The author says that "In a perfect world, RMSDK would just stop living in the CSS stone-ages or at least provide some kind of error handling instead of dropping the whole book, but I’m not holding my breath."
This is blatantly wrong.
In a perfect world, RMSDK wouldn't exist in the first place and Adobe would have gone bankrupt and become history at least 10 years ago.
I was very confused, too. I mean, I do have a YubiKey but Twitter/X has never (or for a very very very long time not) asked me to use my YubiKey to authenticate. As far as I could remember, I only need to use OTP from Authy as 2FA to login. So the whole thing smelled really fishy.
One thing I don't understand is how the surgeon ensures the lens is positioned correctly. We're talking about a rigid lens that can no longer be controlled via muscles, right? Doesn't any misalignment mean you get a fuzzy image at best? And even if you can get a sharp image for some given, fixed distance, you still can't control whether to focus on near things or far things when you look, right??
Practically speaking, is it possible for NVIDIA to "pull the rug" later, intentionally or otherwise, by subtly changing the behaviour of this out-of-doc instruction on new architectures?
I think that the scenario you describe requires one of two conditions:
1. The attacker knows the time and medium through which the two persons call each other, and have control over the medium, being able to inject themselves;
2. The attacker coerces one of the two persons to perform authentication.
You have a much bigger problem if any of the above is true.
I asked Google Gemini 2.0 Flash and Perplexity.ai, the QR code display problem on Tor Browser for desktop appears to have to do with the browser's anti-fingerprinting mechanism.
This is the explanation that the AIs gave me:
# begin explanation
The issue you're experiencing with QR codes showing up as vertical stripes in the Tor browser when using QRCode.js is due to Tor Browser's anti-fingerprinting feature.
Tor Browser is designed to protect user privacy, and one of the ways it does this is by randomizing the output of the HTML5 Canvas API. QRCode.js uses the Canvas API to draw QR codes. When Tor Browser randomizes the Canvas output, it distorts the QR code image, causing it to appear as vertical stripes instead of a readable QR code.
This is a known issue and is intentional behavior in Tor Browser to prevent fingerprinting. Fingerprinting is a technique websites use to uniquely identify and track users based on various browser characteristics, including how the browser renders content like Canvas elements.
Here are the solutions based on my research:
Lower Tor Browser's Security Level: The simplest workaround is to temporarily lower Tor Browser's security level from "Safer" or "Safest" to "Standard". You can do this in Tor Browser's settings under "Privacy & Security" -> "Security Level". Setting it to "Standard" disables the Canvas fingerprinting protection, which should allow QRCode.js to render QR codes correctly. However, this will slightly reduce your privacy while using Tor Browser.
Use a Different Browser: If you need to generate QR codes reliably and use them, the most straightforward solution is to use a different browser like Safari, Firefox, or Chrome, as you've already observed that the QR codes work correctly in these browsers. You can use a non-Tor browser specifically for generating and scanning QR codes, and then switch back to Tor Browser for your privacy-sensitive browsing.
Advanced Configuration (Not Recommended for Most Users): For advanced users, it might be possible to modify Tor Browser's about:config settings to disable specific anti-fingerprinting measures related to Canvas, such as canvas.poison or privacy.resistFingerprinting. However, this is strongly discouraged unless you fully understand the privacy implications, as it can weaken Tor Browser's privacy protections. It's generally better to use one of the first two options.
In summary, the striped QR code issue is a trade-off between strong privacy protection and website functionality in Tor Browser. Tor prioritizes privacy by randomizing Canvas output, which unfortunately breaks some features like QR code generation using libraries like QRCode.js. The recommended solutions are to either temporarily lower the security level in Tor Browser or use a different browser for QR code related tasks.
# end explanation
As well as the proposed solution:
# begin solution
The issue with QR codes appearing as vertical stripes in Tor Browser when using QRCode.js is due to Tor Browser's anti-fingerprinting feature, which randomizes the Canvas API output. This intentional behavior to protect privacy disrupts QRCode.js's ability to render QR codes correctly.
Solutions include:
1. Lowering Tor Browser's security level to "Standard".
2. Using a different browser for QR code generation.
3. Advanced users can modify `about:config` settings, but this is not recommended.
The recommended solutions are to temporarily lower the security level in Tor Browser or use a different browser for QR code related tasks.
# end solution
Looks like the problem is with the desktop Tor browser. I can see that the QR codes are displayed as two square images with coloured vertical stripes instead of real QR codes. That's such as weird problem.
In any case, I have just added the display of the base32 secret key.
This is blatantly wrong.
In a perfect world, RMSDK wouldn't exist in the first place and Adobe would have gone bankrupt and become history at least 10 years ago.