Hacker Newsnew | past | comments | ask | show | jobs | submit | jaefi's commentslogin

Anything that requires more than a boilerplate (everything).


You DON’T have to trust any company or government for passwordless authentication. Don’t want to use your phone? Use a hardware key instead. Don’t want to use a hardware key? Use an open source solution like Bitwarden (and it’s not the only one).

At this point, you’re just making shit up about something you don’t understand.


> Don’t want to use your phone? Use a hardware key instead. Don’t want to use a hardware key? Use an open source solution like Bitwarden (and it’s not the only one).

You're ignoring the fact that WebAuthn can require attestation, which will remove device choice from the equation.


You havent understood my point.

> Nothing compares to the secrecy of password.

Because they are soley internal to you.

Yes, you can generate passkeys at will ... and then you give them away to a usb dongle or HSM, from which some day you might not be able to export them, because vendors love their locked in customers.

I am talking about control and yes, my concerns are speculation but reasonable to me, when you look at pretty much all the recent development. From not-WEI over DRM, to right to repair and on and on.


Looking at bank security is probably the saddest landscape around. Most will ask you for a PIN at maximum and then tell you it's not possible to have stronger authentication because of "safety".

I wish there was stronger laws forcing banks to adopt stuff like that.


I wish there were laws making it the bank's problem if your account gets hacked. The security they choose to use is secondary, but you bet they'd be the most secure websites around if they were liable for the losses.


You won't probably get what you wish for: this is how it works in South Korea but the solution that the banks went is worse than SMS-OTP, where your bank is expected to monitor your computer (https://palant.info/2023/01/02/south-koreas-online-security-...).


The new Google Titan keys can store hundreds; sadly not even sure if I can get one here.


Oh that's interesting, thanks for linking it!


Given how the project is going, not even sure if there will be a V3 at some point.


That's actually what gives me confidence. All the hardware manufacturing problems almost ensure a v3 will be designed.


I meant more the lack up updates and communication doesn't really paints a bright future for Solokeys.


I wrote a small article about security keys. I hope y'all will like it.


Cool article!

Sorry your SoloKey V2 experience isn't going so well. I have a V1 and it's been surprisingly robust over the past 3 years. For NFC, I can only get it working with my Pixel 7 phone of I remove the thick OtterBox case. Perhaps your issue is also related to your case thickness? Having to remove the case is a hassle, so I am sticking with multipurpose USB-A to USB-C adapters for now.

I've been using YubiKeys for like 10 years, but the 5C model I recently got suddenly stopped working out of nowhere. It only lasted me from October to November of this year. I've been wondering if the brand has had a quality drop-off.

Of the security keys in my possession, the Thetis U2F key has lasted the longest (~5 years) and has had no problems whatsoever. They've since released updated FIDO keys, and so I purchased 2.

Good luck on your hardware MFA journey!


Hey! For the NFC thing, I tried with and without a case and seems the issue remains the same (maybe just a hardware failure). I must say I had more chances with NFC on my USB-C key thought it's still a bit jittery. On the other hand, the Yubikey's NFC works perfectly, even with the case.

Also I didn't knew about Thetis, I'm gonna look into those.


Hey there! Yes, I kinda was surprised that the M1 held like this, my previous experiences with ARM-based processors was with single-board ones like the Raspberry Pi which obviously don’t are as snappy as the Macs are. I personally will probably not buy the M2 as I feel the M1 will fullfill its function perfectly for the years to come :)


Hey there, author here! I got the M1 around the 15th March of 2021 from work, at this time, Docker and some other apps weren’t fully supported yet but tech previews were letting a favorable view of the whole thing. I am pretty lucky since Docker isn’t really essential in my work and is just a nice bonus that saves time when doing local tests. Even tho some little things were frustrating at first (some applications not supported), a little patience never killed anyone :) In the end, even with that, I would say that the experience was pretty much painless given I only had few programs not running either natively or M1, most of which being games.


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: