Skip Navigation

InitialsDiceBearhttps://github.com/dicebear/dicebearhttps://creativecommons.org/publicdomain/zero/1.0/„Initials” (https://github.com/dicebear/dicebear) by „DiceBear”, licensed under „CC0 1.0” (https://creativecommons.org/publicdomain/zero/1.0/)JO
Posts
9
Comments
843
Joined
2 yr. ago

  • When you're spending $300M on a game budget you don't want to take a lot of risks. But I don't think there's any lack of creativity coming from the market as a whole. Most dire pronouncements on the state of games are only really true if you ignore indies.

    Like honestly, I think GOW and Spider-Man and Horizon are fine, but I'd rather see Sony put out several AA games that take risks than crank out another sequel to those.

  • If you're paranoid about this, go buy a yubikey and use that to secure your device/access to your passkeys. Being able to secure your own data instead of relying on the admin who may or may not know what they're doing to secure the server is an advantage of passkeys.

  • It''s really up to the end device (and the user of said device) to decide how much security to put around the local keys. But importantly, it also requires access to the device the passkeys are stored on which is a second factor. And notably many of the implementations of it require biometrics to unlock.

    The "one password" thing is also true of password managers, of course. One thing about having one master passphrase is that if you do not have to remember 50 of them, then you can make that passphrase better then you otherwise might, plus it should be unique, which prevents one of the most common attack vectors.

  • If you've ever used ssh it's very similar to how ssh keys work. You create a cryptographic key for the site; this is the passkey itself. When you go to "log in" the client and server exchange cryptographic challenges, which also verifies the site's identity (so you can't be phished...another site can't pretend to be your bank, and there are no credentials to steal anyway). Keys are stored locally and are generally access restricted by various methods like PIN, passphrase, security key, OTP, etc. When you're entering your PIN it's how the OS has chosen to secure the key storage. But you've also already passed one of the security hurdles just by having access to that phone/computer. It is "something you have".

  • My biggest criticism is that I'm not really the one who sets my meeting schedule, even when I'm the one who sends the invite. Unless your entire company has a "no meetings until 2pm" policy this isn't really doable. Especially if you work with people in multiple time zones.

  • Password managers are never going to hit anywhere near 100% adoption rate. It requires knowledge on the part of the user and in many cases money. No grandma isn't going to roll her own with keepass. Most likely she'll never even know what a password manager is. And as long as those users are still out there, admins still have to deal with all the problems they bring.

    Incidentally I looked and it's been over a decade since I started using my first password manager. They're not that new.

  • You're looking at this from the perspective of an educated end user. You're pretty secure already from some common attack vectors. You're also in the minority. Passkeys are largely about the health of the entire ecosystem. Not only do they protect against credentials being stolen, they also protect against phishing attacks because identity verification is built in. That is of huge value if you're administering a site. Yes if everyone used a password manager there would be less value, but only about a third of users do that. And as an admin you can't just say "well that guy got phished but it's his own fault for not using a password manager."

  • I do think that we need more standard procedures around what a reset/authorize new device looks like in a passkey world. There's a lot about that process that just seems like it's up to the implementer. But I don't think that invalidates passkeys as a whole, and most people are going to have access to their mobile device for 2 factor no matter where they are.

    Incidentally I have no idea who this is or whether his opinion should be lent more weight.

  • I mean, their position is that they as the rights holders can republish how they please, but that buying a cartridge does not give you license to play on other devices. You can disagree with them on legal or philosophical grounds but their position isn't really inconsistent.

  • I recall reading that part of why Japan has more vending machines and more variety is the ownership model. In the US vending machines are typically run by companies that service them and collect the revenue. But in Japan, they're typically owned by the shops. So shops are more likely to put a variety of products from their store in the vending machines.

    I also suspect a higher incidence of social anxiety increases the demand for them in Japan.

  • The original is locked at 30fps, and they've got an in-house studio which remade Demon's Souls. Seems like low-hanging fruit. Game is almost a decade old so it seems like a reasonable time frame.

    I'm not really part of the group opposed to remakes though. I just don't buy them if I feel like they're unnecessary.

  • Because it's not happening. Constitutional amendments are just very much off the table in the immediate future. The interstate popular vote compact is an interesting idea but it's going to stall out far short of deciding the election. And it's not a high salience issue for many voters.