Mama told me not to come.

She said, that ain’t the way to have fun.

  • 3 Posts
  • 1.07K Comments
Joined 2 years ago
cake
Cake day: June 11th, 2023

help-circle




  • money… is made from merely money being passed around whilst no actual value is created

    Crypto is a zero-sum game, so money is never “made,” it’s exchanged. So if one person does well, another person must do poorly. That’s the same for stocks, though stocks are a bit different in that the stock price includes the actual, physical assets a company owns.

    Real estate isn’t. When real estate increases in value, that doesn’t mean another property decreased in value, it just means people value that property more today than in the past. This could be due to limited supply (there are only so many plots a geographic area) or renovations, meaning its intrinsic value changes (higher expected rents), therefore it’s not a zero sum game.

    So you really need to define what “wealth” is if you’re going to lump real estate in with stocks and crypto currency.

    Stocks were a share of ownership in a structure

    They still are. The stock price includes the intrinsic value of the company, as well as expected future growth in its intrinsic value. It’s that expected future growth that is doing a lot of work here, and it’s why companies like Palantir can trade at ~1700 times earnings when a “normal” company would be around 10-20x (for reference, Nvidia trades around 50 times earnings, Johnson and Johnson is around 20), people expect Palantir to grow way faster than “normal” companies.

    Expected future growth has always been a part of that equation, that’s not new. What is new is the amount of hype around certain stocks, and that probably has more to do with the news cycle (people have access to information way quicker than 50 years ago or even 20 years ago).

    each token can claim less and less quyantities of the traditional underlying value things - just notice food inflation.

    Inflation has also been a thing as long as fiat currencies have been a thing. The target has been 2%, and the average between 1913 and 2020 was about 3.6% (source; I took the total 2555% and divided it by the 87 years of that period).

    Whilst official Inflation numbers don’t tell us this story

    Do you have evidence of that? The CPI the US uses has been criticized for various reasons, but it’s still the official measure used, and there’s a good reason for that: it’s pretty good.

    Things like housing are very location-dependent, so changes in one region won’t really reflect on overall inflation figures if other areas aren’t experiencing that as well. But if you look at expenditure figures using percentages of peoples’ incomes, housing stays relatively constant in overall percent, which is around 30%. Again, these are national numbers, things may certainly vary by region, since areas like LA will be quite a bit different than rural Texas.

    The societal consequences of the value-representation structures we have (literally, of thing like money, stocks and even certificates of ownership) unwinding would be huge.

    Sure, if what you say is actually true. But I don’t think that’s the case. I think instead, salaries increases tend to trail inflation, and some people still haven’t yet caught up from the high inflation just after COVID. The averages look good, but that breaks down in individual cases.

    Rents, for example, are starting to come down in my area (about 6.5% from last year), which was one of the hardest hit. A lot of the problem was due to new construction projects getting delayed due to COVID supply-chain disruption, and we’re finally catching up to where we should’ve been.










  • Original comment:

    Here’s a fun fact: phone manufacturers know this. So what they call “100%” is not actually 100%.

    My response, which was a small clarification:

    That depends on the manufacturer, some do, some don’t. My phone has a setting to control the max charge, so I set it to 80% when I got it.

    And the follow up from a different user:

    Yes, but that 100% is not really that. It has been programmed to display that percentage, when i reality its 80%.

    And my response:

    No, I’m saying that not all manufacturers have that limit, and it’s a relatively new setting (last few years). If you have an older phone or something not from the top few manufacturers, it might not have that feature.

    Then our conversation started. That’s the context. Here’s your first comment:

    Exactly, which is neither a user setting or relatively new. Battery manufacturers have always had to decide what voltage is what state of charge (percent).

    The user setting where you limit it to 80% is on top of what the previous commenter was describing

    And then my response:

    Sure, if the manufacturer sets it to not charge to the max. I’m saying some manufactured charge to the max by default, hence why that setting is useful.

    My point is and has always been that this isn’t universal, so don’t just assume that your phone stops charging at 80% if battery longevity is important to you. Check if your phone does it so you can know.

    If anyone is trolling here, it’s you.



  • It is a security threat, and to claim it doesn’t count is absurd.

    Oh, absolutely.

    Replay attack is the wrong term, here’s the threat model I’m talking about. Basically, the attacker watches the authentication flow and uses the resulting session (token?) to make web requests as you, stealing whatever data it wants. There’s no attack on the authentication scheme, but on the shortcuts web services use.

    It doesn’t matter if you use passwords, TOTP, or webauthn, there’s going to be some vector to attack the system without breaking the authentication mechanism.

    The average user isn’t going to see much security benefit from webauthn vs TOTP in the same way that adding a better lock to your front door is unlikely to improve your overall home security, because at a certain point, the burglar will just smash a window. TOTP is good enough because it’s safe from attacks on email and SMS that worse one-time code systems use. You should definitely have a lock on your door, but at a certain point, the lock is no longer the weak point in the system.

    And yes, I’m using “code generation” as a generic catchall. I group auth systems like so:

    • offline threats - e.g. passwords that can be broken by seeing the hash
    • reliant on third party service that can be attacked separately - email and SMS
    • “code generation” - uses some cryptographic mechanism to generate some unfakable code that can’t be reused; seeing more examples doesn’t help, and codes can’t be reused

    If your password manager handles the second factor, the user experience of TOTP vs webauthn is nearly identical, and the security is nearly identical to your average attacker, to the point where they won’t attack the authentication mechanism itself, but something else on the website or the password manager itself.

    The problem is that most people do only use plain old passwords. If we can get any kind of extra security, even TOTP, then all the better.

    Exactly. The difference between TOTP and webauthn only really matters if you’re a government or something else where state-level actors are part of your threat model. If your service uses one or the other, the distinction isn’t important to the average user.


  • The only MITM attack I’ve seen is entering codes before the user does. That’s not breaking TOTP in any meaningful way (which is what I was trying to get at), so it would be similar for password entry or even passkeys if they have sufficient control over the device or network to essentially do a replay attack.

    I’m basically saying that generating codes with TOTP and passkeys are a similar process and are subject to similar threats. Passkeys are slightly better since codes can’t be generated independently, but AFAIK that’s not a significant threat for TOTP anyway, because if they have that level of control, they already have your data.

    The choice between TOTP or passkeys is not a significant one, if your provider offers one or the other, your account will be reasonably secure. If your TOTP solution is built in to your password manager, it’s basically the same thing so you should probably prefer passkeys.