dwaite

44 ms·

691.
by dwaite 3y ago
>Passkeys are wonderful for consumer use, because they're meant to enable your own ability to break glass, by backing up the credential to other devices. You can do this via iCloud (by default) or via things like Airdrop. > Techn
692.
by dwaite 3y ago
From https://www.chromium.org/security-keys/ : > Chrome’s users have an interest in ensuring a healthy and interoperable ecosystem of Security Keys. To this end, public websites that restrict the set of allowed Secur
693.
by dwaite 3y ago
> I have always understood that Apple defined a Passkey to be a key pair that is synced through iCloud Keychain. Even their WWDC 2021 presentation distinguishes passkeys to be different than security keys because they are "always wi
694.
by dwaite 3y ago
They could also look at your SMS and Email OTP. The secrets in the password vault can be used to authenticate and change settings in various trusted systems, like configuring call forwarding. Cloud-based backups or the local filesystem coul
695.
by dwaite 3y ago
With passwords, the user choosing a unique password or the site choosing to use a recommended process for hashing passwords is proper hygiene, but requires knowledge and is a choice. With passkeys, there is no opportunity to have bad hygien
696.
by dwaite 3y ago
Modern security keys (made in the last 5 years or so) support CTAP 2, which will support setting and using a PIN even if there is no hardware keypad. The client system will prompt for the PIN before letting you use the credential. Chrome I
697.
by dwaite 3y ago
For the other direction (phone providing computer access), there is a hybrid flow. You select an option like 'use passkey from another device', and it will pop up a QR code. Scan that with your phone/tablet, and it will provi
698.
by dwaite 3y ago
A passkey is a discoverable credential (meaning - a website can ask the system for it without knowing who the user is first) with user verification (meaning, it can ask the system providing the passkey to verify the user). For a platform li
699.
by dwaite 3y ago
Platform authenticators have made it more obvious that some people took the multi-factor model as some immutable truth of the universe. The modeling of authentication techniques as factors shows the strengths and weaknesses of the categorie
700.
by dwaite 3y ago
Yubico sells Yubikeys where are smartcard devices loaded with several apps (keyboard emulation OTP, GPG, PIV card, and FIDO 2). They also sell cheaper security keys, which are purpose-built for FIDO 2 only. When someone says they are using
701.
by dwaite 3y ago
> Passkeys parasitize on FIDO2 U2F standard U2F authenticators and the U2F protocol cannot support passkeys. A passkey is a discoverable credential which supports user verification. U2F supports neither discoverability nor user verificat
702.
by dwaite 3y ago
> A frequent question here is if non resident keys are less secure than resident ones. Credential ID's as key wrapped keys are secure since they are encrypted with aes128 and hmaced. This is incorrect. The strategy for how handles r
703.
by dwaite 3y ago
Think of it as process maturity. They don't want to just rubber-stamp some company's project as a "CNCF" project, only to have it collapse when the company pulls employees off it.
704.
by dwaite 3y ago
> From everything I've heard it kinda does. If you're writing something valuable then maybe a company will employ you to keep working on it, and the portfolio can certainly help in interviews (to write other software), but gett
705.
by dwaite 3y ago
The most significant impact of this change is that python threads can run at the same time. Before, calls to C API were essentially cooperative multithreading yield points - even if you have 100 python threads, they can't run concurren
706.
by dwaite 3y ago
> What non-transparent GIL specific behavior are developers relying on exactly? They are relying on behavior of a single environment. We similarly see a lot of issues moving threaded code to a new operating system in C/C++, because
707.
by dwaite 3y ago
As soon as you leave python, that C extension can give up the GIL and your other python threads can start running. The GIL makes python code have cooperative threading. It does not protect from e.g. your thread's view of state mutating
708.
by dwaite 3y ago
> It really just depends on what you mean by non-blocking I/O. > Most node code I see in the wild is just a simple `await loadData()` which doesn't block the main node thread but does block that code flow until the data retu
709.
by dwaite 3y ago
Do you have a legal decision that AI art forms no derivative of a copyrighted work, vs a derivative of ALL the copyrighted work in its training set? There is no new law, there is ambiguity with the lack of current case law. There are certai
710.
by dwaite 3y ago
I believe the expectation is that there is a difference between new creative work by humans and the output of tools. Tools are not 'artistically influenced' by their inputs. Also, a human can take a work, modify it, and create a d
711.
by dwaite 3y ago
> It would be great if Apple simply built out keychain access to support more data types and family sharing. Sharing is coming to iOS 17, which is a bit surprising due to the general push-back on scope creep. I don't think additiona
712.
by dwaite 3y ago
> Why not just fill the gap in the market and make bank? The existence of 1st party platform and browser options and freemium competition are great from the perspective of having password managers available to the masses, but make a new
713.
by dwaite 3y ago
You don't have to use iCloud. You can use local storage, or any cloud provider, or SMB/CIFS.
714.
by dwaite 3y ago
It is more of a difference in British English, where a leash is used to control a large/dangerous animal, while a lead is used more cooperatively (like walking a dog). I heard lead quite a bit from trainers, and assume their choice in
715.
by dwaite 3y ago
The colors are meant to be within a calibrated (sRGB) color space. Images and videos can request to be in a different color space which includes the HDR range. CSS can also request colors outside that space, but that is done by using extend
716.
by dwaite 3y ago
Indeed, taking over control of a market is more trouble than it is really worth. Apple wants alternatives. They're happy just taking the lion's share of profits.
717.
by dwaite 3y ago
For any significant market, I doubt we will have movies or shows go to a full 3D experience. These are storytelling, not interactive experiences. You aren't going to be able to pause and get up and see what is inside the briefcase in a
718.
by dwaite 3y ago
Television manufacturers are constantly looking for a premium feature, since the profits are so slim on the lower end. 3D was one such feature, but had a benefit for non-3D movies in that it needed significantly more backlighting for active
719.
by dwaite 3y ago
not really, that’s control-clicking. They’d need four buttons to cover the permutations (before you even get to command and shift clicking)
720.
by dwaite 3y ago
sort of. From a user perspective, the app security model is brokered (by a store) while the web security model is a direct ad-hoc relationship to whoever [you _think_] owns the domain you are on. Apps tend to need reviews for republication,

More ›