Conversation

Notices

1. Embed this notice
   Cassandra Granade 🏳️‍⚧️ (xgranade@wandering.shop)'s status on Wednesday, 01-Jan-2025 07:22:14 JST Cassandra Granade 🏳️‍⚧️

   My 2¢ on passkeys: until I, as someone who is comfortable reading the developer docs on the passkey spec website, can figure out how to use passkeys with my own personal tech stack — a stack that involves a phone running Graphene and Firefox, a Linux desktop and laptop running LibreWolf, and a variety of self-hosted services — passkeys are not personally useful to me.

   They may be useful to other people, but I'm not in a position where I can compromise on that stack.

   • Embed this notice
     Cassandra Granade 🏳️‍⚧️ (xgranade@wandering.shop)'s status on Wednesday, 01-Jan-2025 07:24:36 JST Cassandra Granade 🏳️‍⚧️

     in reply to

     In principle, KeePassXC works great for passkeys on my desktop, and I can sync them using my self-hosted NAS, but that doesn't help me on my phone. The path of least resistance seems to be "use Google" or "use Apple," but I've taken extraordinary efforts to remove as much cloud stuff as I can from my life, and I'm not eager to put it back.

     That KeePassXC exists makes it clear that self-hosting is possible, but there's too little documentation and too many gaps for that to be practical for me.

     Bill repeated this.
   • Embed this notice
     Cassandra Granade 🏳️‍⚧️ (xgranade@wandering.shop)'s status on Wednesday, 01-Jan-2025 07:27:15 JST Cassandra Granade 🏳️‍⚧️

     in reply to

     It's a bit unfortunate, because using PKI for authentication is an obvious win over sending the untrusted authentication provider your entire secret key (you know, the password). I want to use PKI. Fuck, I'd be happy just giving SSH pubkeys to every site I use and doing shit that way.

     So I should love passkeys! And the spec and developer docs are cool! But they practically don't exist for me personally, and that's kind of sad.

   • Embed this notice
     Glyph (glyph@mastodon.social)'s status on Wednesday, 01-Jan-2025 10:06:47 JST Glyph

     in reply to

     @xgranade it is very unpleasant to be wedged firmly into the fracture between "all the tech institutions we have are private companies and therefore suck" and "all the atomized, individualized tech-libertarian free 'products' to reduce dependence on those institutions are developed by people with an unrealistic understanding of the resources required to maintain them and therefore suck" and while I have made a different compromise judgement here I have a lot of sympathy for this view

   • Embed this notice
     Cassandra Granade 🏳️‍⚧️ (xgranade@wandering.shop)'s status on Wednesday, 01-Jan-2025 10:06:47 JST Cassandra Granade 🏳️‍⚧️

     in reply to

     • Glyph

     @glyph Other things I find myself wedged between: "software outside the OS duopoly tends to be poorly funded, and thus sucks" and "specs are predominantly written in the context of an internet that is more dependent than ever on unaccountable cloud services, and thus suck."