> It's not reasonable to tell people "too bad," fly back to the US as much as 3 times per year.
Where are you having elections three times per year? If you’re living abroad, you shouldn’t be voting in local elections because you’re not a resident. You probably shouldn’t be voting in state elections either because you’re not a resident. So you have to come back every 4 years to vote in the presidential election, or go to a consulate to vote every 4 years.
The US. Primary, general, and in a number of states, you have to have a special election to replace the senator/representative that joined the new administration or quit or whatever. Actually, that causes 4 elections because you have a primary for that. [1]
>You probably shouldn’t be voting in state elections either because you’re not a resident.
That's a matter for the state, and many say if you still have a house, or intend to return, then you vote there.
> If you’re living abroad, you shouldn’t be voting in local elections because you’re not a resident.
And no, a number of states allow voting in that case even if you're not a resident [2]. For instance, you own a vacation home, you get to vote on property tax related matters concerning that house.
I regularly fully read and try to understand paper contracts before signing them. Every time, it's clear that no time was set aside for me to read the contract, and the other party expected me to sign the contract within a few seconds of first receiving it. Often, I get the sense that the other party is annoyed or frustrated that I take time to read the contract before agreeing to it.
I've read that contracts fundamentally require a "meeting of the minds", where two parties come to a mutual understanding of an agreement. At the same time, overwhelming people are expected to not read and understand contracts they agree to. I don't understand how these two facts don't combine to mean the vast majority of written contracts are not legally binding, but apparently judges don't share my confusion.
What’s PQ story with passkeys? Considering all the hype that everything needs to be pq safe by 2029 (or whatever), wouldn’t it make sense to delay adoption? Otherwise a db leak would compromise every single account in a pq world.
Authentication is safer than encryption, because harvest-now-decrypt-later is not available. Currently PQ is not standardized for passkeys, and at least Firefox fails if the authenticator advertises unknown algorithms.
Most Passkeys use PQ PKI algorithms. From statistics I've seen most are Elliptic Curve on currently recommended PQ curves.
For better and worse, Webauthn is one of the "choose your own adventure" PKI systems where the keys themselves suggest which PKI algorithm/details they use. This is partly because Webauthn has been around a long time and has had to backwards compatibly support a wide variety of physical security keys over the ages.
Most good open source libraries for implementing passkeys will do a good job of limiting passkeys to known good algorithm choices, including any PQ requirements/suggestions. The Passkey standard itself also sets a "higher water" baseline above Webauthn's supported algorithm list.
I don’t follow? What is a “currently recommended PQ curve”? As far as I understand, the entire point is that all ECC is broken by quantum computers, hence the hype to move to something else by 2029. Anyone that can see your public key can compute your private key.
My understanding is that some of the curves are still considered high enough entropy that the number of qubits needed is "unreasonable". The important point remains though that passkeys don't have a fixed encryption suite and can be updated over time.
Passkeys aren’t permanent, you can change or revoke them. If the algorithm used suddenly becomes vulnerable, you would need to rotate all your passkeys.
Sure. You’re assuming every site will revoke your passkey when that happens though. It also feels like a great time to trick people into registering an attacker passkey instead.
No, it absolutely doesn’t apply the same way to password. In a PQ world anyone that has your public key also has your private key. That’s not the case with a password and stolen hash.
Yeah, you are right. I don't know what I was thinking when I said that.
Little harsh to say I have NO idea what I am talking about, though.
I still don't agree that companies won't revoke their passkeys if we are in a PQ world.
If they don't, you are still in a better place than passwords. Each public/private key pair is unique for every domain, so a compromise in one place is not a compromise in others. Many people re-use passwords (even if you don't).
It sounds like your withdrawals/transfers are actually suspicious. You don’t give any details on amounts or frequency or anything else. But you are certainly doing something outside the normal.
reply