I live in a country where there is no market for a decent business laptop with good support (like a P1) and everything is plasticy or RGB-laden tat.

I was kind of forced onto a mac as it was the only thing that had decent-enough support or I could buy an identical new one and restore a backup on, without having to use something grey market

Unless it's a very specific hardware, most Linux distros will boot up fine from the same disk image on different machines or even inside a VM.

That doesn't seem to be a common situation though, having access to premium Apple hardware, and not business laptops.

Which part of the claim is nonsense and which tool is the parent trying to get people to switch to?

Everything should be considered 'insecure' unless formally verified (EAL7 etc.), and even then there may have been bugs in the verification process.

The low bandwidth always on kindle modems could also be feasibly built into TVs for telemetry, and may be cheaper than the money they could get from selling the data.

The country I live in (VN) recently banned online banking without using a mobile app and biometric verification via selfie. The sites had to withdraw access.

It may be technically difficult / expensive / annoying if it was not designed into their system. Your linux box doesn't has hordes of peers / backup mechanisms and cross references to users, to a point that it may be impractical or not cost effective to conclusively prove that a user is deleted everywhere

Deletion may not have been in the original spec or in any of the specs that were bolted on.

Sure, ok. But whatever happens is still an internal process. Not a legal one.

‘A regulator once told one business that it was okay to do one thing’ is very rarely any indication that that same regulator would take the same position for another business in another situation. Let alone that regulators in general will take the same position.

Lots of security relies on potential attackers being lazy and relatively 'sane'.

There are lots of security measures you can bypass if you pretend to be crazy within given bounds or simply stop acting sane.

I wonder if this will become increasingly niche if people grow up with systems that can spoon feed tailored content and monitor feedback

I believe passkeys can be made phishing resistant, as they can be cryptographically bound to a given application, and the application has to attest itself to your system too.

You won't be able to use your google account passkey to log into the perfect clone of "gmail.com" where the 'a' is actually a greek or cyrillic letter or something, and neither will your ageing parents. You could still paste your password into the fake site from your password manager, or the spyware on your computer could still sniff it from your clipboard.

Password managers check the domain before they fill.

But users can and do override this decision. "Huh, why isn't 1Password autofilling my password on bank0f4merica.com? Let me quickly select 'autofill and remember'..."

I'm somewhat desensitized to this myself for non-bank use cases. It's unfortunately necessary with corporate merges and rebrands. After all, how is my password manager supposed to know that it's safe to fill my hulu.com password on disneyplus.com? The same applies to mobile apps providing some-outsourcing-vendor.com instead of my-actual-service-provider.com etc.

For passkeys, there's native support for that type of thing using "related origin requests": https://web.dev/articles/webauthn-related-origin-requests

> But users can and do override this decision.

Yes. That is a feature, not a bug.

Transferability and delegation of authority are features. Calling them "phishing vectors" only makes them seem like a bug.

Being able to enter my Hulu password on disneyplus.com is a feature, being able to enter my Bank of America password on bank0famerica.com is a bug. The problem is that the same behavior causes both.

I'll raise you a better one:

Being able to give your Hulu or Bank of America password to your spouse is a feature, but giving it to a scammer is a bug.

Can't have one without the other, but I disagree making credentials non-transferrable is the right choice.

Name one password manager with an "autofill and remember..." action that fills passwords from unrelated domains.

You're spreading nothing more than FUD. This is a completely imaginary threat vector that doesn't exist. And even threats that do exist don't always justfity security at every cost. The optimum amount of security is never 100%.

...until you login to, say, your Microsoft account on one of like 27 domains that use the same SSO and your autofill doesn't trigger so you just grumble to yourself "man I hate the modern web" and manually copy/paste it in.

Hopefully after thoroughly checking the URL but you only have two minutes before the Uber gets here and just need to get this one last thing done ASAP...

Don't most people use git for their latex (or even markdown) version control? All the tools that have been developed for code collaboration work really well for documents compared to messing around with word's undocumented format and binary blobs.

In academia (at least in fields that primarily use LaTeX) most people just use Overleaf.

No, git is understood as an unreasonably difficult Dropbox for most people that do not code substantially.

I use Markdown + Pandoc compiling to a .docx as a workaround, but merging changes back is manual.

I just had to use teams to speak to the British government to get a passport. I don't think there is another option.

Maybe they should stand up their own gov jitsi or something, but then the public may not be able to work out how to use it.