buddylw

I would say its something you have when it’s hardware backed, including secure enclave/pin/face id, but a cloud sync’d password manager isn’t necessarily that, though, again still a better situation than a phished password.

A few examples here to illustrate... The way ebay and Amazon handle this are great. Multiple passkeys allow login of multiple device ecosystems and/or hardware tokens so that users can mange their own level of risk and really any level of implementation is helps the average person.

Meta's implementation by contrast is bad, in my opinion. You are only allowed one passkey (so one login ecosystem/hardware key allowed) and it completely bypasses 2fa and security tokens. So, someone looking for more security must avoid passkeys "altogeher" and use password + U2f security key and the passkey only being allowed in a single ecosystem means that password/phishing lanes must remain open. All you're doing is disabling 2fa on a key that is likely sync'd to all of your devices. All that said...it may still be a security improvement for most users in the real world in practice, I just find it a very annoying and confusing set of security decisions.

It moves the attack surface to password managers, which is arguably a better situation than phishing. I'm skeptical that the war is over, though. I have no proof to back this up as phishing is the low-hanging fruit today, so the numbers 'largely' back you up. I personally include device compromise in my threat model and I'll concede that may be overdoing it for the average person.

Passkeys only make sense if multiple passkeys are supported. What if I lose my Fido key? One issue here is that passkeys don’t have a clear role. If they are replacing passwords, only, then they are 100% an improvement even when not hardware backed, but you still need 2fa. If they are hardware backed, you probably don’t need a second factor and different sites see different roles. Assuming I can setup a backup key, hardware backed covers all of sites’ misconceptions, though.

I have one as a watch bezel that I use in a pinch. Anything you need to scale, divide, or multiply in the real word doesn't need more than 2 significant digits of precision so it works. For example, I've used it to calculate how many grams of coffee will give me a 1:16 to the amount of water/coffee I want.

This problem isn't going until we find a better solution to scraping than using your IP address as a passport.

I have a Swiss Micros DM42, a modern clone of the HP42s on my desk and I have the plus42/free42 app on pretty much every device I own. Stack based calculators are great because the stack works as a little scratchpad when I'm trying to figure something out.

If I'm solving a problem of any complexity I'll move to a more appropriate tool like python or a spreadsheet, but for the simple math that needs to be done around the edges personally and professionally, I like a calculator. If I'm at my desk, I'll use the physical version.

Bluesky is far from perfect, but I think you need a realistic comparison to other social media networks. Twitter is far more toxic if you are unable to curate your feed. Mastodon has a nice community, especially for tech, but lacks breadth.

There is a core group at Bluesky of people that left Twitter and they have an obvious slant, but I really don’t see this issue making the network worse than any other and only requires you to curate your feed like you have to do on every network.

No one said morality was easy.

Well, there’s one thing I know didn’t cause this: an IPv6 DDOS attack. GitHub, in 2023, is somehow still immune to all IPv6 attacks

If they add ipv6 support I’ll forgive them, but I lost hope a long time ago. It’s almost comical now.

I don’t really like this view of the world. I think they are correct about the lack of certainty and doing things while you can, but often big goals, like having a child, professional success, monetary success, etc. can cause us to miss life, too. Everything is a trade off. There’s always opportunity cost and you can always look back and see what you may have sacrificed to get where you are.

It’s needlessly depressing to wallow in this mindset. I personally value being a good person and my connections with people. Sure I could focus this energy on one human I bring into the world, but that’s not objectively better than anyone else I affect positively.

And I know having a child is a transformative experience. I’m lucky enough to have lots of little cousins and Have volunteered with programs for kids for years. Kids are amazing and bring magic to the world as you grow older. I just think that wrapping all of your identity and self worth up in a single goal is asking for disappointment. It’s not fair to you or the child.

Try to appreciate your real impact on the world. Did you improve someone’s day today? Did you restore someone’s faith in humanity? Is someone comforted right now by their trust in you? That’s the good stuff. Make that happen any way you can.

If you do want a child, go for it. Time IS ticking, but if you can’t or didn’t or are considering bring one into a bad situation or relationship to quell an existential fear, don’t worry. It’s fine. You can still find meaning and have an impact through your connections with others.

It’s possible, but I doubt they willingly sold their credentials. It’s more likely that they were scraped by some other means and sold.

I really like having totp functionality. I use a yubikey for TOTP and boot into an air gapped machine with keypass to store the TOTP codes in case I lose or break the yubikey. I don’t store TOTP codes in my main password manager, but it’s not completely insane. You’re screwed if someone gets your decrypted password database, but you’re still protected from most other attack vectors.

I read much of my waking hours for work, entertainment, and personal growth. It just isn’t usually (for better or worse) in the form of a book.