TeMPOraL

And/or maybe the vendors were annoyed that people would lend the keys anyway, refusing to accept that it is normal because that's how delegation of authority works in real life too. House keys are also things you often lend to a third party that you want/need to access your house in your absence, and in fact making extra duplicated for trusted third parties is normal.

Software vendors continue to refuse to support, or even accept the existence of, this entire class of use cases for regular consumers (they are, however, more than happy to milk enterprises on convoluted implementations of those).

That's the point: passkeys, and even 2FA, address rare and unlikely threat scenarios, while defeating most common use cases (delegation by sharing credentials), and making people vulnerable to most common threats (like, losing or breaking your phone).

Humanity having millennia of experience securing them: also yes.

Major password managers don’t even allow you to export your passkeys to a file that you can read/backup yourself

That's a red flag to me. It's enough that phone backup systems go out of their way to prevent you from accessing your own data, too, for unexplained "sekhurity" reasons.

P.S. It's past time to move off of LastPass. LastPass lost all of your passwords again last month, just like they did in 2022. The most similar service is 1Password. If you like LastPass, you'll like 1Password about the same, but 1Password hasn't had multiple terrible security breaches.

That's the most annoying thing about password managers, and a major reason I still don't use them: there exists no password manager that is cross-platform (desktop/mobile in particular), local-first, and isn't sketchy or enshittified or otherwise on HN's current "don't use it, use <whatever> instead" list.

For core security tool class, that doesn't inspire confidence.

Password managers are themselves cross-device footguns and I could easily write the same headline for them myself. I've been working in tech for 20 years now, and I don't use them.

ETA: Well I do use auto-fill in browsers/mobile, but funny thing about this, I have three running on my phone[0], they all activate at the same time, and they contain mostly non-overlapping set of credentials, and I got tired of trying to sync them together, so I just look up passwords manually one by one in each and use clipboard to transfer the credential once I find it.

And I had to stop using passkeys because they interact with this split-brain system in unpredictable ways.

--

[0] - Specifically: Google Password Manager / Google Autofill / whatever they call it, Samsung Pass / Samsung Wallet (they're sort of but not the same?), and auto-fill built into Firefox.

Also from experience, most sites will implement it in every wrong way possible.

For example, all the major sites that allow the total of 1 active TotP authenticator app - trying to add one forces to delete the other. Which is fine while you have only one phone and aren't in the process of switching to another one.

That's my point: it's not a consequence of connecting a monitor. An external element is making it look like such.

This difference tells you that, for example, you cannot fix the problem by fixing the monitor, because the problem does not exist in hardware. It's actually entirely external to the hardware you own, because it exists entirely "in the cloud" (i.e. on MS and LG servers).

I disagree, the mechanism is the only important thing. Everything else is storytelling and superstition.

ToS are usually not worth the toilet paper they're printed on. They're not legally binding.

Indeed.

The point is that frequent transitions seem to incentivise rhetorical instead of literal backstabbing.

It's propagating in the runtime state - it's a "Trusting Trust" thing.

Here's my real unpopular opinion: the actual value of democracy is bloodless transition of power. Everything else is window dressing.

Those details are the only thing that matter. Without them, all you have is superstition.

20 years ago people would've called it a trojan horse.

But then, by standards of two decades ago, every website that cannot legally avoid showing a GDPR popup would be classified as malware. As it should be today. Alas, standards have changed.

Yeah, I commented on the McAfee LG thread but the stuff that comes bundled with hardware is embarassing. I don’t know how Razer, Logitech, nvidia, MSI, asus, etc get away with it. The stuff is awful, even their “good” software.

Well, this is the whole market on its own. It's entrepreneurship. No different than every web SaaS startup trying to capture some entry-level piece of computer use and then constrain it so it interoperates only with their "net of trusted partners".

They get away with it because everyone is happy and making money - the users, notably, are not part of the group here, and have no voice. The users are resources to be exploited. Same as on the web, and on most markets these days.

My point is not to shift the blame to Microsoft; it's primarily LG that's at fault here.

My point here is simply that it's not the monitor that is installing this. Neither the malware nor the URLs to malware exist on the device - they get fetched as part of normal OS-side auto-provisioning, which is the part that was compromised.

You too deserve to eat. Does it mean we're all supposed to pay you in perpetuity for that HN comment you just posted, because we read it and it's encoded in our brains now?

but illegal to train on output of LLMs.

Since when?

It's not meant to do anything about LLMs. It addresses the procurement of training data. I'm glad the courts demonstrate some basic lucidity that sadly seems to have escaped tech discussion sites some time ago.

What if I don't want to run a business? I just want to run a website!

That's why I'm not a fan of DoH or certificate pinning. Those are tools of control.

Over saturated HDR is a good default in times when all TV shows only use various shades of pitch black.

The monitors aren't installing anything. That headline was a lie.

It's Windows Update that's installing LG crapware upon seeing relevant hardware IDs. That's why the problem affected older monitors too - it's the update side that suddenly started to ship malware.

A person from Poland here: why does the country matter here? What are the implications you're implying?

I wouldn't call it silly, because see the two as directly equivalent and fundamentally the same thing.

That's the thing - they are more human-like intelligence than search engines. I'm gonna push back on your push-back here strongly. I'm not saying they are intelligent - but they're much more like human-like intelligences than like any kind of classical software systems, which is why it makes more sense to talk and think about them in these terms than as software system.

To do the opposite invites confused thinking like considering "lethal trifecta" a solvable programming problem.

If you were vulnerable to prompt injection, I could order you to do absolutely anything you're capable of doing and you would be helpless to do otherwise.

Yes. Depending on specificity and timescales involved, we call that "reading comprehension" or "social engineering" or "peer pressure" or "motivating literature" or "advertising" or "propaganda" or "religion".

What makes you think the similarity is the superficial part, and not the difference in mechanism? I'd argue it's the latter.

The LLM that abruptly switches languages will also likely switch to a wildly unrelated topic. If a human behaved that way, you'd call a doctor.

Haven't met many kids, I see. Or even normie adults talking. I know plenty that tend to jump from topic to topic once they get into a stride talking, and they're not the ones diagnosed with ADHD.

Does this correct for mortgage? Because owning through a bank loan still amounts to a monthly subscription.