News for hackers. Stuff that matters.

A comment on NPM debug and chalk packages compromised. Parent comment

Re:NPM debug and chalk packages compromised by yawaramin on Tuesday September 09, 2025 @01:20AM (#45177707)
I'm angry about this. Large megacorps with the budget of medium-sized countries allocate the minimum amount of budget to maintain their auth systems and still allow the use of phishable auth methods. If npm disabled passwords and forced people to use passkeys, this huge problem just disappears tomorrow.

But instead, we're left with this mess where ordinary developers are forced to deal with the consequences of getting phished.

[ Parent | on HN ]
Re:NPM debug and chalk packages compromised by hdjrudni on Tuesday September 09, 2025 @03:15AM (#45178575)
Passkeys can be a pain in the ass too. Evidentially I set up my Yubikey with Github as some point, which is fine if I'm at my desktop where my key is plugged in, but if I want to sign in on mobile.... now what? I just couldn't log in on mobile for months until I realized I think there's a button on there somewhere that's like "use different 2fa" but then what was even the point of having a key registered if it can be bypassed.
[ Parent | on HN ]
Re:NPM debug and chalk packages compromised by dchest on Tuesday September 09, 2025 @03:29AM (#45178662)
While you can setup passkeys with YubiKey, the most common intended use case is key pairs that are synchable via your Apple/Google/password manager account. So, once you add a passkey, you'll be able to sign in on mobile with it automatically.
[ Parent | on HN ]
Re:NPM debug and chalk packages compromised by sneak on Tuesday September 09, 2025 @04:20AM (#45179088)
You can use software u2f (iCloud supports this), you don’t need Yubikeys.

Also, Yubikeys work on phones just fine, via both NFC and USB.

[ Parent | on HN ]
Re:NPM debug and chalk packages compromised by nialv7 on Tuesday September 09, 2025 @09:57AM (#45181989)
you can use yubikeys for both passkey and password+2fa. this way you aren't bypassing anything. and btw, you can get USB-C yubikeys so you can plug it into your phone. if even that's not an option, you can get a USB-C to USB-A adapter.
[ Parent | on HN ]
Re:NPM debug and chalk packages compromised by yawaramin on Tuesday September 09, 2025 @11:05AM (#45182928)
> but if I want to sign in on mobile.... now what?

Just set up a new passkey on the mobile device.

[ Parent | on HN ]