became obsolete, you could just whack a new one in for a few hundred dollars, prolonging the life of your vehicle. Now ev
4.
by levymetal 4y ago
One of my favourite things they’ve done recently is remove support for TOTP. Now, if you want 2FA, you have to download their proprietary Adobe Account Security app. This in turn requires you to provide a phone number, because unlike TOTP t
5.
by levymetal 4y ago
These can be hidden using uBlock origin. I’ve got a list you can import (just use the raw link). The selector isn’t perfect in Google (sometimes leaves some unattached content) but the link is always removed. Feel free to submit a PR if you
6.
by levymetal 4y ago
I wouldn’t say I’m part of the community, but I’m certainly a fan of ZZT. A text-based game engine developed in 1991 by Tim Sweeney which still has a community going and new games being released to this day. I was able to make my way around
7.
by levymetal 4y ago
ASX now offers electronic delivery of CHESS holding statements and notifications: https://www2.asx.com.au/investors/start-investing/electronic... However, holders can’t opt themselves in; inexplicably this needs t
8.
by levymetal 4y ago
Google famously uses geolocation to set language instead of Accept-Language. They have their reasons, which I disagree with. https://news.ycombinator.com/item?id=30638590
9.
by levymetal 4y ago
After using foam earplugs daily for 5 years my inner ears became very sensitive to the point that plugs caused extreme pain. After a bit of research I found these https://www.happyearsearplugs.com/ These don’t go into the e
10.
by levymetal 4y ago
And now we’ve come full-circle as 1Password 8 requires you to save your password prior to submitting the form instead of offering to save it after submission. Which is a huge regression as it results in this exact issue all over again. htt
11.
by levymetal 4y ago
It's not about 2FA though. The problem is that PayPal allows users to log in via a one-time code sent via SMS, without the need to enter their password or TOTP (I assume this extends to hardware keys as well). They're doing 1FA ov
12.
by levymetal 4y ago
OP here - yeah that's my bad - I never intended it to be interpreted as fully revealed but a sentence taken out of context can read that way, so I tweaked the article (as well as fixing a few spelling mistakes). Apologies for the confu
13.
by levymetal 4y ago
OP here - thanks for pointing that out, for some reason when I try to type TOTP my fingers keep defaulting to TOPT - some kind of muscle memory I guess. In any case, this has been corrected, although I'm unsure how a simple spelling mi
14.
by levymetal 4y ago
OP here - I just tried again and got the normal flow this time. Guessing they must be A/B testing SMS one-time codes as the default.
15.
What’s going on with security at PayPal?(christianvarga.com)
216 points by levymetal 4y ago|99 comments
16.
by levymetal 14y ago
I understand what he's trying to get at, but it's a moot point. Also the article painfully contradicts itself.. > We're more likely to pick the prettiest object up first. ... > Just make sure your product doesn't look terrible, and
17.
by levymetal 14y ago
Would be handy to have a snap to grid feature
18.
by levymetal 14y ago
You could do what Mountain Lion does - 7px standard scroll bar, which grows to 11px on hover. It actually has a 15px clickable area on hover when you include the 2px margins. 15px visible all the time is a bit of overkill. But don't make th
19.
by levymetal 14y ago
I always add the client to the profile, but I don't think they've ever logged in. And I'd prefer to do it the proper way (aka add the SEO company as a user) than let my client share their login details around.
20.
Does it bother you when people are incompetent?
13 points by levymetal 14y ago|12 comments
21.
by levymetal 14y ago
If the user misses it, it's the developers fault.
22.
by levymetal 14y ago
Genius. And it's not often I say that.
23.
by levymetal 14y ago
It's the same as all other companies. "Switch to our Halifax, and get £100 free. Offer only available to new customers". It's rare to see a company that rewards existing customers instead of disregarding them and focusing on the new ones.
24.
by levymetal 14y ago
Hey, are you calling my MacBook low-end? :p
25.
by levymetal 14y ago
If the primary goal is discovery of new content then I think it works pretty well. I'd prefer the "Rising" and "Hot" columns swapped, but perhaps I'm not the primary audience. I'd also like to see excerpts in the "Rising" column to help mak
26.
by levymetal 14y ago
That image at the end reminds me of ZZT.