Thankfully someone with some sense. I saw that post title and didn't even bother to read it. It sounded like someone having argued with me a decade ago that IPv6 is a mechanism for the government to track you because you have no more privacy anymore because you don't have NAT...

▲

0x20Fearless 3 hours ago | parent | next [-]

I’ll be silly, but having a unique address per device, is indeed a simpler vector to track, right?

On topic, I’m not sure I even trust my own password sanitation, and seeing service A and B hacked every other month, I feel weary. Knowing that someday my passwords might be compromised as well, so what should I do as just a person who can’t remember things? Write them down, I guess.

	▲	flumpcakes 2 hours ago \| parent [-]
		It's common for devices to choose a new IPv6 address within your range at random to perform a new connection / rotate periodically. Which in turn makes it harder to track vs. your /64 which is approximates your old NAT'd public IPv4.

▲

malfist 3 hours ago | parent | prev | next [-]

This:

> Thankfully someone with some sense

Cannot be asserted with this:

> I saw that post title and didn't even bother to read it.

▲

2 hours ago | parent | prev | next [-]

[deleted]

▲

chaps 3 hours ago | parent | prev [-]

Why didn't you bother to read it but still think they have no sense?

▲

blackcatsec 3 hours ago | parent | next [-]

Because I too understand passkey attestation and have written code to do exactly that and have worked in multiple enterprises where we've done a mass Yubikey rollout across thousands of people. So I've got a pretty solid understanding of passkeys, yubikeys, and attestation. As well as I don't read headlines of people claiming it's "tracking you".

	▲	alterom 2 hours ago \| parent [-]
		Yay, finally an expert. Can you help me figure out some things? 1. One time when I was abroad in Poland, a thief walked into my room at night and stole my wallet, phone, and laptop. (The thief was eventually caught 6 months later, but that's another story). Question: what to do in that case if I were using passkeys? Is there a solution that doesn't require trusting a cloud provider? 2. Currently passkeys are offered as an alternative to passwords. What are the mechanisms that require passwords to be available as well? I.e. what stops my bank from simply giving me a passkey at a branch and offering no other option? 3. Clouds are currently the easiest way to use passkeys. Last time I checked, you were locked into that cloud, but things move fast. What ensures the ability to move the keys out of the cloud? And what do I need to do to have my own "cloud" like that? 4. What protection does the passkey ecosystem offer for physical threat to the user? With passwords, there's no way for anyone to know which Hacker News accounts are mine, or whether I still have access to them. I don't remember has plausible deniability (who hasn't ever forgotten a password?). With passkeys, getting detained with your device means surrendering all your passwords, to my understanding. What am I missing? Thanks!

▲

loloquwowndueo 2 hours ago | parent | prev | next [-]

Would you bother reading an article whose title is “the earth is flat. No really. “

	▲	chaps 2 hours ago \| parent [-]
		If I was posting in a thread about an article responding to that article, then yeah -- I'd read it. But we're not.

▲

alterom 2 hours ago | parent | prev [-]

Because, apparently, passkey evangelists are a cult.

The spec requires passwords to still be an option, they say, so there's nothing to see here, move along — and avert their eyes should an inconvenient argument come their way.

Because, see, we all know that specs are ironclad, never change, and are always fully implemented.

Also, putting all your eggs, ahem, passkeys into one cloud basket (as this article recommends) to "move around" is surely the most best solution better than passwords.

Because we can always trust the cloud, right? Not like it's somebody else's computer or anything, that they can instruct to not do what you tell it.

Anyway, none of the passkey lovers ever answered me what to do if my computer and cell phone ever get stolen again when I'm traveling abroad in the Brave New Passkey World.

The best answer I got was carry a yubikey with me at all times.

One more thing to worry about losing, yay. Much convenience, very security, wow.

If there are any new developments on that front, would love to hear them.