this is so well done, thanks for sharing it. i've been trying to communicate with people how we are living in the golden age of dev where things that previously couldn't have been created, now can be. this is an amazing example of that.
I’m not sure how seeing the generating text would give people confidence that the seeds don’t have certain properties that are useful for cryptanalysis. It’s the same issue with nothing-up-my-sleeve constants. If they aren’t agreed upon before design begins, you could iterate on an infinite set of benign-looking constants until you found a set with desirable properties.
What do you do without 2fa if your account is taken over? I’m trading that risk for something more in my control. Yeah it would suck if I lost all my hardware keys, my laptop, and paper backup codes, and additionally I couldn’t get support from anyone.
recovery is easy. i'm a customer of all these companies so i have faith i'll be able to convince them i'm me if it comes to that. and i keep a handful of hardware keys to make self-recovery easier if i lose or break one. most of my practices are to mitigate risks i personally know how to mitigate, and doing it while causing myself as little headache as possible. being able to auth using touch id on my personal laptop is great for day to day usage.
hard disagree. my favorite workflow for high value accounts is webauthn backed by secure enclave with hardware key backups. it's really low friction from ux perspective and it frustrates me when sites don't support it.
Secretive is one of my favorite tools on mac os. it's the best ssh workflow i've used: key material never leaves the device, can auth with touch id, and forward the agent as necessary. i've also sent him $ on github as a small thank you for a tool i use daily (and i'd encourage you to, too!)
I'm disappointed the author glazed over flash loans since it's such a perfect example of something that did't exist previously. The things that "make you dizzy for free" are the things to pay attention to. In crypto I can borrow effectively limitless money _uncollateralized_ if I pay it back within an atomic transaction. Why is that interesting? It's because it's not something that was ever possible before and there's no telling what it will enable. The lowest hanging fruit is stuff like arbitrage where you can now effectively operate without capital constraints but there will assuredly be more interesting uses discovered. Even ignoring the specifics of flash loans, the ability to compose financial primitives into atomic transactions is new.