somerandom2407

Just a warning to any publishers who might want to force me into an alternative app store - I will stop using your app long before I'll install another app store.

I have a reasonable amount of confidence in Apple's due diligence around vetting apps on the app store. I can't think of another major brand that I would trust on this matter.

It's terrible news for anyone who has some responsibility for the security of environments in which these devices are used.

Right now we have a relatively high confidence that as long as the devices are not jailbroken and are kept up to date they are relatively secure.

What this change means for people like me is that either there is some capability to detect whether third-party app stores are in use on a device and we will set a policy that disallows anyone using such things from accessing company data/services, or we have to lock out the devices altogether.

I'd only be interested in a platform I could trust completely, with no proprietary firmware or software blobs required. Short of that, if I have to trust someone, I'm probably just going to trust Cisco or Ubiquiti given they're western and have been around for a while with a relatively good track record and a lot of money to lose if they're found to have been negligent or malicious.

I think there's a market there for a fully open platform, but it's probably not very easy to pull off given how secretive the chip vendors seem to be.

The change to 1Pass is annoying and I don't mention these to discount your valid concerns with it, only to make people aware of the options that can help with this and make it less taxing than continuously entering a password:

* On Windows you can enable Windows Hello for biometric authentication.

* On Mac, as shit as it is, you can buy Apple's magic keyboard with TouchID (for crazy money, but still) and use it while the notebook is shut.

I hope 1Password can eventually consider adding something like face recognition from a webcam as an alternative method.

Unfortunately, without this they are not compliant and it gives a false sense of security to claim it is multi-factor when it's actually only one factor. You'll find the same with other Passkey stores like Kevault that require biometrics as well.

Actually it's kind of the opposite. Right now the banks know how easy it is for someone to end up getting scammed, so they try to be really strict on picking up on potentially fraudulent transactions precisely because they can't trust endpoint security.

If they have something like this in place, they will have greater confidence in the transaction being genuine and less likely to block it. In this case, for such a large amount of money, relative to the size of your account, they might still be very cautious about it, but it would be less likely to cause an issue.

The concern you're raising here is that the government might secretly force big companies like Facebook or Google to require attested passkeys that restrict usage to only approved first-party keystores right?

Passkeys exist now and there's no taking them back. However, even if they did not, the government might well just develop its own authentication system and require that it be used under policies that require age verification for social media, for example. Hell, they might end up doing that anyway, and that would be no different. If the government wants to force tracking/verification on certain websites, it won't simply be something they walk away from if Passkeys don't exist. You can only fight this with your vote and by not using those services once they implement such controls.

The people don't care enough to bother, and that's fine - it's not your (or my) place to force other people to do anything.

My point was not about getting critical mass, it's that the service can already do anything they like to lock people into whatever they want and gatekeep their service. They can do it with Passkeys, or they can do it with a proprietary alternative and if they're big enough, they'll get away with it. Neither of us can sway them at all - I wasn't saying they should do this, only that they can.

Blaming Passkeys is aiming at the wrong target. Passkeys rightly offer features that have valid use-cases, even the attestation in the right context. Can they be abused? Probably, but so can just about anything. Passkeys do, on the other hand, offer some real tangible benefits that other mainstream solutions do not.

And if the bank implements the best form of Passkey (and implements it well) in this case it would require the user to biometrically authenticate before sending money (perhaps based on dollar amount or transaction volume) to a new account. The user would hopefully learn over time that the biometric requirement is aligned with money transfers and would grow suspicious if they were prompted for it during a scam session.

Any site/service could easily implement their own proprietary solution to force compliance around usage of said service. Whether they can abuse Passkeys or not is irrelevant. If the service does something inappropriate, you can stop using it and, if necessary, build a competing service that is not abusive.

To suggest that people should stop using Passkeys over this is throwing the baby out with the bathwater. All of these features of Passkeys are appropriate in a given context. The only concern is where a service that might not need/justify "high security" Passkeys starts demanding them anyway, and no-one is forcing you to use said service in that case.

Your brain, your values. Only you can know why you ascribe less value to things that AI readily produces, but it is fundamentally a choice you get to make.

In the beforetimes, a lot of people didn't value software, but many software developers still did.

You don't have to jump through hoops of your own making to justify the things you want to enjoy and, outside of the workplace, people won't value you as an individual based on any set of performance criteria.

What do you think should happen if an artist views a lot of arts over their lifetime and then themself generates something similar to another artist's work? I would argue that collectively humans have been standing on the backs of other humans all throughout history. An artist today does not simply come out of the womb knowing how to make great art - they learn it by observing other art, learning about art and practicing (not altogether dissimilar to model training) over many, many hours.

Is it fair to say, then, that artists who have trained on the work of prior artists should also not be able to protect their works unless they have directly received consent and have compensated all the artists whose works they have viewed and potentially learned from over their lifetime?

And this is one of the reasons some people are up in arms about Anthropic's recent inclusion of watermarking against anything Claude models touch. It will even take human-generated code that it works on and apply watermarks to it which can be then used to prove it was AI processed and perhaps invalidate any copyright on even human-written code.

I don't like it and I wasn't consulted about it. Given it is supposed to be representative of a united humanity or something like that, I'd be interested to know what proportion of the 8 billion people were consulted in its creation.