• 1 Post
  • 14 Comments
Joined 3 years ago
cake
Cake day: December 20th, 2021

help-circle









  • It protects you against your PC being compromised but it doesn’t protect you from someone stealing the device, assuming they have the necessary expertise to read the keys out of the device.

    A regular laptop thief will have no idea what they’re looking at though, so it does have some value as a physical security (through obscurity) device.

    Ultimately it depends on your threat model. If you never leave the house then it’s an upgrade from a software password manager.



  • The author only mentions homomorphic encryption in a footnote:

    Notes:

    (A quick note: some will suggest that Apple should use fully-homomorphic encryption [FHE] for this calculation, so the private data can remain encrypted. This is theoretically possible, but unlikely to be practical. The best FHE schemes we have today really only work for evaluating very tiny ML models, of the sort that would be practical to run on a weak client device. While schemes will get better and hardware will too, I suspect this barrier will exist for a long time to come.)

    And yet Apple claims to be using homomorphic encryption to provide their “private server” AI compute:

    Combining Machine Learning and Homomorphic Encryption in the Apple Ecosystem

    Presumably the author doubts Apple’s implementation but for some reason has written a whole blog post about AI and encryption and hasn’t mentioned why Apple’s homomorphic encryption system doesn’t work.

    I’d be quite interested to know what exactly is the weakness in their implementation. I imagine Apple and everyone who uses their services would be interested to know too. So why not mention it at all?




  • This breach is worse than just a website’s database being leaked. These are info-stealer malware logs. Meaning that you had malware on one of your devices that recorded you typing your credentials into websites and then the logs of that malware were publicly leaked.

    Before changing all of your passwords (and setting up a password manager if you don’t already use one) you need to identify which of your devices was compromised and wipe it.

    If you change all your passwords from the compromised device then the malware will just record all of your new passwords.