>Like all recovered edgelords who came of age in the early 2010s, I somewhat miss the heyday of image-boards like 4chan. They were the final bastion of the wild-west early internet before the nazis ruined everything.
Extremely true. I don't know anywhere like those times these days. Where do the young people/trolls hang out and push to the edge of acceptance these days? Or is the culture of "getting right to the edge of getting banned but not crossing the line for lulz" and "act in a way nobody knows whether you're actually trolling or not" dead?
I want to argue that there are some rose-tinted glasses at play. /b/ (which is what most people think of when they think about 4chan) has been considered "no longer good" since at least 2006 [1], probably earlier. And even by that time they were already organizing raids and causing real harm to communities, both online and offline.
I'm not sure that it's 4chan the one who has changed but rather that the world got a lot more connected [2]. A 2010 edgelord may say "pool's closed" while a 2025 edgelord may say "it was a Roman salute", but the spirit behind is probably the same.
As the other poster pointed out, /b/ was never good;).
But:
>A 2010 edgelord may say "pool's closed" while a 2025 edgelord may say "it was a Roman salute", but the spirit behind is probably the same.
I think I disagree. I don't think "pool's closed" was ever boosted into the mainstream, nor was it legitimized across truly fascist or racist communities; it was an internet meme for internet people. "It was a roman salute" is a phrase of normies that likely have limited experience with computers and online communities; without getting into the politics, a certain class of people actually believe "it was a roman salute". "pool's closed" meant nothing outside of specific communities.
“Any community that gets its laughs by pretending to be idiots will eventually be flooded by actual idiots who mistakenly believe that they're in good company.“ (https://news.ycombinator.com/item?id=1012082)
Having been an early user of 4chan back in late 2003, from what I saw, the tone shift of nazi stuff just being edgy belligerence for the shock value to people saying “no really, this is my serious political ideology” really got traction somewhere around 2012-2014. Prior to that, there was still pushback. Much like how the idea of having a “waifu” was originally a derisive joke, but somehow turned into actual practice.
This coincided with a few things, massive increase in internet use, raids having increased 4chans notoriety, but most importantly it was the timeframe when Russia prepared for and invaded invaded crimea, which included ramping up “active measures” to shift conversation with troll farms/propaganda. 4chan (and later, 8chan, which had a huge population of boomers buying into “qanon” nonsense) became an ideal host to try to amplify disruptive propaganda.
I didn’t quite notice what was going on, since by that time I was mostly only on select boards like /tg/ or alt chans like operatorchan, but the Russian influence became obvious in the lead up to the 2016 election.
And it wasn’t just nazi stuff, it was all sorts of bullshit like Marxism, esoteric magic and conspiracy shit that was being thrown around to see what stuck. And they were active across every social media site. Though as bad as 4chan was, I’d argue russian presence on Facebook and twitter was especially harmful and far reaching. They didn’t even need to be subtle or target groups: https://qz.com/1284222/russian-facebook-ads-were-barely-targ...
All of this 100%. And on a more personal level, while I had a grand old time as a 3edgy5me t(w)eenage boy on the early, "free" internet, that time has left me with numerous mental scars I carry with me every day.
- Thanks to shock sites, for showing me things a 13 year old kid really should not be seeing, and I wish I meant something as banal as pornography. I'm still occasionally haunted by images I've seen to such a degree where I have to take short breaks at work to compose myself.
- Thanks to political discussion boards, which turned important, real life issues and global problems that have genuine life or death stakes for people who weren't me into an alternative to sports that also let me pretend I was in any way intellectually superior to my peers for simply being willing and able to regurgitate conservative political propaganda that I barely comprehended.
- Thanks to the entire thing, for helping me nurture a shut-in mentality, that other people were too much work to be worth it, that my peers were dumb and not worth my time, that they wouldn't understand me at all and so involving myself in school was completely pointless, ensuring I would have no social life or skills whatsoever when I graduated high school and later college. Instead you gave me an entire other world of similarly uninformed, loud assholes to live in that would completely dissolve by the year 2009, leaving me 20 years old with no idea who the fuck I was, or what I believed in, ripe for recruitment into reactionary politics that would make me an insufferable douchebag for the next 10 years or so until I managed to pull my head out of my ass.
Community size and reach plays a big part in this.
Aside from the the whole "Am I trolling as a racist or am I a racist trolling?" issue, communities get away with a lot more when they are smaller, more insular and more hidden from the public. Once the community starts to bleed out beyond the immediate site, you start to run into issues. Not just because the jokes and content are spreading, but the attitudes behind those jokes. And those attitudes (even if they make up just a portion of the users) have a tendency to not be great.
I think a perfect example of this would be what happened on Reddit with the /r/antiwork subreddit. As soon as the community got too large and started spilling into other areas of the site, the cracks started to show. Culminating with the interview by one of the mods (?) on Fox News I believe. All of a sudden a chunk of the users are questioning "Wait, this is who I'm siding with?" and then the only people left are the people who aren't bothered.
Well said, and I think it extends to many communities which are founded on negativity of some sort: eventually people move on, except for those so-filled with negativity, it is all they have.
I think a part of what happened has to do with
>"act in a way nobody knows whether you're actually trolling or not"
Some people were joking and some weren't, or were just too dim to understand that it was a joke, and then when they all showed up in Charlottesville to march. They were mostly serious except for that one poor guy who still thought it was a meme and ran away.
"Any community that gets its laughs by pretending to be idiots will eventually be flooded by actual idiots who mistakenly believe that they're in good company." -Rene Descartes
They're still around, they just happen to be on X/Telegram.
Roughly speaking they're in two camps: Groypers and BAP-adjacent Yarvinites. I suppose both are "Nazi" in the sense they are anti-intellectual and anti-egalitarian. Some are paid. Some do it for free.
I don't see much of an equivalent on the left, maybe extreme far left Zizarian types or femcel/misandrists.
There is a ton of content with dark jokes, black humor, very provocative content and even "nazi" memes and people send it to each other to laugh about it.
Those reels usually have very few likes / comments but A TON of sends. I personally am on multiple group chats where we only send each other those kind of memes.
The thing is, instagram being a huge echo chamber. Before you have no idea those exists, and once you are in you see a ton of those
The echo chamber on Instagram is deep. Even when there are a ton of comments, they’re sorted beginning with the most “relevant” (i.e. worldview affirming). So if you’re viewing a controversial video, you’ll see comments echoing your own beliefs, and others will see the opposite. You’ll both move onto the next video thinking “wow, everyone agrees with me!”
I deleted instagram last year and haven’t reinstalled it. Those reels are so addicting. I’m glad I never installed TikTok because I imagine it’s just as bad. I still suffer from YouTube Shorts but at least the mobile web UI is janky enough to eventually push me out of its trance.
Instagram is a special level of degeneracy. That is an app made for the masses. I never used tik tok, but youtube shorts gives me actual quality content while instagram feels like its gunning for a mix of reality TV, post 2005 history channel, and animal brain fondling.
Although I will admit that Instagram has their advertising insanely dialed in. The content is gross junk food but the ads I have actually clicked before.
TikTok has the same issue. Two people can see the same video, come to opposite conclusions, and only see comments that agree with them.
TikTok is maybe the last bad echo chamber of the big short video platforms: stitches encourage some sort of debate and expose you to snippets of opposing view points, and the algorithm gives you at least a chance of finding new types of content you also like. But it's only the least bad, it's still very bad. Especial once you factor in your own confirmation bias and the comment algorithm
Or is the culture of "getting right to the edge of getting banned but not crossing the line for lulz" and "act in a way nobody knows whether you're actually trolling or not" dead?
Yup, among the sane! If there are any bastions left, we’re working on eradicating them. Honestly kinda baffled someone could type this sentence with the implication that this is a good thing…
>Yup, among the sane! If there are any bastions left, we’re working on eradicating them
The communities of trolls trolling trolls have been replaced by larger communities of nazis training nazis to attack and terrorize. Thank you for eradicating the former, paving way for the latter.
I have one of those time-based number hardware fobs, with the 6-digit 7-segment LCD display, which I'd guess I'd actuated less than 100 times, yet on one such actuation, it displayed 1-2-3-4-5-6.
Maybe because the whole mode when using it is infosec, my snap first thought was about how this is highly unlikely and is someone messing with me.
My next thought was to run to get a camera from the other room, regardless of whatever is going on.
By the time I got back with a camera, and just barely missed photographing the display, I realized that someone compromising my airgapped self-contained hardware fob was even more unlikely than this number sequence coming up randomly within 100 actuations.
And, like this article points out, there are many "unlikely" numbers that might come up, so the chance of any of them is not as unlikely as it would first seem until you thought about it.
I was driving my wife's car a few years ago when I managed to look down and see that the temperature was 55 degrees, and the odometer read 55,555. For a split second I couldn't believe my eyes; what are the chances?
That this-can't-be-correct reaction can be useful in emergencies, if it gets your attention, and activates a mode in which you can focus and act decisively in an instant.
I once was applying a spray-can anti-slip treatment to a bathroom floor, when I might've heard a whoosh, looked up, and had a thought (that I remembered afterwards as) "fire shouldn't be coming from that direction".
From the adjacent room, there was this flash fire shooting across the floor at me.
That got my attention, and activated an emergency mode, parts of which I had no recollection. I somehow leapt backwards up onto the tub edge in an instant. Then the floor was on fire and lapping at the walls of the small bathroom I was in. The next thing I knew, I'd leapt over the flame, into the next room, somehow gotten the fire extinguisher from inside a cabinet, and was putting out the fire. Which worked nicely.
Then, I guess, as that mode was winding down, without really thinking about it, I put the exhausted fire extinguished back in its spot in the cabinet. As I went to call the fire department to check out that there were no lingering problems.
(Turned out that the floor treatment application also emitted a highly flammable gas, which rolled across the floor, into the next room, until it hit the pilot light in an old nat-gas oven.)
Now, if we had an adrenaline reaction every time we saw unlikely numbers, that would be a problem. But, however the cognitive scientists deconstruct it, I'm fond of having what I'll call a good emergency mode feature.
Based on NOAA weather data, a rough estimate for the probability of experiencing exactly 55°F at any given time in temperate U.S. cities is around 2-5% on average
Cute, but ultimately cute features are not compatible with a critical security application.
If it had been developed as a feature of an existing application maybe it would fly (and probably even not there). But as a third party app, or even a third party library that needs to be added to the security supply chain? Not a chance for any serious business.
Yeah, unfortunately "Easter eggs" call into question the security of the software pipeline.
Did PMs and other engineers review and OK this? -> Suggests a lack of judgement or just rubber-stamping.
Did a lone engineer add this "just to be cute", and it didn't get caught and stopped? -> Proof that your development/release processes are insufficient and you are intensely vulnerable to insider threats.
Neither is good for a security product. At a previous company we were explicitly told that any easter egg was an immediate firing. The company's products had a long history of easter eggs before that.
This doesn’t mean every app has to be fun. If I want to have fun, I’ll go play with something specifically built for fun. If I’m balls deep in an incident and suddenly my MDM security policy login TTL expires and I have to reauthenticate, the last thing I want to see is yet another interstitial with some cutesy BS to nuke my working memory.
Sidetrack but this is interesting wording, what do you mean exactly? As in some software that is accesory to other software? Or something that you have to access while moving between software?
Complete tangent: "voila" is French for "here it is", but "viola" is French for "raped". Careful using foreign words if you're not sure you can spell them.
Viola also means purple/violet or the instrument. Let's try to be more chill about people making typos, nobody, even a fluent French speaker would read it as "raped". Only someone with a keen eye for drama and being a nuisance.
I think this is a bad idea and insecure. Obtaining a code needs to be an intentional effort and not just available to someone who happens to be screen surfing my phone at the right time. It's worse that it's on the lock screen as it seems the author does based on their screenshots. Lose your phone, and your passcode will not protect someone from using your codes.
That’s a fun little Easter egg! It’s always cool to see small details like this that add some personality to otherwise routine tasks. Makes me wonder what other quirky things could be hidden in security tools without compromising functionality.
TOTP seeds are only useful if you have the account they are associated with. How would the 2fa app by some random guy discern the identity associated with the seed?
Isn't one issue the display of the codes on the lockscreen? If viewing notification contents there is enabled, it would be problematic if it popped up while you were away from your device to say "Your Google 2fa is 100000 right now". I get that the iOS default requires unlock to view the actual content of the notification, but still, that seems less than perfect from a security standpoint.
Notifications say nothing about the account - just that you got this cool number on the app. And yeah you need the device unlocked to read the notification anyway
But yeah security concerns with it are overblown, the more realistic concern is trusting me personally vs a name brand!
To add an item, you scan a QR code. That QR code usually contains the name of the service and your username. For example, the format of Github's QR code is:
What? The same way that when you look at the 2fa codes in your app you know which account they are associated with. The qr codes people typically scan for that do not just contain the seed itself but metadata for the account associated with it like email address or account name.
What if one bad actor does it not initially do that, but only after the app has enough users, with a random upgrade? Not that _you_ would do that, of course. But it makes sense that people are wary about where they trust their TOTPs.
Some time ago people were locked out of their TOTPs because some guy bought their app from its creator and turned it into ransomware having them pay to not lose their codes.
Dubs and I upvote.
>Like all recovered edgelords who came of age in the early 2010s, I somewhat miss the heyday of image-boards like 4chan. They were the final bastion of the wild-west early internet before the nazis ruined everything.
Extremely true. I don't know anywhere like those times these days. Where do the young people/trolls hang out and push to the edge of acceptance these days? Or is the culture of "getting right to the edge of getting banned but not crossing the line for lulz" and "act in a way nobody knows whether you're actually trolling or not" dead?
I want to argue that there are some rose-tinted glasses at play. /b/ (which is what most people think of when they think about 4chan) has been considered "no longer good" since at least 2006 [1], probably earlier. And even by that time they were already organizing raids and causing real harm to communities, both online and offline.
I'm not sure that it's 4chan the one who has changed but rather that the world got a lot more connected [2]. A 2010 edgelord may say "pool's closed" while a 2025 edgelord may say "it was a Roman salute", but the spirit behind is probably the same.
[1] https://en.wikipedia.org/wiki/Talk:4chan/Archive_4#Death_of_...
[2] https://ourworldindata.org/grapher/number-of-internet-users
As the other poster pointed out, /b/ was never good;).
But:
>A 2010 edgelord may say "pool's closed" while a 2025 edgelord may say "it was a Roman salute", but the spirit behind is probably the same.
I think I disagree. I don't think "pool's closed" was ever boosted into the mainstream, nor was it legitimized across truly fascist or racist communities; it was an internet meme for internet people. "It was a roman salute" is a phrase of normies that likely have limited experience with computers and online communities; without getting into the politics, a certain class of people actually believe "it was a roman salute". "pool's closed" meant nothing outside of specific communities.
You know the meme. /b/ was never good.
“Any community that gets its laughs by pretending to be idiots will eventually be flooded by actual idiots who mistakenly believe that they're in good company.“ (https://news.ycombinator.com/item?id=1012082)
Having been an early user of 4chan back in late 2003, from what I saw, the tone shift of nazi stuff just being edgy belligerence for the shock value to people saying “no really, this is my serious political ideology” really got traction somewhere around 2012-2014. Prior to that, there was still pushback. Much like how the idea of having a “waifu” was originally a derisive joke, but somehow turned into actual practice.
This coincided with a few things, massive increase in internet use, raids having increased 4chans notoriety, but most importantly it was the timeframe when Russia prepared for and invaded invaded crimea, which included ramping up “active measures” to shift conversation with troll farms/propaganda. 4chan (and later, 8chan, which had a huge population of boomers buying into “qanon” nonsense) became an ideal host to try to amplify disruptive propaganda.
I didn’t quite notice what was going on, since by that time I was mostly only on select boards like /tg/ or alt chans like operatorchan, but the Russian influence became obvious in the lead up to the 2016 election.
And it wasn’t just nazi stuff, it was all sorts of bullshit like Marxism, esoteric magic and conspiracy shit that was being thrown around to see what stuck. And they were active across every social media site. Though as bad as 4chan was, I’d argue russian presence on Facebook and twitter was especially harmful and far reaching. They didn’t even need to be subtle or target groups: https://qz.com/1284222/russian-facebook-ads-were-barely-targ...
Trump being a meme is what got him off the ground. And here we are.
All of this 100%. And on a more personal level, while I had a grand old time as a 3edgy5me t(w)eenage boy on the early, "free" internet, that time has left me with numerous mental scars I carry with me every day.
- Thanks to shock sites, for showing me things a 13 year old kid really should not be seeing, and I wish I meant something as banal as pornography. I'm still occasionally haunted by images I've seen to such a degree where I have to take short breaks at work to compose myself.
- Thanks to political discussion boards, which turned important, real life issues and global problems that have genuine life or death stakes for people who weren't me into an alternative to sports that also let me pretend I was in any way intellectually superior to my peers for simply being willing and able to regurgitate conservative political propaganda that I barely comprehended.
- Thanks to the entire thing, for helping me nurture a shut-in mentality, that other people were too much work to be worth it, that my peers were dumb and not worth my time, that they wouldn't understand me at all and so involving myself in school was completely pointless, ensuring I would have no social life or skills whatsoever when I graduated high school and later college. Instead you gave me an entire other world of similarly uninformed, loud assholes to live in that would completely dissolve by the year 2009, leaving me 20 years old with no idea who the fuck I was, or what I believed in, ripe for recruitment into reactionary politics that would make me an insufferable douchebag for the next 10 years or so until I managed to pull my head out of my ass.
So well put. This should be posted every time someone is nostalgic of those times.
I'm not pro-walled garden, all is dandy and barbie but there is an opposite extreme.
For me the most fun time as a teenager was role-playing on forums: free, fun and harmless.
> I'm still occasionally haunted by images I've seen to such a degree where I have to take short breaks at work to compose myself.
This is PTSD. Get checked out.
Community size and reach plays a big part in this.
Aside from the the whole "Am I trolling as a racist or am I a racist trolling?" issue, communities get away with a lot more when they are smaller, more insular and more hidden from the public. Once the community starts to bleed out beyond the immediate site, you start to run into issues. Not just because the jokes and content are spreading, but the attitudes behind those jokes. And those attitudes (even if they make up just a portion of the users) have a tendency to not be great.
I think a perfect example of this would be what happened on Reddit with the /r/antiwork subreddit. As soon as the community got too large and started spilling into other areas of the site, the cracks started to show. Culminating with the interview by one of the mods (?) on Fox News I believe. All of a sudden a chunk of the users are questioning "Wait, this is who I'm siding with?" and then the only people left are the people who aren't bothered.
Well said, and I think it extends to many communities which are founded on negativity of some sort: eventually people move on, except for those so-filled with negativity, it is all they have.
I think a part of what happened has to do with >"act in a way nobody knows whether you're actually trolling or not"
Some people were joking and some weren't, or were just too dim to understand that it was a joke, and then when they all showed up in Charlottesville to march. They were mostly serious except for that one poor guy who still thought it was a meme and ran away.
There was even an old 4chan joke for this:
"Any community that gets its laughs by pretending to be idiots will eventually be flooded by actual idiots who mistakenly believe that they're in good company." -Rene Descartes
The amusing thing being that the original source of this is hn, not 4chan [1]. deserves a spot on https://news.ycombinator.com/highlights imo.
[1]: https://news.ycombinator.com/item?id=1012082
> Where do the young people/trolls hang out and push to the edge of acceptance these days?
Discord. It's all underground. The public internet is hostile to it, everyone has had to built their own spaces.
> Dubs
Not sure if anyone else noticed the item id of this comment does indeed end in 88?
Dubz get!!!
Particularly ironic since it mentions nazis...
They're still around, they just happen to be on X/Telegram.
Roughly speaking they're in two camps: Groypers and BAP-adjacent Yarvinites. I suppose both are "Nazi" in the sense they are anti-intellectual and anti-egalitarian. Some are paid. Some do it for free.
I don't see much of an equivalent on the left, maybe extreme far left Zizarian types or femcel/misandrists.
Instagram reels.
There is a ton of content with dark jokes, black humor, very provocative content and even "nazi" memes and people send it to each other to laugh about it.
Those reels usually have very few likes / comments but A TON of sends. I personally am on multiple group chats where we only send each other those kind of memes.
The thing is, instagram being a huge echo chamber. Before you have no idea those exists, and once you are in you see a ton of those
The echo chamber on Instagram is deep. Even when there are a ton of comments, they’re sorted beginning with the most “relevant” (i.e. worldview affirming). So if you’re viewing a controversial video, you’ll see comments echoing your own beliefs, and others will see the opposite. You’ll both move onto the next video thinking “wow, everyone agrees with me!”
I deleted instagram last year and haven’t reinstalled it. Those reels are so addicting. I’m glad I never installed TikTok because I imagine it’s just as bad. I still suffer from YouTube Shorts but at least the mobile web UI is janky enough to eventually push me out of its trance.
Instagram is a special level of degeneracy. That is an app made for the masses. I never used tik tok, but youtube shorts gives me actual quality content while instagram feels like its gunning for a mix of reality TV, post 2005 history channel, and animal brain fondling.
Although I will admit that Instagram has their advertising insanely dialed in. The content is gross junk food but the ads I have actually clicked before.
TikTok has the same issue. Two people can see the same video, come to opposite conclusions, and only see comments that agree with them.
TikTok is maybe the last bad echo chamber of the big short video platforms: stitches encourage some sort of debate and expose you to snippets of opposing view points, and the algorithm gives you at least a chance of finding new types of content you also like. But it's only the least bad, it's still very bad. Especial once you factor in your own confirmation bias and the comment algorithm
Find a lot of it on discord.
Eventually, the ironic becomes unironic. If you're pretending to be an idiot, eventually you'll find yourself surrounded by actual idiots. Or bigots.
>Yup, among the sane! If there are any bastions left, we’re working on eradicating them
The communities of trolls trolling trolls have been replaced by larger communities of nazis training nazis to attack and terrorize. Thank you for eradicating the former, paving way for the latter.
The 4channification of the mainstream is quite sad - it took all the unpleasant sociopathic politics and none of the fun!
> act in a way nobody knows whether you're actually trolling or not
This is basically how I market my blog :)
I have one of those time-based number hardware fobs, with the 6-digit 7-segment LCD display, which I'd guess I'd actuated less than 100 times, yet on one such actuation, it displayed 1-2-3-4-5-6.
Maybe because the whole mode when using it is infosec, my snap first thought was about how this is highly unlikely and is someone messing with me.
My next thought was to run to get a camera from the other room, regardless of whatever is going on.
By the time I got back with a camera, and just barely missed photographing the display, I realized that someone compromising my airgapped self-contained hardware fob was even more unlikely than this number sequence coming up randomly within 100 actuations.
And, like this article points out, there are many "unlikely" numbers that might come up, so the chance of any of them is not as unlikely as it would first seem until you thought about it.
If you run the fob 100 times, the probability of seeing "123456" at least once is about 1% (1 in 100 chance).
One person in every hundred
I was driving my wife's car a few years ago when I managed to look down and see that the temperature was 55 degrees, and the odometer read 55,555. For a split second I couldn't believe my eyes; what are the chances?
That this-can't-be-correct reaction can be useful in emergencies, if it gets your attention, and activates a mode in which you can focus and act decisively in an instant.
I once was applying a spray-can anti-slip treatment to a bathroom floor, when I might've heard a whoosh, looked up, and had a thought (that I remembered afterwards as) "fire shouldn't be coming from that direction".
From the adjacent room, there was this flash fire shooting across the floor at me.
That got my attention, and activated an emergency mode, parts of which I had no recollection. I somehow leapt backwards up onto the tub edge in an instant. Then the floor was on fire and lapping at the walls of the small bathroom I was in. The next thing I knew, I'd leapt over the flame, into the next room, somehow gotten the fire extinguisher from inside a cabinet, and was putting out the fire. Which worked nicely.
Then, I guess, as that mode was winding down, without really thinking about it, I put the exhausted fire extinguished back in its spot in the cabinet. As I went to call the fire department to check out that there were no lingering problems.
(Turned out that the floor treatment application also emitted a highly flammable gas, which rolled across the floor, into the next room, until it hit the pilot light in an old nat-gas oven.)
Now, if we had an adrenaline reaction every time we saw unlikely numbers, that would be a problem. But, however the cognitive scientists deconstruct it, I'm fond of having what I'll call a good emergency mode feature.
Based on NOAA weather data, a rough estimate for the probability of experiencing exactly 55°F at any given time in temperate U.S. cities is around 2-5% on average
Cute, but ultimately cute features are not compatible with a critical security application.
If it had been developed as a feature of an existing application maybe it would fly (and probably even not there). But as a third party app, or even a third party library that needs to be added to the security supply chain? Not a chance for any serious business.
Yeah, unfortunately "Easter eggs" call into question the security of the software pipeline.
Did PMs and other engineers review and OK this? -> Suggests a lack of judgement or just rubber-stamping.
Did a lone engineer add this "just to be cute", and it didn't get caught and stopped? -> Proof that your development/release processes are insufficient and you are intensely vulnerable to insider threats.
Neither is good for a security product. At a previous company we were explicitly told that any easter egg was an immediate firing. The company's products had a long history of easter eggs before that.
This calls me heavily towards the quoted note about halfway through:
"Does nobody make apps for fun anymore?"
This doesn’t mean every app has to be fun. If I want to have fun, I’ll go play with something specifically built for fun. If I’m balls deep in an incident and suddenly my MDM security policy login TTL expires and I have to reauthenticate, the last thing I want to see is yet another interstitial with some cutesy BS to nuke my working memory.
"interstitial"
Sidetrack but this is interesting wording, what do you mean exactly? As in some software that is accesory to other software? Or something that you have to access while moving between software?
I feel like sometimes I’m the only person in the world not shipping ultraniche paywall aso slop
Complete tangent: "voila" is French for "here it is", but "viola" is French for "raped". Careful using foreign words if you're not sure you can spell them.
Viola also means purple/violet or the instrument. Let's try to be more chill about people making typos, nobody, even a fluent French speaker would read it as "raped". Only someone with a keen eye for drama and being a nuisance.
Not exactly, its the 3rd person of passé simple
What if I want someone to look at my big violin?
Voilà - there it is
Viola - musical instrument
violé - raped
Accents matter but not as much as different letters. Don't correct spelling without knowing the proper term.
Scare bleu!
> "voila" is French for "here it is"
I thought it was French for "look at that" (or I guess, literally, "look over there").
I felt real joy reading this, thanks :)
As someone starting to feel a bit of burnout I think I needed to read something like this.
This was 100% the most fun I’ve ever had coding anything. I was missing my tube stop levels of engaged
I think this is a bad idea and insecure. Obtaining a code needs to be an intentional effort and not just available to someone who happens to be screen surfing my phone at the right time. It's worse that it's on the lock screen as it seems the author does based on their screenshots. Lose your phone, and your passcode will not protect someone from using your codes.
To be clear, you don’t see the account details in the notification, just the number, and can’t even read it until unlocking the device
I think it's a great idea, but definitely very insecure, yes. Don't load your actual TOTP credentials into it, obviously.
That’s a fun little Easter egg! It’s always cool to see small details like this that add some personality to otherwise routine tasks. Makes me wonder what other quirky things could be hidden in security tools without compromising functionality.
I love Easter eggs -- but security tools are the last place I want them showing up.
Like do you really want to entrust your TOTP secrets to a random app by a guy you've never met just to get some fun push notifications?
TOTP seeds are only useful if you have the account they are associated with. How would the 2fa app by some random guy discern the identity associated with the seed?
Isn't one issue the display of the codes on the lockscreen? If viewing notification contents there is enabled, it would be problematic if it popped up while you were away from your device to say "Your Google 2fa is 100000 right now". I get that the iOS default requires unlock to view the actual content of the notification, but still, that seems less than perfect from a security standpoint.
Still the app is fun and I appreciate it.
Notifications say nothing about the account - just that you got this cool number on the app. And yeah you need the device unlocked to read the notification anyway
But yeah security concerns with it are overblown, the more realistic concern is trusting me personally vs a name brand!
To add an item, you scan a QR code. That QR code usually contains the name of the service and your username. For example, the format of Github's QR code is:
otpauth://totp/GitHub:[username]?secret=[secret]&issuer=GitHub
Yeah this seed is what’s stored on Keychain
It's not even worth the thought.
What? The same way that when you look at the 2fa codes in your app you know which account they are associated with. The qr codes people typically scan for that do not just contain the seed itself but metadata for the account associated with it like email address or account name.
The password manager that... writes very short puns!
Giving a random app your 2FA secrets? Raises eyebrow…
Feel free to network proxy and check I’m not being cheeky - I have another blog post about that ;)
What if one bad actor does it not initially do that, but only after the app has enough users, with a random upgrade? Not that _you_ would do that, of course. But it makes sense that people are wary about where they trust their TOTPs.
Some time ago people were locked out of their TOTPs because some guy bought their app from its creator and turned it into ransomware having them pay to not lose their codes.
Yeah that’s fair to be honest, at least until my blog starts pulling enough money to not be worth destroying my reputation on a rugpull
And not telling when you get 271828? Racist!
Honestly making it configurable for birthdays would be pretty neat
The obvious solution here is to discover an important natural or mathematical constant that happens to match your birthday in its first six digits.