The code is at the bottom of the can and can only be seen be shining a flashlight down it. This completes Step 1 of the verification.
Oh and it changes your pee color so it can reveal the passkey pisskey verification QR code on the urinal in front of you to complete Step 2 of the verification.
We’ve had certificate authentication (backed by hardware) for ages. We could fix the UX there and be done with it, but nooooo, we are reinventing everything again. (Tangentially related: JWT, OIDC and SAML are basically kerberos with extra steps.)
a very long password that (ideally) is only bound to a single device, requires a second identifier (biometric, PIN, password) and that is phishing resistant.
thus rendering them redundant, because their strength is being bound to a single physical device. if they’re portable, they’re as good as asymmetric key pairs.
Their strength is being half a cryptographic key, not that they’re device bound.
That was a “requirement” that big tech wanted, to force you to be dependent on TPM storage, so you’d be forced to use a Trusted™ device and OS. It was made optional after pushback from basically everyone else.
Password managers support Passkeys now. Bitwarden and KeePassX among others.
As long as I trust that my password manager is secure, and as long as I use a strong master password or (better) have a hardware key to unlock it, it is way more secure than a password, and I can still install Linux without losing my logins.
that’s not the point, passkeys are not vendor centric, they are a standard. you don’t want to duplicate a passkey for the same reason you don’t want to copy an SSH private key on multiple devices. it’s a security feature that allows disabling the account access in case the device becomes compromised (lost, stolen, infected, etc.)
i refuse to give my phone my thumbprint or do a face unlock. i’m not sure if it’s still collecting a biometric bullshit on my face, but i have not done it myself. I’m a luddite here and i insist on it so no one (especially no one trying to violate the united states 4th amendment) can get into my phone without my permission or hacking into it.
We’re going to return to user + password in the near future.
Please drink verification can to continue
The code is at the bottom of the can and can only be seen be shining a flashlight down it. This completes Step 1 of the verification.
Oh and it changes your pee color so it can reveal the
passkeypisskey verification QR code on the urinal in front of you to complete Step 2 of the verification.Passkeys, more likely.
deleted by creator
Half a cryptographic key that you can’t easily give to someone over the phone by accident.
By convention. See for example: https://github.com/keepassxreboot/keepassxc/issues/10407
We’ve had certificate authentication (backed by hardware) for ages. We could fix the UX there and be done with it, but nooooo, we are reinventing everything again. (Tangentially related: JWT, OIDC and SAML are basically kerberos with extra steps.)
a very long password that (ideally) is only bound to a single device, requires a second identifier (biometric, PIN, password) and that is phishing resistant.
Bitwarden let’s you sync your passkeys between devices. And you can also unlock your vault with one stored on a physical security key.
deleted by creator
Bitwarden has been working great with me as sits transition to passkeys, even big corporate ones.
But yeah in practice, google and facebook are going to probably dominate because they are the easy + free option.
KeepassXC supports passkeys as well.
thus rendering them redundant, because their strength is being bound to a single physical device. if they’re portable, they’re as good as asymmetric key pairs.
Their strength is being half a cryptographic key, not that they’re device bound.
That was a “requirement” that big tech wanted, to force you to be dependent on TPM storage, so you’d be forced to use a Trusted™ device and OS. It was made optional after pushback from basically everyone else.
Password managers support Passkeys now. Bitwarden and KeePassX among others.
As long as I trust that my password manager is secure, and as long as I use a strong master password or (better) have a hardware key to unlock it, it is way more secure than a password, and I can still install Linux without losing my logins.
deleted by creator
that’s not the point, passkeys are not vendor centric, they are a standard. you don’t want to duplicate a passkey for the same reason you don’t want to copy an SSH private key on multiple devices. it’s a security feature that allows disabling the account access in case the device becomes compromised (lost, stolen, infected, etc.)
deleted by creator
xmpp is still alive and is still an open standard
deleted by creator
i refuse to give my phone my thumbprint or do a face unlock. i’m not sure if it’s still collecting a biometric bullshit on my face, but i have not done it myself. I’m a luddite here and i insist on it so no one (especially no one trying to violate the united states 4th amendment) can get into my phone without my permission or hacking into it.
Ooh-la-la, someone’s gonna get laid in college.
Edit: This is a joking reference from a Rick and Morty episode (S02E06).
deleted by creator
Oh, I’m sorry. It’s a reference to a Rick and Morty episode. I thought that’s what you were referring to.
deleted by creator
i never stopped
Log in with the honor system.