Client side verification is just security by obscurity, which gains you very little.
If someone is capable of MITM attacking a user and fetching a password mid-transit to the server over HTTPS, they are surely capable of popping open devtools and reverse engineering your cryptographic code to either a) uncover the original password, or b) just using the encrypted credentials directly to authenticate with your server without ever having known the password in the first place
I got this last one, and I’ve gotten it a handful of times over the past 5-10 years. They only send it out to a small % of their userbase each time
You are acting like someone checked off a “log passwords” box, as if that’s a thing that even exists
Someone configured a logger to write HTTP bodies and headers, not realizing they needed to build a custom handler to iterate through every body and header anonymizing any fields that may plausibly contain sensitive information. It’s something that literally every dev has done at some point before they knew better.
This is only true for steam keys sold on other platforms afaik
It’s not uncommon to see certain sites to only work on chromium because the dev used the filesystem APIs that don’t exist on FF
Yes but if it’s first instinct is “go left” on 1-2, it’s pretty apparent the reward function could use some tuning
More, but not way more - they would be licensing window IoT, not a full blown OS, and they wouldn’t be paying OTC retail rates for it.
You will probably have waaaay more issues trying to get the windows client working through wine than dealing with any hiccups on the Linux client. It was buggy but passable like 5-6 years ago so I’m sure it’s much better now
You can try running it through a VM first before making the switch - 3d performance will be horrendously bad, but at least it will give you some piece of mind.
If unity gives a different download for each, you would have the best luck with whatever version matches closest (so the 22.04 download on current pop_os). Basically the more system dependencies the program has the more likely you will run into conflicts installing on a mismatched OS, but it isn’t guaranteed to cause problems (e.g. program requires openSSL version 1.2, but my OS ships with 1.1). I think unity just bundles everything with the binary, so it should be fine.
For what it’s worth, i used it on Ubuntu back when it was still in beta and it was super buggy (the installer and account stuff mostly, the engine itself seemed ok), so hopefully their Linux offering has since improved.
Anything that says it works on Ubuntu should 99.9999% likely work on Pop, because pop os is built from the Ubuntu package base
lol. Did this in my old building - the dryer was on an improperly rated circuit and the breaker would trip half the time, eating my money and leaving wet clothes.
It was one of the old, “insert coin, push metal chute in” types. Turns out you could bend a coat hanger and fish it through a hole in the back to engage the lever that the push-mechanism was supposed to engage. Showed everyone in the building.
The landlord came by the building a month later and asked why there was no money in the machines, I told him “we all started going to the laundromat down the street because it was cheaper”
If you know the key is composed of English language words you can skip strings of letters like “ZRZP” and “TQK” and focus on sequences that actually occur in a dictionary
You don’t memorize RSA keys
No im saying if your password size is limited to a fixed number of characters, as is the case with RSA keys, words are substantially less secure
“can you string words to form a valid RSA key”
“Yes this is the most secure way to do it”
“No, it’s not when there is a fixed byte length”
-> where we are now
Sure but we aren’t talking about that
You memorize your RSA keys?
Words are the least secure way to generate a password of a given length because you are limiting your character set to 26, and character N gives you information about the character at position N+1
The most secure way to generate a password is to uniformly pick bytes from the entire character set using a suitable form of entropy
Edit: for the dozens of people still feeling the need to reply to me: RSA keys are fixed length, and you don’t need to memorize them. Using a dictionary of words to create your own RSA key is intentionally kneecapping the security of the key.
No it doesn’t, if they intercept an encrypted password over HTTPS they can resend the request from their own browser to get access to your account
What is the problem with that? The password is secure and only shared between you and the site you are intending to communicate with. Even if you sent an encrypted password, they wrote the client side code used to generate it, so they can revert it back to its plaintext state server side anyways
How would you verify it then?
If not sending plaintext passwords was best practice then why do no sites follow this? You are literally posting to a site (Lemmy) that sends plaintext passwords in its request bodies to log-in