Just your average Reddit refugee.

  • 0 Posts
  • 8 Comments
Joined 1 year ago
cake
Cake day: June 13th, 2023

help-circle



  • I feel like this needs to be pushed back on a little bit. Don’t let perfect be the enemy of the good. Having a password manager that provides good passwords and TOTP as a second factor is way better than only using a password.

    Sure, it would be nice if you had two devices. A phone password manager and a usb security key, but for many people it is inconvenient to carry a security key to plug when you need it. I’d rather that person keep a TOTP on their phone in that case rather than not use two factor due to inconvenience.

    Your concern is mostly about “what if someone steals your phone or computer” then they have both factors. However, your average person isn’t getting hacked by someone they know, and random local thieves aren’t typically sophisticated enough to do more than re-sell stolen computer equipment. The average person is getting hacked by some dude in a foreign country who dumped a password database or phished a password. That person isn’t stealing your device so the fact that both factors are in the same place doesn’t really mean anything.

    Also, most password managers are locked by biometrics these days. In that case, it isn’t really the app that is the second factor. It is your fingerprint or face. Someone may steal your device, but if they can’t get into the password manager that needs a password and biometrics then they don’t have anything.



  • Now I think I see what you are saying. People have suggested that Lemmy needs a separate protocol to connect with other Lemmy instances to more efficiently synchronize. Gossipsub could do that. It would also be nice if each Lemmy instance only needed to keep a minimal amount of data at any one time to service the clients that connect to it while the rest exists in the swarm.

    I still don’t think that you would want a phone to function as your server and your client, though. All that coordinating takes bandwidth and processing power. Phones are ill-equipped for that. Also, usually to p2p effectively you need to be able to make direct connections through firewalls. Opening your phone directly to the Internet would be a bad idea, plus I doubt any phone companies would let you do that. Without a direct connection, you would need to proxy your connection through some server somewhere and deal with bandwidth costs. Might as well just connect to a server as a client.

    Maybe the final solution is software like Lemmy running with decentralized identities via the Nostr protocol that is federated out using Gossipsub.


  • Then the p2p network is really the “server” and the phone is still just a client. I’m also not sure that a p2p network could be queried very well because something would have to be able to produce aggregated and sorted results. It isn’t like pulling one file from a swarm. It would be like a blockchain and the phone would have to download the whole dataset from the p2p network before running queries on it.

    What you are talking about sounds kind of like the Nostr protocol. It is a distributed social network trying to solve the same problem that ActivityPub is but in a slightly different way. All the events are cached on multiple relays and the client applications query those relays looking for information that gets aggregated and sorted on the client however it wants.


  • ActivityPub is all about pushing content around to subscribing servers. It sort of expects the subscribers to always be online which would not work for a phone. Servers could resend missed events, but essentially you would miss every event that occurs while the phone is asleep or doesn’t have the app running.

    Also, every event that occurs needs to be processed and stored whether or not you are actively looking at it so it would be a huge battery drain while it was running.

    It is definitely a service best run on an always-on server with a client application in a phone just asking the server for the latest stuff on-demand.