• 0 Posts
  • 40 Comments
Joined 2 年前
cake
Cake day: 2023年6月12日

help-circle





  • There is indeed a big difference between requiring a specific password vs. requiring a specific device or software to be able to use the service. Keep in mind that big tech can very conveniently leverage this technology to lock you in. For example think about Apple, Google and Microsoft requiring you to use passkeys, and then later require you to use your certified phone and app. Most people will not be able to “go elsewhere”.


  • You seem to be falling for what the author was writing about. Only because you could technically try to use keepassxc to store passkeys, that does not mean that it will work. You see passkeys were build in a way the service you’re trying to login to can decide if they accept your keepassxc for passkey storage or not. It looks like you are in control when you are actually not.








  • Kudos to Niccolò for openly speaking about his mistake of incorrectly stating his video was not sponsored. However I think he made a second mistake which is more serve. As a content creator he must pay more attention to what companies he’s accepting sponsorship from. Given the track record of malibal, this should have been a red flag in the first place.




  • Signal forks can have unexpected behaviours like retaining deleted messages and also they don’t get updated at the same rate that Signal get updated.

    There are ways to save messages before they are deleted even if the stock app is used. Do not ever rely on this feature to work in a “safe” way.

    Every couple of years I hear a story about hackers disturbing signal with backdoors, which would be impossible or very hard to be done If they blocked third party clients. (Ex: 1)

    That is a problem the users who prefer 3rd party clients have to deal with. Obviously if you care enough to not use the official build, you of cause have to take care of using a trustworthy source. That is not “your problem” though.

    The amount of people who use third party Signal clients are very few anyway.

    That sounds a lot like “I don’t use it, so none else needs it either” argument. In my opinion, none of your arguments above are a good reason to combat 3rd party clients.


  • Not in all situations. And in a way a user will not be aware of. The service or website can define what type of passkey is allowed (based in attestation). You may not be able to acutally use your “movable” keys because someone else decided so. You will not notice this until you actually face such a service. And when that happens, you can be sure that the average user will not understand what ia going on. Not all passkeys are equal, but that fact is hidden from the user.