There are some password managers where you need to either manually look up passwords and copy+paste or autotype them or select the correct password from a dropdown. Some of these will come with an optional browser extension which mitigates this but some don’t really tract domain metadata in a concrete way to do this linking.

Some examples would be Pass which doesn’t have any standard metadata for domain/URL info (although some informal schemes are used by various tools including browser-integration extensions) and KeePass which has the metadata but doesn’t come with a browser extension by default.

The reason I say browser password manager is two main reasons:

1. It is absolutely critical that it checks the domain to prevent phishing.
2. People already have a browser and are often logged into some sort of sync. It is a small step to use it.

So yes, if you want to use a different password manager go right ahead, as long as it checks the domain before filling the password.

I don’t think that is quite accurate.

We discovered many more Pluto-or-larger sized things that were closer to the sun than Pluto. It became increasingly obvious that there was nothing special about Pluto and we either needed to add hundreds of planets or “demote” Pluto.

You probably mean TOTP. OTP is a generic term for any one-time-password which includes SMS-based 2FA. The other main standard is HOTP which will use a counter or challenge instead of the time as the input but this is rarely used.

Tips for being secure online:

1. Use your browser’s password manager to generate random passwords.
2. In the rare case you need to manually enter your password into a site or app be very suspicious and very careful.
3. Never give personal information to someone who calls or emails you. If necessary look up the contact info of who called you yourself and call them back before divulging and details. Keep in mind that Caller ID and the From address of emails can be faked.
4. Update software regularly. Security problems are regularly fixed.

That’s really all you need. You don’t even need 2FA, it is nice extra security but if you use random passwords and don’t enter your passwords into phishing sites it is largely unnecessary.

I’m not an expert on modern alarm systems but it seems that it is very common and fairly inexpensive to have cellular data backup. Not every system has it, but many do. In that case cutting the main connection will likely result in someone appearing on site fairly quickly.

Many cameras also have some form of local buffering. So even if you are gone before someone does show up you still may find yourself recorded.

But at the end of the day just put a bag over your head and you can be gone by the time anyone shows up without leaving a meaningful trace. Other than the very top-end system security systems just keep the honest people honest.

I don’t think that is true. Not much at Google really bought into the UUID hype. At least not for internal interfaces. But really there is no difference between a UUID v4 and a large random number. UUID just specifies a standard formatting.

I don’t really mean literally to practice asking people out. But there are times in your life where you need to ask people for things. It is hard to get over the anxiety, risk of social embarrassment and practice showing confidence (even if you are not). These are valuable skills in all sort of social circumstances.

It is true, don’t do it.

Even at huge companies like Google, lots of stuff was keyed on your email address. This was a huge problem so Google employees were not allowed to change their email for the longest time. Eventually they opened it up by request but they made it very clear that you would run into problems. So many systems and services would break. Over time I think most external services are pretty robust now, but lots of internal systems still use emails (or the username part of it) and have issues.

IIUC Google accounts now use a random number as the key. But there are still places where the email is in use, slowly being fixed at massive cost.

FWIW I think it is actually a valuable social skill to be encouraged to ask someone out to prom. A lot of people don’t have many similar experiences throughout their lives.

Prom is fun. You get to hang out with all of your classmates, ask someone out. A subset of people are always going to go overboard, but keep in mind that you don’t see the “normal” cases. Most people just walk up to someone and ask them out. They find a date from the school or go alone.

I’m from Canada so I don’t know if the US is wildly different, but here it is a bit of a big deal, but I think part of that is what makes it fun, you sort of build a bit of hype around what would otherwise be just another school dance.

If you want to use proprietary apps the best option is probably dumping the APK from your “Googled” phone then sideloading it onto the new phone. However it may be difficult to keep up with updates unless you have a dedicated phone to download them.

It’s never too early. If you see an interesting job posting reach out and go thorough the process. At worst you learn a bit about what they were looking for and gain some interview experience. At best you get a job offer. Even if you decide not to take the offer you learn a bit about the positions available to you.

It costs effectively nothing to apply. Just a few hours of your time.

Most credit card issuers don’t issue credit cards to random apps by solo developers.

I would pay a lot of money to see Nintendo’s conniption over having to allow home brew and non-approved software on their game consoles. I would love to release emulators for older Nintendo consoles for the Switch so that they don’t get to keep charging people again to play old games on newer consoles.

1. I can usually pull out my phone faster than taking a card out of my wallet.
2. Phone-based cards typically have significantly higher limits than physical cards. (I can tap hundreds of dollars with my phone, only about $100 on my card.)
3. The phone needs to be unlocked which is safer than the card which just needs to be tapped with no other authentication.
4. One less thing to carry around.

Because to implement this you need to negotiate with individual credit card issuers. Basically how this works is that your phone is being issued a virtual card with the keys locked inside the phone’s HSM. Then it can be used to make NFC payments just like any physical card. So you need 1. contracts with many card providers, 2. card issuance processes with these providers 3. huge amounts of compliance bureaucracy. At the end of the day it isn’t really worth it unless you are a huge company and expect to have tons of users or see it as an essential feature of your phone OS.

It’s not “inherently insecure” at least not to that degree. (Once could argue that lack of E2EE is insecure.) If you stand up an unrelated instance you shouldn’t be able to access private messages that don’t relate to an account on your instance. So only bugs in your instance, or your conversation partner’s instance, will be able to leak those messages.

For software to run on a computer it needs to speak the computer’s “language”. This is typically called “machine language” but differs across different hardware. For example most modern Intel and AMD processors speak x86_64. This language has ways to express different operations such as “add these two numbers” or “put this CPU core into a low power mode”. This is the fundamental way that software works, but running in this language.

There are languages that are completely different, such as ARM which is very common on mobile devices and is the language used by Apple’s new M chips. These have basically nothing in common with x86_64.

These languages also evolve over time. For example x86_64 is a significant extension to the older x86 language. For the most part this is fine, it is like the CPU now knows more words, if you use those new words the new CPU will understand them, but older CPUs won’t.

RISC-V is a new machine language. What makes it interesting is that it is a free and open specification. This means that anyone can create a new RISC-V CPU, unlike x86_64 where you need to buy a license from Intel or ARM where you need to buy a license from the ARM corporation. Most people think that this openness has major benefits, for example now anyone can create a new processor which may be better, rather than having innovation being stifled by licensing costs (if you can even get a license) or needing to create their own machine language and require huge amounts of effort to migrate software to it.

Note: It is important not to confuse “machine language” with “programming language”. When people write software they very rarely write code in machine language directly. Usually they use a programming language which is then converted into the machine language of the CPU it will run on.

If you just need to intercept the keypresses in webpages then you can inject a content script and handle these. However there is no way with the new WebExtensions API to intercept browser chrome events.

Additionally there is no way to delay events. So if you want to suppress both shift presses you will struggle to do that. If you are ok to let the first one go through suppressing the second one is trivial.