If you’re just storing the password on the key then, no you can’t get it unless you have the key. The main usage (arguably) for a yubikey is the FIDO2 auth method where you add those keys as MFA methods. That would allow access using either key.

It depends. Do you need MFA to access the password manager?

If not, then yes it reduces the effectiveness of having MFA on your accounts but they are still more secure than not having MFA at all.

I’d like to get a Pixel for GrapheneOS but I’m sorta waiting to see if the upcoming fold has pen support. If not, I’ll probably just get an earlier model since it’s cheaper.

But will it have stylus support? That’s pretty much the only reason I didn’t consider the last version.

You definitely should try something with an actual desktop. It sounds like you’re wanting a headed server with virtualization capabilities. I’d personally run LXD or KVM and LXC if I needed a type 2 hypervisor and containers like what you’re saying. Luckily, a ton of distros support both of these at this point.

Btw, proxmox utilizes KVM and LXC on the backend. So the only difference is that you’re leveraging the tools directly. If you’re a CS student then learning the underlying tools is the best way to learn about a system and how it all interacts.

It looks like Quad9 supports DoH: quad9

I might give it a shot. It looks like a good alternative. Thanks for the recommendation.

I used to love Vivaldi, but eventually it being a chromium browser forced me to switch back to Firefox and it’s children. If they switched over to using Firefox as a base rather than chromium then I’d consider it.

It sounds like they made their own bed with preferential treatment towards Manjaro.

It largely depends on the program. If the application has native Wayland support then it usually works pretty well, but apps that only run on X11 (which need to run through Xwayland) may be a little glitchy. It will depend on a lot of different variables including drivers, model, libraries, kernel, etc. But later this month Nvidia is to release new drivers that allow “explicit sync”, which should address a lot of this I believe.

After looking through it a little bit, it sounds like HIP is mainly used for verifying hosts’ identities. It sounds like you’ll still need firewall rules in order to create the scenario in your example, right?

Good point!

Ooh or “gender = null”

Thankfully it only lasted 2 years. But during that time it sounds like it was a plan to suppress the presidential competition that backfired. It’s good to know that humanity has always sucked.

Have you considered using Bitwarden Premium? It has TOTP support and is $10/year currently.

Also, regardless of how your hosting your data, it’s probably good to keep a secured backup of your vault or two just in case something unexpected happens.

Fair points. I’d say it depends on what we’re focusing on.

Maybe a good compromise would be to have the account that sent the message generate the preview. At least that way you’d maintain E2EE and save the webserver some unnecessary demand.

I can also see how this could be less reliable (because we’re now relying on a client with all sorts of variables) and less safe (malicious sender could mask malicious links with benign previews) than the server method but it all depends on which you prefer more.

After thinking about it in this situation, previews are just a nightmare to deal with privately and I’d probably just want to turn them off.

I agree. That’s a terrible choice to me.

Why would they not just offload this as a feature for the client to handle? At least then the security and privacy ultimately would be up to the user’s decision.

This isn’t exactly a platform specific problem because having local network access while using a VPN is actually a feature called “split-tunnelling”. The tunnelcrack issue goes beyond this but can be mitigated by using full tunnel VPN that resolves the server by IP address instead of DNS.

Ohh, sorry I misread your comment. Yeah, 2.5G WAN is a little trickier unless you go with something enterprise grade it seems.

They do have the XG series. I actually have a SW-16-XG for the backplane on my server for my SAN. Local access 10G using SFP+ ports are definitely doable if you don’t need to cross any VLANs or do any routing.

I haven’t used one personally but the cheapest they have is the Flex-XG switch it seems, which seems pretty cheap for 10G.