Korthrun

I use a hardware password manager that connects over USB or bluetooth for most things. The few things that I use often I have a system for, and that system is popular culture.

Love “The Prisoner of Azkaban”? Initialize it, and add the publish date some where: HP&TPoA|1999

Starship troopers fan? Initialize a memorable quote. “The enemy can not push a button… if you disable his hand. Medic!”: Tecnpab…iydhh.M! Need numbers? Find a quote with numbers, or add the release year, or the number of times you watched it that one weekend where you and a friend watched it 32 times.

Like TV shows more? How about the fourth episode of family guy: S1-MindOverMuder-E4.

Metal Fan? I do love track three off of Metallica’s 1983 album: #3|Motorbreath-1983

Etc.

No, I would not.

When I was somewhere in the late single digits to 11 years old I loved it. The idea of an overly complicated city wide scavenger hunt that had you solving riddles was just plain exciting. Rooting for the underdog? My new hobby. The whole thing was a very fun fantasy and everybody seemed so cool.

I watched it with a buddy a few years ago and “meh” about describes it. This is coming from someone who still genuinely laughs and dick and fart jokes =/.

It was however pretty easy to enjoy and make fun of some. I could not get over dudes plastic hat either, I want one.

Microsoft pivoted to Skype. Saved you a click and reading about 1000 words.

I’m not even interested in the username of the person I’m responding to. I tend to ignore it completely unless there’s a comment like “lol, username checks out”.

There are very few times I will bother to check someones profile. They have to either say something so awesome that I want to see more, or have given a take so hot I want to see if they’re trolling or if this is standard behaviour for them.

While it looks like the whole Jerboa/“miscommunication” thing has been sorted out here I want to chime in to say that no, I don’t think that checking profiles for anything is a reasonable expectation.

I must have been way out of it late last night. I totally missed that you were asking why people do it and not looking for recommendations. Sorry for the spammy nonsense response to your OP.

To the latter question, I’ve seen devices that do OTP and FIDO in addition to basically storing arbitrary strings (e.g. your cc number).

I get harassment scolding me for using Lemmy to advertise when I mention any of the products by name, despite having no affiliation with any of them outside of being a user, but they’re not hard to find if you look.

I’m curious why your listed options are all software that runs on the internet as opposed to a piece of hardware that you connect to your devices.

Is that just because this is the self hosting community?

Why not a piece of hardware instead of self hosting, cloud hosting, etc?

Seems like an appropriate place to share https://github.com/agarrharr/awesome-cli-apps

I’m a fan of ripgrep and lsd in particular.

Check out the fzf docs. It ships with helpers that offer better shell integration than you’re getting here.

Tiling WM that you are not sure you want to get into: Sway. It’s a great alternative to i3 IMO.

What I use when I care to put in the effort of setting something up in great detail: Enlightenment. Some may argue that it’s not “lightweight”, but you can readily include only the bits you want, and avoid things like network config guis and system tray apps or whatever it is that you don’t want. Even when you’re using “all the things” which is not technically “lightweight” what it IS is performant. Oh, it’s also very pretty.

In addition to many of the fine points made in other comments I think it’s silly to overlook the power of celebrity worship and weird-ass parasocial relationships with famous people.

There exists a large number of people who aren’t really interested in discussing <topic_x>, they just want to know what <favourite celebrity whos life I have deluded myself into thinking is attainable by me> thinks about the topic so that they can regurgitate it and feel like they’re “the same”.

I’m sure if Chappell Roan or whatever “the kids” think is cool these days had jumped to Mastodon we’d be seeing something very different. TBH I’m mildly surprised that we didn’t see more record labels standing up instances. It’s always boggled me that people have just trusted the service desperately trying to be known as “X” as an authority on identity.

I saw the lack of arm and facepalmed but I was half asleep poo posting so got over it :p (fixed now!)

I’ve been using this device for ~5 years now, so my memory is a little hazy on it, but I’m pretty sure for the particular device I prefer (which is to say, I have nfc what the setup is for other vendors, which could be greatly superior) the AES-256 key used for encryption isn’t generated until you setup your first card.

How would any company, regardless of geography have the secret I generated? This is a stand alone hardware device. They seller is not involved at all once I’ve received my package.

Could a sophisticated/well resourced actor clone the smart card they stole or you lost? Sure, brute force attacks are brute force attacks. At least you’d know your device and card are stolen. Now you’re in a race to reset your passwords before they finish making 500 clones of the smart card they stole.

Hypothetically I could blackmail someone at LastPass and have a backdoor is installed for me.

Someone could bust down my door while I have it connected and unlocked and just login to all my things. ¯\_(ツ)_/¯

That will vary from vendor to vendor. In the case of the one I like there are a few relevant things.

The password db is stored encrypted on the device. Accessing the passwords requires all of:

• the device
• a smartcard with a particular secret on it
• the 4 digit hex pin to unlock the secret on said smartcard, which is what is used to decrypt the db

Three PIN failures and the smart card is invalidated.

That sort of covers “stolen” and “lost + recovered by a baddie”. Your bad actor would need to have their hands on both physical pieces and guessed the 4 digit hex code in 3 tries.

As far as a user recovering from a lost or failed device or smart card goes, you can export the encrypted version of the db for backups, which I do to a thumb drive I keep in my document safe. I do the same with a backup smart card. So that and a backup device or purchasing a new one if yours fails or is lost/stolen.

In the super “just in case” move, I also keep a keepassdb on said thumb drive. In case my device fails and it’s just not possible to get a new one. Kind of like keeping two cloud providers in case LastPass goes bankrupt or something.

I’m a pretty big fan of the mooltipass. They’re sold out and between iterations right now, but a new one is expected soon. One of my coworkers is pretty into their OnlyKey.

So many folks talking about which software they use, and how they sync it between devices etc.

You all know there are hardware password keepers right? They present to your devices as a usb and/or bluetooth keyboard and just type out the user/password that you select. They have browser plugins to ease the experience. Now your password is not even stored on the device you’re using to perform your login and it will work on any modern device even without internet access.

Oh and no subscription fee to cover the costs of cloud infrastructure.

E

Why do people do this? There is neither a clubhouse sandwich or any fries in this image.

This looks like a great lunch but why is it so common to call things what they aren’t? “Fries” isn’t a shape. Apple sticks? Slices? Roughly julienned apples?

Put pork flavoured soy on whatever you want, but why the need to call it vegan bacon ya know?

Hot metal + arm = Smiley Face