Some context I think is missing: TFA's author claims to use passkeys for 2FA (and so, not as a password replacement as I think is often implicitly assumed in discussion):
> This one can be tricky because I've seen many sites using passkeys to replace passwords, but that's not something we've done on Report URI, passkeys are used as a 2FA mechanism.
TFA's author has also explicitly precluded the "platform-authenticates-you-to-website automatically" workflow, in a separate blog post [0]:
> This one can be tricky because I've seen many sites using passkeys to replace passwords, but that's not something we've done on Report URI, passkeys are used as a 2FA mechanism.
Well, they can (and likely will be) used in both modes. Either these things are just a different way of generating a password for a password manager (itself a big target of attacks), or they are a way "to move beyond password with TPM-level security". If it's the former, the security benefits are limited. If it's the latter, the "it's a trap" logic applies at least in part.
> Well, they can (and likely will be) used in both modes.
I agree - and that makes me wish that the messaging was more clear from passkey supporters. Some may be genuinely confused and talking about one or the other mode (or not even realize that multiple modes exist), and some may be trying to claim the benefits of one mode while/or handwaving away the tradeoffs of the other mode.
I'm a happy user of 1Password myself, but warning that they only allow export of passkeys through a specific protocol, and it has to be done on the mobile app. [0]
> 1Password for iOS exports ... directly to other supported apps, including your passkeys.
They pick the list of other supported apps. There is no ability to export to a standard encrypted file, nor is there a way to develop an open source app that can receive an export over the objections of 1Password Inc.
Exactly. So much for TFA's "or whatever other software of your choosing" claim.
Passkeys are a trap, trying to lock users in to the service providers.
I did say I like and use 1Password, but I do remember that they switched from a one-time payment model to a subscription model, and have now stopped supporting the old software and only support their subscription software. If it wasn't for my non-tech-savvy, aging family I support their usage of 1Password for, I would still be on Keepass[XC] for my own private usage.
Exactly this. I've tried hacking together a syncing solution on both Android and iOS, from Syncthing, to Git via Termux (Android) or Working Copy (iOS). I didn't try NextCloud or Dropbox etc, but that Obsidian Just Works(tm) as smoothly as Apple Notes (but is available as a full-featured desktop app in Linux -- I know Apple Notes has a - slightly janky - web interface)... I was happy to pay for the sync and stop worrying about checking on my sync status or remembering to push my commits.
Plus the hotbar on mobile makes it easy to do bullets/checkboxes, as easy as typing on my computer keyboard.
For those like OP and me who don’t want to grind but want a little bit of the RuneScape-themed “number go up”, there’s Melvor Idle - originally RuneScape-inspired and I believe Jagex bought it eventually. I like to have it idling on the other monitor when I’m doing mindless admin on the pc, or will check it on my phone a couple times a day
I installed Kubuntu on a laptop for work, since I use KDE at home. It was slightly annoying to have to re-configure stuff like the DE settings, Dolphin etc though.
Anyone have suggestions for syncing/version controlling KDE Plasma 6 configurations?
Karen Horney (20th-century German psychoanalyst) in her book "Neurosis and Human Growth" talks quite a bit about this failure mode. The relevant bit I want to share is her talking about how a person may be in a state of neurosis due to not feeling like they are living up to their idealized self -- and that a commonly destructive response to that neurosis is trying to force everyone around them to treat and perceive them as if they were that idealized self and not the flawed real self they are (regardless of whether the people around believe or are deceived into believing that, which is where she diverges from your point a bit but I think you're touching on very similar things).
Thanks for sharing this insight. I was not previously familiar with her research; interested to learn more. And I agree what I put forth is a narrower notion, perhaps reductive, I had not really considered a context in which “forcing others to believe some subjective account of your shared reality” would manifest other than via deception to whatever extent, but I suppose it could be of a different nature.,
Yes, this. I've found good prices on used electronics on Facebook marketplace, as well as eBay, Swappa ("Craigslist for used electronics", cheaper than Backmarket but no QA, is just for coordinating private sales person-to-person), Backmarket (slightly more expensive than Swappa, but has in-house QA and is backed by their business), and Unclaimed Baggage.
> This one can be tricky because I've seen many sites using passkeys to replace passwords, but that's not something we've done on Report URI, passkeys are used as a 2FA mechanism.
Source: https://scotthelme.co.uk/xss-is-deadly-for-passkeys-the-hidd...