News for hackers. Stuff that matters.
Re:DuckDB NPM packages 1.3.3 and 1.29.2 compromised with mal... by koakuma-chan on Tuesday September 09, 2025 @08:11AM (#45180837)
Npm can't force people to use password manager
Re:DuckDB NPM packages 1.3.3 and 1.29.2 compromised with mal... by diggan on Tuesday September 09, 2025 @08:18AM (#45180920)
Nor does TOTP+password lock you to one authentication provider indefinitely. Tradeoffs :)
Re:DuckDB NPM packages 1.3.3 and 1.29.2 compromised with mal... by maltee on Tuesday September 09, 2025 @08:31AM (#45181056)
You can always register a new passkey with the site if you want to switch authentication providers, can’t you?
Re:DuckDB NPM packages 1.3.3 and 1.29.2 compromised with mal... by diggan on Tuesday September 09, 2025 @10:20AM (#45182306)
Yeah, I guess that'd work if I had a couple of accounts, but since there a bunch of them, I really need proper import/export to feel comfortable with moving to it. I just know I'd punt the task of migrating everything if I have to go account-by-account to migrate away.

Considering that today it'd add work for me today, and future work, with no additional security benefits compared to my current approach, it just don't seem worth it.

Re:DuckDB NPM packages 1.3.3 and 1.29.2 compromised with mal... by vel0city on Tuesday September 09, 2025 @10:19AM (#45182300)
I've got passkeys from multiple "authentication providers" available on all of my devices. This isn't a tradeoff.
Re:DuckDB NPM packages 1.3.3 and 1.29.2 compromised with mal... by ljlolel on Tuesday September 09, 2025 @08:19AM (#45180934)
You can if you just force passwords longer than people can memorize or even want to write down (assigned 24+ characters)
Re:DuckDB NPM packages 1.3.3 and 1.29.2 compromised with mal... by koakuma-chan on Tuesday September 09, 2025 @08:26AM (#45181014)
It's just gonna be on a sticky note hanging on the screen or under keyboard
Re:DuckDB NPM packages 1.3.3 and 1.29.2 compromised with mal... by hu3 on Tuesday September 09, 2025 @09:20AM (#45181568)
careless people just copy paste those