News for hackers. Stuff that matters.

A comment on DuckDB NPM packages 1.3.3 and 1.29.2 compromised with malware. Parent comment

Re:DuckDB NPM packages 1.3.3 and 1.29.2 compromised with mal... by 3eb7988a1663 on Tuesday September 09, 2025 @11:05PM (#45192706)
It is not a given that multiple services let you enroll multiple keys. How many year did it take before Amazon allowed multiple Yubikeys? Which means you are in a real pickle if you ever lose your one hardware device with keys (lost, stolen, bricked, whatever).
[ Parent | on HN ]
Re:DuckDB NPM packages 1.3.3 and 1.29.2 compromised with mal... by yawaramin on Wednesday September 10, 2025 @12:24PM (#45199995)
It's an incorrect implementation, the same as when eg an account provider truncates a long password to 8 characters.
[ Parent | on HN ]