Ah, that sounds good. I was thinking of a scenario where someone runs code in, say labs, and gains access to memory while that machine generates my temporary code to send it to me, and thus gains access to that code. Or, alternatively, just attack my browser through a compromised site running a JS exploit and gaining access to anything in my memory. But that's on my side to fix (or, rather, on the browser developers). One way or the other, I have set up 2FA for now. Use more lynx! On Thu, Jan 4, 2018 at 10:18 AM Cyken Zeraux <cykenzeraux(a)gmail.com> wrote:

[This is kind of getting far afield of mediawiki, but...] Spectre can potentially be used to read your private (bitcoin) keys, so bitauth is just as vulnerable to it as anything else (assuming keys on your computer and not some hardware token setup). The only benefit i see is that bitauth would probably happen in a separate process and the cross process variants of spectre look more difficult to pull off. As far as different/exotic authentication technologies go, I think U2F would be the way to go. But its all pretty irrelevent to this attack as if you had an unpatched browser and someone did this attack against you, they would probably target your session cookie. (Assuming its available in the process. I dont know enough about different browser architectures to say if thats always true) -- bawolff On Friday, January 5, 2018, Dan Bolser <dan.bolser(a)gmail.com> wrote: guess is