> The reason for representing Health Cards using Numeric Mode QRs instead of Binary Mode (Latin-1) QRs is information density: with Numeric Mode, 20% more data can fit in a given QR, vs Binary Mode. This is because the JWS character set conveys only log_2(65) bits per character (~6 bits); binary encoding requires log_2(256) bits per character (8 bits), which means ~2 wasted bits per character
If you were using binary storage, you wouldn't use "the JWS character set" (aka base64). You'd store it directly and have 0 wasted bits.
Also, they're not acknowledging the bits wasted by their current system. Numeric mode in QR codes spends 3.33 bits per digit. At two digits per character, they're spending 6.67 bits to store only 6 bits of information.
Bearer tokens precede JWT and it's part of the Authorization header.
For authentication & authorization, the caller sends a bearer token. The format of the token is known to both parties and the server knows how to validate it.
It's better than username password combos because (1) not every "account" has a password, (2) tokens can and generally do expire, (3) it's not tied to the password if the password changes the tokens continue to be valid, (4) the user can invalidate the tokens of their choice, (5) you can grant restricted permissions to a token. You can do more or less things with tokens based on the needs of the application but it decoupling it from password gives you additional security and flexibility.
Ohhh they have additional cabin pressure? I could swear the air quality was MUCH better after spending about 10 hours in the plane and not feeling any fatigue.
I thought the air was less dry too, but didn't really have means to measure that.
It is less dry. The 787 can be held to a higher RH% because of its carbon fuselage. No worries about rust. Furthermore, it's not pressurized with engine bleed air which is very hot and dry.
They can detain you briefly for something as simple as wearing jeans if someone committed a crime while wearing jeans but typically this is only for a handful of minutes. These reporters were fully arrested which is a different standard as you've written already.
It sucks that a free option is gone, but companies are not in an obligation to provide free stuff for developers forever.
They never claimed that they are doing a public service. The only reason it's free is they hope you'll get used to it and pay for bigger stuff later on.
It's OK to be sad, but it's not OK to be morally outrageous.
No ethical dilemma or "ever hungry crony capitalism machine" here.
Uber's system killed a person. They received a huge backlash and their permission to test self-driving cars have been revoked in the state of Arizona. They also pulled out from testing California as well.
Waymo had 13 non fatal crashes, of which, 12 of them were other drivers' fault. One was caused by the software where the car wanted to maneuver around some sand bags on the road and side swiped a bus. No injuries. Google took the blame and said it's a learning experience. AFAIK, Waymo cars are not available to public by default.
Tesla had multiple fatal accidents as a result of "Auto Pilot" which is just a bunch of driver assistance systems taped together and marketed as a complete self-driving system. At every single accident, Tesla never admitted the blame, and just reiterated it's statistically safer to drive with AutoPilot than without.
Obviously, this pisses people off. The never-take-the-blame attitude gets old and annoying. It's like a colleague who would throw everyone under the bus to avoid taking the blame.
Secondly, I've seen the video of the accident with the Apple employee. It's clearly AP error and I don't care if it's statistically safer to drive with AP, if a system causes and accident that I could have avoided easily, I don't trust that system.
I don't disagree. But in the end, looking at statistics, it's still safer to drive with AP indeed.
Self-driving cares are done for the first time (I mean, almost fully autonomous ones). Accidents will happen still. We are very far away from a good generic AI that can adapt to different tasks so it's gonna be a bumpy road, pun intended.
That's not the right conclusion I don't think. That published statistic is referring aggregates and averages.
As we know there are safer and riskier drivers on the roads.
If everybody was driving with AP the total number of accidents would drop.
However if you are already a safe driver, there's a chance that AP is riskier.
I don't want to bash AP to the ground, I think the tech is still phenomenal, and forced the car industry to catch up. However Tesla has the attitude of the classic move fast and break things mentality and not willing to take responsibility for it. When lives are at stake, you gotta do better than that.
You don't get to blame the customers for getting distracted for using a system that's literally called and marketed as Autopilot.
There's a reason similarly capable other cars in the market their systems as driver assistance and will force you to give input on tighter intervals.
2FA means two factor authentication. It's a guarantee that even if someone hacks your password or steals your computer, if they don't also have physical access to the secondary device (phone, yubikey etc), they won't be able to gain access to your account.
If you put the secrets of 2FA into the same computer, you are back to 1FA.
However, you end up being less secure than not enabling 2FA in the first place. This is because when you enable 2FA, they can disable the regular checks that they have for 1FA accounts. It will also be incredibly difficult to regain access to the account if you don't have access to 2FA devices.
2FA is protection against a lost password. It was never protection against a lost password combined with a stolen device.
Think about this scenario. You use Google authenticator on your phone, and have your banking app on your phone. A thief knows your banking password and steals your phone.
Now replace "phone" with "computer". I don't see how changing the underlying 2FA device changes security.
The only real danger is if that 2FA db on your computer is not encrypted. But again, the same danger exists if you use an unencrypted phone.
> It was never protection against a lost password combined with a stolen device.
I don’t know where you’ve worked but almost every time I’ve been in a discussion that’s an explicit goal. The most common situation being where someone loses a laptop but not a token or phone.
Even in the case where someone gets the phone, note that phones have fairly strong protection against reading private data directly and 3/5 of my auth apps and my password manager have require both the device and a passcode or Touch ID authentication to open so its non-trivial to get either codes or passwords out of a device. On iOS at least it’s been many years since “an unencrypted phone” existed so there aren’t simple ways to get around this which don’t just devolve to some form of “if the CIA/Mossad/etc. target you but inexplicably choose not to hold a gun to your head until you unlock the account”.
In the hairy world of Android things are much less certain. Encryption is optional, and root access is available which can be leveraged to backup the unecrypted contents of any app, including Google authenticator. I'll agree, an iPhone is a very good secure second factor. But I don't see anyone getting as passionate about not using an android for second factor as people get over using a computer. Which to me seems totally unjustified.
Especially since most enterprises own their employee's laptops, but not their phones. The administrator can manage and mandate full disk encryption on the PC. But if the employer offers TOTP for a second factor, they have no control over what device holds those TOTP codes.
