Most active commenters

    ←back to thread

    2071 points K0nserv | 11 comments | | HN request time: 0.881s | source | bottom
    Show context
    zmmmmm ◴[] No.45088995[source]
    > In this context this would mean having the ability and documentation to build or install alternative operating systems on this hardware

    It doesn't work. Everything from banks to Netflix and others are slowly edging out anything where they can't fully verify the chain of control to an entity they can have a legal or contractual relationship with. To be clear, this is fundamental, not incidental. You can't run your own operating system because it's not in Netflix's financial interest for you to do so. Or your banks, or your government. They all benefit from you not having control, so you can't.

    This is why it's so important to defend the real principles here not just the technical artefacts of them. Netflix shouldn't be able to insist on a particular type of DRM for me to receive their service. Governments shouldn't be able to prevent me from end to end encrypting things. I should be able to opt into all this if I want more security, but it can't be mandatory. However all of these things are not technical, they are principles and rights that we have to argue for.

    replies(38): >>45089166 #>>45089202 #>>45089284 #>>45089333 #>>45089427 #>>45089429 #>>45089435 #>>45089489 #>>45089510 #>>45089540 #>>45089671 #>>45089713 #>>45089774 #>>45089807 #>>45089822 #>>45089863 #>>45089898 #>>45089923 #>>45089969 #>>45090089 #>>45090324 #>>45090433 #>>45090512 #>>45090536 #>>45090578 #>>45090671 #>>45090714 #>>45090902 #>>45090919 #>>45091186 #>>45091432 #>>45091515 #>>45091629 #>>45091710 #>>45092238 #>>45092325 #>>45092412 #>>45092773 #
    JeremyNT ◴[] No.45089284[source]
    This is the crux of the matter.

    Maybe conceptually you will be able to run some kind of open operating system with your own code, but it will be unable to access software or services provided by corporate or governmental entities.

    This has been obvious for some time, and as soon as passkeys started popping up the endgame became clear.

    Pleading to the government definitely can't save us now though, because they want the control just as much as the corporations do.

    replies(5): >>45089321 #>>45089323 #>>45089975 #>>45090561 #>>45090592 #
    reddalo ◴[] No.45089975[source]
    > as soon as passkeys started popping up the endgame became clear

    That's why I'm 100% against passkeys. I'll never use them and I'll make sure nobody I know does.

    They're just a lock-in mechanism.

    replies(3): >>45090207 #>>45090270 #>>45090402 #
    kleiba ◴[] No.45090207[source]
    For someone who hasn't spent any time thinking about that matter, could you please elaborate your point?
    replies(2): >>45090297 #>>45090312 #
    1. progval ◴[] No.45090297[source]
    "Passkeys are incompatible with open-source software" https://www.smokingonabike.com/2025/01/04/passkey-marketing-...
    replies(1): >>45090365 #
    2. fragmede ◴[] No.45090365[source]
    Then how come KeePassXC has them?
    replies(1): >>45090480 #
    3. indigo945 ◴[] No.45090480[source]
    The linked blog post explains it. The spec can be implemented by open source software, but the upcoming (or now current?) update to the spec enables attestation, that is, it allows the auth provider to cryptographically verify which implementation the client is using. Under this scheme, auth providers can simply choose to no longer support open source implementations like KeePassXC, and since the spec authors have already claimed that KeePassXC is "non-compliant" because it doesn't ask for a PIN on every auth request, it seems likely that that would happen.
    replies(2): >>45090540 #>>45090669 #
    4. fragmede ◴[] No.45090540{3}[source]
    Yes but it seems like KeyPassXC could just ask for PIN on every auth request to satisfy that requirement, without having to close their source.
    replies(1): >>45090756 #
    5. tadfisher ◴[] No.45090669{3}[source]
    Attestation is dead outside of corporate environments. Apple will not implement it except through MDM.
    replies(2): >>45090738 #>>45091137 #
    6. freedomben ◴[] No.45090738{4}[source]
    Isn't PAT apple implementing attestation for everyone?
    7. reddalo ◴[] No.45090756{4}[source]
    What if I don't want KeyPassXC to ask me for a PIN every time? I can modify its source code and nobody can stop me.
    replies(1): >>45091712 #
    8. GoblinSlayer ◴[] No.45091137{4}[source]
    Apple will implement it.
    replies(1): >>45095690 #
    9. pbhjpbhj ◴[] No.45091712{5}[source]
    Then your version of KeyPass will not be signed and won't pass TPM checks and so the banking app will refuse to run unless you open the signed version?
    replies(1): >>45096544 #
    10. tadfisher ◴[] No.45095690{5}[source]
    Source? That is surprising news.
    11. yencabulator ◴[] No.45096544{6}[source]
    Which leads us back full circle to "Passkeys are incompatible with open-source software" from https://news.ycombinator.com/item?id=45090297