Remix.run Logo
TacticalCoder 3 days ago

Exactly the same. Moreover my main work machine, the one I call my "workstation", doesn't even have sound. No videos. No meetings from that one. And that's the machine to which the Yubikeys are hooked.

I've got plenty of machines, including that one shitty laptop I trust even less than the rest. Arguably the only way to operate securely is to consider that most devices in your house (and at work) are compromised and hostile, that most networks are trying to fuck you up (for example not HTTP at my home: simply none, it's not allowed) and that they're really out there to get you. And, yet, to have a setup that works.

Same things with my phones: I've got one real phone, with two apps I added to it. Country's mandatory EID app and brokerage's 2FA app. And that's it. Nothing else. Nada. Zilch. One phone, two apps. No email account. Nothing.

Then I've got another phone, with another subscription, where I've got Telegram, that app to see the targets at the shooting range (long distance shooting: there are webcams in front of targets so you can see where you hit), the home automation apps, etc. All those shitty phone apps developped by clueless devs: they go on that phone. The email? Some throwaway email account I don't care about. You can 0-day that phone: I wouldn't give a shit. And I tell people: "My name on Telegram ain't my real name" and they love it. Non-technical people: they begin to understand and they love it.

People are going to need to step up their security game big times now for I think we're in for quite a wild ride.

I know it's bad but I'm not going to say there's not some schadenfreude seeing what happens to those who were calling others "paranoid".

I mean: we're talking about people "quickly installing software (as admin/root)" on their main machine.

The road is going to be long for it's an entire shift of mindset that's now required.

Convenience vs security: you pick. Video call vs major project compromised: you pick.

gabinator 3 days ago | parent [-]

The vindictive side of me hopes the cybersecurity "rug" is pulled out from underneath all these companies (new & old) who don't appreciate craftsmanship. I don't think we need regulations, but companies need to suffer when they drop the ball