Hacker Newsnew | past | comments | ask | show | jobs | submit | landmass's commentslogin

Absolutely! I now won't enter the site because they kill the back button.


Why would you want to? Just create a new passkey on the other machine. If you're saving them in a password manager, just create a new entry, "Another Machine's Passkey."


There are two types of passkeys (1) resident, hardware-bound, non-copyable, installed on Yubikey etc., and (2) non-resident, copyable.

Technically, by not being copyable, a resident key isn't a "Passkey," but that's just terminology and it serves the same purpose as a passkey.


I've installed KeePassXC on my Mac and Linux machines and it stores Passkeys. Low-tech syncing is by Signal Notes to Self. If there were an audited app for iPhones I'd still be using that method; there isn't, so I've moved to Bitwarden. Passkeys seems to work fine on Bitwarden.


DuckDuckGo also suffered from the SEO infection, but recently - the last week or so, perhaps - it has improved. SEO probably still controls it, but when I put in "-Amazon" it does not present Amazon findings - remarkable! I'm also seeing a significant number of "no result" results. It isn't perfect but it's much better than six months ago.


As a long-time user of KeePassXC, I switched because of the difficulty of syncing databases. Basically, I used the sneakernet and a thumb drive whenever I thought I needed to for five or six devices - it became wearing. At first after the change I kept the critical account - banks, email, and the like - solely on KeePassXC. As I began to trust Bitwarden I began to slowly add those accounts, too.

Also, while I trust Bitwarden sync, I'm not quite as sure of the various apps that implement the KeePassXC on iOS. I'm still not aware that any have been audited, so to my mind Bitwarden is more secure.

Still, the possibility of a change of management philosophy at Bitwarden also wore on me, so not wishing to be solely dependent on an app that I might no longer trust, I continued to maintain my KeePassXC vault, duplicating any new Bitwarden entries. It's a simple way to backup Bitwarden, though a bit time-consuming.

Syncing KeePassXC is simpler now than before I migrated; sneakernet is no longer required, having been replaced by Signal and "Note to Self." It's still not as simple as Bitwarden's sync, so I'll maintain that unless I have a trust reason to change. FWIW


If there hasn't been a study of the negative effect of inviting crypto miners to use cheap energy I'm not surprised. It would probably show a huge negative effect and Texas isn't interested in disagreements with its power policy. They have carefully shielded ERCOT from having to show transparency. Industry and crypto mining are paid to reduce power usage during ERCOT-declared emergencies but ordinary user are not.


I was skeptical but what you said is real: https://www.cnbc.com/amp/2023/09/06/texas-paid-bitcoin-miner...

This is utterly disgusting.


I wonder if AI is set to outpace crypto with all the gpu compute going into the AI race.


I was told by a furniture store owner 20 years to use local cabinet makers to build bookshelves for you. He said never to have shelves installed in your house - a movable bookshelf costs the same as an installed one and you can take it with you when you move.


My participation has changed since the API change. I use old.reddit and uBlock Origin as I always have. I limit myself to scanning a few sub-reddits to ensure nothing bad has happened to Bitwarden and Yubikey, I don't log in and certainly don't contribute as I used to. If/when old.reddit stops functioning I'll stop even that low level of participation.


Curious about how Passkeys work at the website level. Passkeys strikes me as essentially an authentication method.

1. Signing up or logging in to a website today you'd expect your password to be hashed, stored, and protected. (I understand some are stored in plain text, but that isn't part of this question.) Assuming you want to change over, or create a new account, to passkeys, how do they store and protect that account?

2. Assuming you're still using a password manager for the foreseeable future, does it make sense to use passkeys to access that? IIRC, most password managers will use your password/passphrase (plus a lot of processing) to encrypt your vault. Even if you authenticate with passkeys and gain access, how do you decrypt your vault without your password/passphrase? It's clear that authentication does no good if your vault is already sitting on the black hat's desktop, as LastPass discovered, so a basis for encryption is still required. It appears to me that anything that requires an encrypted holding will still require passwords/passphrases.


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: