joskvw

I hated paper until I found a decent pen (frixion erasable, mediocre) and paper (Lemome grid notebook, very good). It's still harder than typing, but I've found nothing better for thinking through challenging problems.

"Absolutely shouldn't" is silly.

- Browser vulnerabilities are non-trivial.

- Mullvad browser's proxy feature only works if you're connected at the OS level, which helps mitigate browser level exploits.

Compared to any other off the shelf solution, Mullvad browser provides a good balance of usability & privacy.

Compared to something like you're describing, I agree it's worse.

Dedicated stormwater infrastructure separate from sewage pipes solves the problem. You can also build tanks to hold overflow.

My bad, sorry about that.

This is a valid approach, but it might lead to a more complicated setup compared to the alternative approach shown in the article (example.com/5678).

If you enter google.com in your browser and login, unless you misspelled the domain and that didn't get flagged by anything, you'll be fine. If a relative that doesn't know much about tech gets a text/email asking them to login to their bank but the site linked is b4nk0f4m3r1c4.com, that phishing site could replay the entered credentials into the real site to login.

I agree that U2F/webauthn/FIDO2 is superior (in terms of security and in most cases convenience) in basically every way. This is an alternative approach that is less secure than webauthn but a bit more secure than regular number matching or enter this code 2fa.

That's a really good post, interesting read. This is similar in some ways but I don't see how their approach protects the user from more advanced attacks (an attacker could still swap the captcha).

Yes, it is. This system is primarily meant to counter phishing attacks that use similar domains. I should have clarified that in the post.

This is the first blog post I've put on HN. Feedback is appreciated.