Amolith / is on Nostr

Small business owner, professional musician, sysadmin, and founder of NixNet, a collection of open source and privacy-focused services I make available to anyone for free

I also co-host the Linux Lads podcast
@[email protected]
https://linuxlads.com

#fedi22 #linux #musician #sysadmin #developer #technology #vim #emacs #doublebass #bluegrass

Last Notes

2024-03-26 20:55:11

This might end up being a bad idea :akko_woozy:
https://sr.ht/~amolith/willow/#collaboration
#Willow

2023-12-31 02:18:06

> Enjoy thousands of shows ad-free … some shows may have ads
So … let me get this straight … I would be paying to not see ads … and I would still see ads … :neofox_what:

2023-10-24 05:27:31

My password thing has been given a better name :neocat_approve:
https://git.sr.ht/~amolith/wyrd
It's a self-hosted tool that allows you to receive credentials from clients end-to-end encrypted using age.
https://github.com/FiloSottile/age
https://nixnet.social/media/cfd79de27ad7a029626b6bbb4f07bb1378270b4f772a44580bfbd20d34d765ac.png?name=
https://nixnet.social/media/2867b68c896bf788daff9ad775791f6fe816c731c87d8155050373b68b4203de.png?name=

2023-09-27 07:07:39

I just publicly open sourced a tool I wrote last year
I often log into services to manage things on behalf of clients, so they have to send me their credentials for those services. I dislike asking them to send sensitive information over SMS or email, so I built this. The user fills out a form, that data is parsed and encrypted entirely in their browser using a WASM wrapper for age, the ciphertext is passed to the backend, and the backend forwards it to a list of email addresses.
Please suggest some better names! :neofox_cry_loud:
https://git.sr.ht/~amolith/password-thing/

2023-09-17 19:49:53

- reply

@npub1q5l…ywp3
> The only password that needs memorizing is the password manager. All others should be auto-typed.
You also need to decrypt the disk if you're using FDE, log into the machine, then decrypt your password manager. Those are three passwords that should be memorised and can't be auto-typed.
> they should never be typed in the first place let alone memorized
I disagree on both counts.
Memorising a password is perfectly fine and even desirable in some situations. However infeasible, password managers can be cracked. Unless you're tortured or drugged, odds are good that your brain can't be.
Manually typing passwords is 100% necessary when you're logging into many machines often, like we have to do because we set machines up for internal use and for clients. It's also necessary when logging into things on machines that don't have an installed password manager.
> All others should be auto-typed. Do not use clipboards either.
I wish these were feasible, but they're not. Bitwarden is the password manager I always recommend because it's open source, the cryptography is very strong, and the free tier is perfectly sufficient for the vast majority of people. Their desktop app is electron 🤮 and doesn't support any form of auto-type and likely never will because electron 🤮. Many other password managers are exactly the same. The only one I know of that has auto-type off the top of my head is KeePassXC and shell scripts that use xdotool/ydotool with pass or gopass or one of the other implementations.
Manually typing passwords is only a problem if there's a physical keylogger between your keyboard and the password field. If it's a software-based keylogger, auto-type from your password manager is exactly the same as manually typing them. I agree that it's always best to avoid using a clipboard, but imo that's just not a feasible mandate in the real world.

2023-09-17 19:10:08

I would appreciate it if someone could review this and maybe give some critiques or organisation suggestions. One of my clients is convinced that his 10-character random password is significantly more secure than my 7-word passphrase just because passphrases can be susceptible to dictionary attacks.
So I did all the math and presented it with explanations and I want to make sure it's correct and understandable before I send it to him
https://wiki.secluded.site/hypha/passwords_and_passphrases

2023-09-07 19:48:01

why not matrix?
https://telegra.ph/why-not-matrix-08-07
The author managed to put all my gripes with this absolutely _horrendous_ protocol on one page