• 1 Post
  • 57 Comments
Joined 3 years ago
cake
Cake day: August 9th, 2023

help-circle
  • The way Frenck handled the tone initially was mostly okay, though he really should have properly addressed the concern with details as he did in his final comment. The comments in between are pretty dismissive, I agree.

    That said, there’s no real issue of information being leaked. The first 5 characters of a hash are all but useless to an attacker. Admittedly, it does raise the attack surface very slightly, and should be opt in instead of opt out. Or at the very least be enabled by default and presented during onboarding.

    That said, there’s way this works doesn’t ring any alarm bells to me.


  • The comparison is done by hashing your password, sending some of the first few characters of the hash to HIBP, receiving hashes that match that pattern, then locally comparing the full hashes.

    So there’s no concern that credentials are being leaked (despite the other post earlier this month insisting HA was leaking all your secrets) as you can’t really leak a password with a partial hash (you can narrow an attack surface very slightly, I admit), and all actual true comparisons are done locally.



  • The ability to do it aside, if feel it should be brought up that handing off things like this can lead to giving anything that gets through an “unofficial seal of approval” so to speak.

    “This email looks phishy, but AI says it’s safe so I’ll ignore my initial concerns” is going to inevitably happen.

    There’s also the fact that using a model to detect scams, means you can use that same model to train a different model on how to build scams that bypass the detection.

    This also feels a little like a hammer looking for a nail. There have been tools to handle this without the insane computational requirements of an LLM for many years.













  • Two things, an ssd and a motherboard, both with heat sinks built in. You can’t use both heat sinks. One of them has to be removed, and OP chose the wrong one based on the incorrect assumption that the heatsink on the ssd was not held on with such a strong adhesive.

    You come in here with essentially “lmao you’re an idiot why would you remove the heatsink? The engineers know what they are doing why would you know better?”

    So if they should remove neither of the heat sinks, since an engineer put them both where they are, they should just throw out the drive?