• 0 Posts
  • 38 Comments
Joined 1 year ago
cake
Cake day: June 22nd, 2023

help-circle



  • Saw this question posted elsewhere, so I’m paraphrasing somebody else, but the privacy benefits of Graphene OS are ESPECIALLY impactful if you’re using invasive apps. The whole point of setting up all of the extra sandboxing, storage limits, network restrictions, yadda yadda yadda, is specifically for people who might need or want to still leverage some apps from bigger, less trusted providers.

    I’ll flip the question, if you’re only using trusted, vetted, open source applications, do you even need GrapheneOS? Why not LineageOS, which also comes free of gapps?

    And this also fully neglects the inherent distinction between privacy and security. Maybe you trust google knowing you called your mom last night, but you don’t want your oppressive conservative government accessing your phone to view your Signal messages to your Grinder date. There’s more to privacy than just the number of times your phone pings Google Telemetry servers.



  • Honestly I don’t know, but it seems to me like extracting every single frame of a video as a lossless PNG is only really something that’s necessary if you’re trying to archive something or do frame by frame restoration. Either way, it is something that you hopefully aren’t doing every day, so why not just let it run overnight & move on?

    Otherwise ask yourself if you can settle with just extracting a single clip/section, or what’s actually wrong with lossy jpeg with a low -qscale:v (high quality) - start around 5 and work down until you visually can’t see any difference





  • Worst thing? Someone with access to your password can now break into the associated account, and use that access to snoop or potentially permanently lock you out. E2EE data could be lost forever if they change the password and 2FA.

    More likely? Unless you reuse passwords, or the associated site has been recently compromised, pretty low odds of compromise. If you suspect your 2FA has leaked, just get a new secret, easy peasy. Most reputable sites should alert you to a login on a new device, potentially giving you time to react or alerting you of snooping.

    If your secret leaks without context on what site it’s associated with, then unless your name is Taylor Swift, odds of someone associating it to a site, let alone the matching password, are astronomical.










  • capture the generated codes and time of input in some way, then brute force hashes until they generate one that produces the correct codes at x time

    Given a TOTP key is usually at least 18 characters for a 6-digit code, having only one data point sticks you with something on the order of 10^28 possible keys for a given singular code (way more if case sensitive). You’d need to be regularly intercepting TOTP codes to brute force your way to the right key, and even then it’d only be valid for a single site. At that point it probably means you’ve fully compromised the connecting device or server, at which point, why do you even need the TOTP again?