• 11 Posts
  • 520 Comments
Joined 3 years ago
cake
Cake day: December 31st, 2023

help-circle


  • EDIT: seems like it’s both simpler and more complex than I thought to achieve what I want. https://codeberg.org/PassFF/passff/issues/581 suggests it is “just” a local tweak. At the same time, any search I make for finding an actual implementation guide for authenticators is buried under pages of results for using passkeys in your own web app. The ecosystem’s current state seems to be “don’t bother, just trust us!”. Even the damn “passkeys.com” site is a barely disguised ad for OwnID.

    I dunno, the browser could open a file picker and let me point it towards the passkey, or perhaps let me paste the key contents into a field?

    It’s been several months since I looked into it, so maybe things have changed since, but I don’t see why the browser has to be hooked up to my password manager through a mechanism that seemingly can’t be user-piloted nor user-intercepted. How does a browser API require some external third-party software to be installed and configured to work?! It’s a public/private key pair at the end of the day, right? Not some novel algorithm, protocol, or whatever. Why can’t I simply tell the browser “here is where my existing passkeys reside; place any newly generated ones here as well”? Or perhaps “here is the program to call and here are the arguments to supply when you need to create and/or retrieve a given passkey”?

    I don’t think I have claimed the standard itself is locking anyone out - let me correct that if I did. I have just not found a way to not be locked out of the feature itself in the products of big players like Google - my Google account(s) being the one service where I feel like I could actually benefit from using passkeys over passwords (not to mention one of those I have seen pushing the “replace all your passwords with passkeys!” messaging).

    To be specific, my password manager is http://passwordstore.org/, (“the standard Unix password manager”).



  • Personal anecdote to illustrate: the last time I tried creating and using passkeys for my Google account, I got the impression they (Google) would only accept keys coming from either Google Authenticator (their 2fa smartphone app) or something like macos’s built-in keychain. No way to give them a key generated using a local, offline service that I could store however I want - it needed to be accessible using, basically, a big corpo['s software] as the intermediary. This coming from how their website would request the keys from my browser (which means mozilla seem to be in on it as well :/).

    Given that I currently use a pure file-based password manager that I can move around and switch the keys for as I please, the current state of passkeys feels like a step back in terms of allowing me to control my digital identities.





  • Honestly that description kinda makes me want to target servo for all of my hobby browser-backed UIs. Html5 with forms can do a surprising amount (albeit not always as effortlessly as just including a JavaScript library) - though I expect something like IndexedDB isn’t at all available?

    EDIT: well, the servo repo has a bunch of code in a storage/engines/indexeddb folder, but the repo aussi has about 30 open issues relating to “IndexedDB” in one way or another.









  • After the country-wide quarantine was lifted here in France, I hoped for a moment that we would capitalize on the remote-work experience to push as much employment as possible out of the cities and suburbs and into rural communities, but that never materialized.

    I don’t think it’s necessary to empty rural villages, but there definitely needs to be a concerted effort to revitalize these parts instead of letting what amount to market forces drain them of their capacity to sustain life and communities.

    The currently-employed “more efficient” farming methods are also only possible by continuing to centralize more and more land under single owners and by heavy use of fertilizers and mono-culture; there’s no telling how long they will remain effective and in the meanwhile we’re starting to recreate the landed gentry/ serfs class divide…




  • The weirdness is much less visible in Primeagen’s content nowadays (albeit I’ve almost completely stopped watching it so maybe it’s now getting more overt?), I’m not overly surprised devault has nothing concrete to point at - in fact I wouldn’t be surprised if he has scrubbed the more egregious things from his youtube channel.

    It’s never been big attention-grabbing things but more a certain level of crypto-fashy offhanded remarks and general vibes - been brought up in the weekly snarks a few months back.

    The biggest recent criticism I could make is having DHH on fire over an hour with allegedly no pushback on how terrible his “distro” is given how much primagen supposedly prides himself on his technical prowess. Then again, he’s not using omarchy himself so what does he care if the rubes in his audience get duped into trashing their machines?