Readit News logoReadit News
happyopossum commented on Yep, Passkeys Still Have Problems   fy.blackhats.net.au/blog/... · Posted by u/todsacerdoti
freehorse · 16 hours ago
Not that seamless if you do not want to be locked into a single platform, though. This is what the article mostly talks about.
happyopossum · 15 hours ago
Apple has offered an “iCloud for windows” app for ages that literally syncs your iCloud Keychain (passwords and passkeys) to a windows box where you can use browser extensions for chrome, edge, etc.

You’re still not platform locked…

happyopossum commented on Yep, Passkeys Still Have Problems   fy.blackhats.net.au/blog/... · Posted by u/todsacerdoti
lazide · 15 hours ago
Huh? I’ve seen zero implementations that work seamlessly across computer, phone, tablet - unless they are all single platform, which I have yet to see anyone actually pull off.
happyopossum · 15 hours ago
There are nearly countless ones - 1password for example works everywhere, as does Roboform, bitwarden, keepass, LastPass, nordpass, and many others.

All sync seamlessly and support the major (and often minor) browsers.

happyopossum commented on Yep, Passkeys Still Have Problems   fy.blackhats.net.au/blog/... · Posted by u/todsacerdoti
lapcat · 15 hours ago
> It's an open protocol, you don't need to use any of the vendors. My Yubikey is a "passkey", so is my Flipper Zero. Keepass provides passkey support.

I don't want to use a Yubikey. It's a pain in the butt. I just want to use my Mac, with no more damn dongles.

Keepass is a vendor, and one who doesn't even have a Safari extension.

> Nothing wrong with extending this to passkeys, it's convenient and makes sense for them.

I didn't say there was anything wrong with extending this to passkeys. The problem is the lock-in, e.g., Safari requires iCloud keychain for passkeys, but not for passwords. And there is no plaintext export/import, unlike with passwords.

Nobody can convince me that passkeys are good when I buy a Mac and use the built-in Safari but can't even use passkeys to log in to websites unless I give my passkeys to a cloud sync service or have to install some third-party "solution" (for a problem that should not exist in the first place). That experience is so much worse than passwords.

happyopossum · 15 hours ago
> Safari requires iCloud keychain for passkeys

Repeating this doesn’t make it true. https://developer.apple.com/documentation/authenticationserv...

All of the 3rd party credential managers I’ve used that support passkeys work with safari, and through the APIs that Apple offers the credential managers you can even pick your default CM and never think about iCloud again…

happyopossum commented on Yep, Passkeys Still Have Problems   fy.blackhats.net.au/blog/... · Posted by u/todsacerdoti
lapcat · 16 hours ago
> Seems like vendor lock-in was the goal from the start.

Exactly. The passkey vendors state that the goal was to make phishing not just difficult but impossible. This means plaintext access to your credentials is forbidden forever, regardless of your level of expertise, and regardless of the complexity of the process to export/import them. The purpose of the so-called "secure credential exchange" is once again to prevent you from directly accessing your credentials. You can go from one passkey vendor to another, but you're always locked in to one passkey vendor or another.

Any credential system that makes it impossible to write something down on a piece of paper, take it to a new computer, and login to a website is just a gateway to vendor lock-in. You can manually manage your own ssh keys but for some reason not your passkeys.

As an Apple Mac user, what annoys me the most is that the use of passkeys in Safari requires iCloud Keychain, which of course requires iCloud and an Apple Account. [EDIT: Obviously I'm talking about built-in support. I'm well aware of third-party software, so everyone can stop replying to this now, please!] You can't do local-only passkeys, not even if you take responsibility for backing up your own Mac.

The passkey vendors took some good theoretical ideas, such as site-specific credentials and public-key cryptography, and totally mangled the implementation, making it hostile to everyone except themselves.

happyopossum · 15 hours ago
> what annoys me the most is that the use of passkeys in Safari requires iCloud Keychain

Completely untrue, Safari on both Mac and iOS supports third-party password managers for both traditional passwords and passkeys.

happyopossum commented on Gemini 3 Flash: Frontier intelligence built for speed   blog.google/products/gemi... · Posted by u/meetpateltech
anonym29 · 15 hours ago
Why do you close the bathroom stall door in public?

You're not doing anything wrong. Everyone knows what you're doing. You have no secrets to hide.

Yet you value your privacy anyway. Why?

Also - I have no problem using Anthropic's cloud-hosted services. Being opposed to some cloud providers doesn't mean I'm opposed to all cloud providers.

happyopossum · 15 hours ago
> I have no problem using Anthropic's cloud-hosted services

Anthropic - one of GCP’s largest TPU customers? Good for you.

https://www.anthropic.com/news/expanding-our-use-of-google-c...

happyopossum commented on Gemini 3 Flash: Frontier intelligence built for speed   blog.google/products/gemi... · Posted by u/meetpateltech
timpera · 16 hours ago
Looks awesome on paper. However, after trying it on my usual tasks, it is still very bad at using the French language, especially for creative writing. The gap between the Gemini 3 family and GPT-5 or Sonnet 4.5 is important for my usage.

Also, I hate that I cannot send the Google models in a "Thinking" mode like in ChatGPT. When I send GPT 5.1 Thinking on a legal task and tell it to check and cite all sources, it takes +10 minutes to answer, but it did check everything and cite all its sources in the text; whereas the Gemini models, even 3 Pro, always answer after a few seconds and never cite their sources, making it impossible to click to check the answer. It makes the whole model unusable for these tasks. (I have the $20 subscription for both)

happyopossum · 15 hours ago
> whereas the Gemini models, even 3 Pro, always answer after a few seconds and never cite their sources

Definitely has not been my experience using 3 Pro in Gemini Enterprise - in fact just yesterday it took so long to do a similar task I’d thought something was broken. Nope, just re-chrcking a source

happyopossum commented on Gemini 3 Flash: Frontier intelligence built for speed   blog.google/products/gemi... · Posted by u/meetpateltech
tootyskooty · 17 hours ago
Since it now includes 4 thinking levels (minimal-high) I'd really appreciate if we got some benchmarks across the whole sweep (and not just what's presumably high).

Flash is meant to be a model for lower cost, latency-sensitive tasks. Long thinking times will both make TTFT >> 10s (often unacceptable) and also won't really be that cheap?

happyopossum · 15 hours ago
Google appears to be changing what flash is “meant for” with this release - the capability it has along with the thinking budgets make it superior to previous Pro models in both outcome and speed. The likely-soon-coming flash-lite will fit right in to where flash used to be - cheap and fast.
happyopossum commented on Gemini 3 Flash: Frontier intelligence built for speed   blog.google/products/gemi... · Posted by u/meetpateltech
jauntywundrkind · 17 hours ago
Just to point this out: many of these frontier models cost isn't that far away from two orders of magnitude more than what DeepSeek charges. It doesn't compare the same, no, but with coaxing I find it to be a pretty capable competent coding model & capable of answering a lot of general queries pretty satisfactorily (but if it's a short session, why economize?). $0.28/m in, $0.42/m out. Opus 4.5 is $5/$25 (17x/60x).

I've been playing around with other models recently (Kimi, GPT Codex, Qwen, others) to try to better appreciate the difference. I knew there was a big price difference, but watching myself feeding dollars into the machine rather than nickles has also founded in me quite the reverse appreciation too.

I only assume "if you're not getting charged, you are the product" has to be somewhat in play here. But when working on open source code, I don't mind.

happyopossum · 16 hours ago
Two orders of magnitude would imply that these models cost $28/m in and $42/m out. Nothing is even close to that.
happyopossum commented on Ford kills the All-Electric F-150   wired.com/story/ford-kill... · Posted by u/sacred-rat
happyopossum · 2 days ago
So they’re not killing the lightning, they’re adding a range extender? I guess that’s not gonna get as many clicks, but it hardly seems controversial given market reception of the current lighting (basically everyone who wanted one bought one and then sales tanked).
happyopossum commented on Ford kills the All-Electric F-150   wired.com/story/ford-kill... · Posted by u/sacred-rat
dyauspitr · 2 days ago
That’s too bad, I love my lightning. I spend about $20/month on home charging, love the acceleration and it’s good enough to haul all the things I need for my small farm.

Also, it’s great for long distance recreational drives (from a very specific perspective)- I like driving 250-300 miles in a day and then parking at an RV spot for the night instead of a hotel room. I can run the heat and AC all night as well as have a “full tank” ready to go.

happyopossum · 2 days ago
Most campgrounds I’ve seen here (Northern California) explicitly say you can’t charge your EV in RV spots.

u/happyopossum

KarmaCake day18206October 26, 2012View Original