notJim

Sure you can buy a niche product from a niche store, but it's gonna take them 3 days to get to the post office, and 2 weeks to get it to you. And they're gonna charge you $9 for the privilege.

Even the great stores like McMaster-Carr are kind of unpleasant to use, because the shipping is so slow (even though everything else about the experience is far superior to Amazon.)

Of course it doesn't hold for FBA, if it's not FBA, then it's not Amazon's logistics.

Oh I meant that I'm in the US, so maybe this issue is specifically a problem outside the US.

I really don't understand this monopoly argument at all for Amazon. What category of product is sold there, but nowhere else? Between big box stores, Wal-Mart, Target, eBay, B&H, local stores, independent online stores. I don't feel at all that I'm forced to shop at Amazon for lack of choice. Is this an American thing?

Can you not just use the reset password flow any website has?

The 1password integration works great IME. When a site supports passkeys, 1password seems to offer to save the passkey, and at login time, a little popup appears from 1password asking if I want to use my passkey, and I can either enter my password, or use TouchID to unlock 1password.

I use this across iPhone, MacOS and Windows, and haven't run into any issues.

> (re-enroll attacker's key or register attacker's passkey).

What is the mechanism to do this? As I understand it, the passkey is basically a public/private key pair. You'd have to download the attacker's key pair into your passkey system? What passkey system allows you to provide a key pair, rather than always generating one? I'd like to see a step-by-step walkthrough that doesn't involve a straightforward phishing scenario, or running privileged commands on the users computer (if you can do that, all bets are off.)

In this attack, it sounds like the key step was that the user entered their username and password, thinking they were preparing to enter a passkey. It wasn't the passkey system itself (which would prevent this attack), it was the transition from password → passkey system that was attacked.

In any case, if you can get the user on the phone and convince them to let you walk them through a bespoke auth flow, I doubt there is any auth mechanism that would stop this. This is why every auth system these days is constantly telling you "We'll never ask for X", because at that point, the game is over.

Comment · 26 days ago

The unchanged AI style is grating to read. I'd rather read the bullet points you fed to your AI than this style. Of course I'd really rather read your own quirky writing style (which identifies you as a human), but if you don't have the bandwidth for that, just post the prompt.

In recent years, I have not been able to find a human CPA who can accomplish this feat. (If anyone has a reco who's taking new clients in the US west coast, feel free to email me.)

They're saying it's not the only way, it's just one way. Some people post on LinkedIn, other people have shared hobbies w/ their management chain, it's just looking for any edge you can find.

I was not agreeing or disagreeing with that point, I was answering the question that was asked.

I think if there's a $6T market, it will come via integrations with the products and workflows of large companies, which is obviously also happening. Apparently the tech sector as a whole is worth $5 to $10T, so it's actually not inconceivable there's $6T worth of value there (especially since the value will not be constrained to the tech sector).