uzyn

The site has a hidden webauthn trigger[1], an anti-pattern that automatically logs user in via passkey if it exists. A better approach, IMO, would be requiring user to click "log in".

[1]: `<input type="text" autocomplete="username webauthn" style="position:fixed;top:0;left:0;width:1px;height:1px;opacity:0;pointer-events:none" aria-hidden="true" />`

The security issue aside, seeing more companies push announcements like these on X as the only official source is a trend I'm not sure I like.

I can understand the rationale, this feels lighter and not something that belongs on status.github.com or the blog. Maybe what's actually missing is an official channel for ephemeral stuff on a domain they own, somewhere between a status page and a tweet? Just sharing an observation.

It seems our fingers have gotten thinner, or more skillful at tapping at relatively tinier buttons now. Look at how huge those buttons are.

I am aware screen size has increased tremendously, even then I think the buttons were still quite huge compared to the size of today's tappable links.

Impressive! Feels really responsive. I feel the controls are a little unusual though: WASD corresponds to actual map orientation rather than to where the character is facing. I find it confusing when playing together with a mouse, where I would expect I can hold W to move forward while using the mouse to control the character's orientation and direction.

If C uses it without the knowledge of the original owner (A or B). With proper signCount check, C would have to increment it at its end; A or B would not have known.

When A logs in with an unincremented signCount. A and the relying party are now aware of a potential cloned authenticator and disable the compromised passkey.