Also next to impossible to write down to give to someone else.

This (or by phone) is how I've transferred: all family accounts, all small community accounts, some business accounts, many friend-shared accounts, and it's also how some people ensure accounts can be accessed if they die. It's not a small problem.

Yeah, I think people will lose their passkeys a lot. I think companies are happy to provide another service ("passkey syncing") that you will pay for for life. Back In The Day you could be a freeloader by remembering your passwords like a nerd. No longer. The loophole is closed!

That said, passwords are actually so bad that anything would be an improvement over them. While a stealable passkey vault sync'd to your malware-infested Windows laptop is not ideal for security, it's sure better than typing your bank password into your favorite forum because you don't understand that website administrators can see your password when you type it on their site. (Not to mention phishing.)

Apple, Google, and Microsoft already do passkey sync for free. They don't do exports, though. However, there are various third party solutions for synching passkeys that aren't tied to your computer manufacturer.

I don't think passkeys are going to replace passwords any time soon, and I don't think freeloaders are even part of the equation here. You can share a passkey through Bitwarden just as easily as you can share a password.

Freeloaders already need to jump through hoops to share passwords and even then they're getting off easy; if streaming companies actually cared about catching freeloaders, they could stop the practice all together. What they're doing now is just signalling them that you're not supposed to and adding very minor annoyances to the mix.

Only in their own ecosystem, though, right? I use Windows and an iPhone; nothing syncs. I use 1password instead.

Would iCloud for Windows help sync things for you?

https://support.apple.com/en-gb/guide/icloud-windows/icw2bab...

After you set up iCloud for Windows, you can use iCloud Passwords to access your passwords in Google Chrome or Microsoft Edge using a browser extension. You can also manage your passwords in the iCloud Passwords app.

They used to complain about that 10 years ago, but apple was just ahead of it's time. Microsoft saw the light and is racing down that path. Soon enough, no computer without user-defeating secret logic and remote ownership will be allowed to interact with important networked applications. Linux users will either need a tainted linux variant or not have access to banking, streaming (already a problem), games, and so on.

And still, the entire bank account is still vulnerable to a $15 silent borrowing of your phone number for a day, bypassing all normal protections. The system is only harder to access for the rightful owner.

How would that attack work?

SIM Swap attacks are what they are referring to, I think.

Or SS7 attack to intercept SMS messages, no SIM swap required.

Doesn’t this require physical access to a compromised mobile network?

Requires that someone has physical access, that they can then sell digital access to.

Do banks really use SMS as an auth method these days?

This is only true in some countries, and tbh. having this as the state of the art, sounds a bit dystopian. I've been using my BankID, which is a Norwegian electronic identity solution, to log into banks and such, for decades now. With these type of solutions, there is no way that taking control over phone numbers make any difference when trying to get access to a bank account.

Btw. this type of electronic identity solution are not Norway specific, I know all the other Nordic countries have them, and they are, as far as I know fairly popular in the rest of Europe as well.

Or if you get your line cancelled for some reason and have no access to your phone number and you are abroad. You’ll have trouble with banks and many other things that use phone number for verification.

Really wish they worked on removing phone number verification before doing any other security/password thing.

It is already required to buy an approved terminal to participate in society. This may seem a bit of joke in some countries but in many places it is absolutely real.

The next step in progress is to bake in functionality that can guarantee interested parties that it is you operating the terminal at all times.

You're probably right. We'll have enforced boot chains and attestation for devices if we want to take part in large parts of our economic system in the future. A ton of important systems like banking, safe and secure sex worker and entertainment sites for users and performers, government services like online taxes and car licensing and drivers testing* and children-safe sites.

Over twenty years ago, many of us warned about the dangers of increased and unaccountable intelligence service power. We saw what the Patriot Act would create.

We joined the EFF and the ACLU, or renewed our memberships. Organizations at the time that focused more on actual deep philosophical issues and how they relate to our political world.

Obviously the Patriot Act has saved lives. Terrorist events and neglected victims are tragic and VERY emotional.

But today, immigrants and others are spending their own lives protesting the actions of ICE. Their own very limited time on this planet.

I'm not here to judge Immigration and Customs Enforcement. I'll take flak for that among liberals. Again, I'm not judging ICE. In many cases they've been falsely accused where there was clear evidence they weren't at fault.

No, what bothers me is immigrants, who already have difficult lives, and Generation Z, who have less economic security themselves, are the ones marching in the streets.

Twenty years from now, who will be working extra unaccountable and unbillable hours protesting in the streets because the DRM and secure computing systems being pushed through today are abused?

Even if most of that abuse is a show, meant to divide citizens and law enforcement. There are people out there working for free for that show.

Who will work more in the future?

And like not judging ICE, I'm not judging the countries racing and battling to deploy secure computing environments. Knox and TrustZone and TPM and whatever new things await us in the future. There are reasons both for safety and economic security I dont judge.

And there are dark patterns around software supply chain weaknesses and online safety and incentives to accelerate those issues to push through security architectures.

Other countries are doing it. I hate the fucking game theory solutions that it encourages.

But what I'm worried is that in twenty years who will be working for free because our secure computing environments are found unfair?

And unfair can be many things. Governments push values, even when it's not explicit. When I'm using my integrated cyberdeck or implants or just ambient room device, what am I missing? What is being pushed into or out of my vision or awareness?

That's twenty years in the future, what's forty years in the future? I won't be here, but you bet your ass I'm worried. Because the people who I fucking care about now working their asses off for free are being blinded about the upcoming digital wreck, like they were in 2001.

* I believe myself here, that's key.

Until recovery and multi-device support are seamless across ecosystems, forcing this kind of shift just adds friction

Both are technofeudal corporations and hostile to users' rights.

Microsoft is just rapidly getting even worse lately.