epistasis

I create multiple passkeys for the account: an iCloud passkey and a Yubikey passkey.

Both passkeys are independent of each other and know nothing about each other, only the website knows that both are mapped to the same account.

It's like setting up multiple API keys for a service. Passwords are usually restricted to just one, but passkeys are (generally) allowed to have multiple backups.

When I go to login to Google, for example, it will prompt for a passkey. Currently, in Safari, it will prompt for biometrics on my iCloud passkey. I can either give it my fingerprint/face, or hit the "More options" button, which in the current list allows either 1) insertion of a USB security key, or 2) presenting a QR code that a phone device can scan, allowing use of the passkeys on the phone.

(All very good questions, BTW!)

If you're comfortable with OTP with backups, does a password manager like 1password, with backups, fit your needs? Or would you prefer to self-manage your backups on your own storage?

I ask because I'm curious about others' practices and desires here, not with any promise of a better solution!

Too late, you're using web standards, you're part of an ecosystem.

I agree with your anti-password take, 100%. But all my passkeys have biometrics attached to them, mostly so that I know that they are being used, when they are being used. Silent release of authentication credentials is a scary security mode. A YubiKey with a press mechanism is enough, I just happened to buy the biometric version. Or use the biometric lock on iCloud Keychain passkeys.

I do love the cloud version of passkeys, but I also have a backup YubiKey. I could do two backup YubiKeys, drop the cloud, and keep one YubiKey in a safe deposit box and one elsewhere, but I haven't had much reason to yet.

A passkey doesn't give up anything compared to a password, and is in fact much much easier to handle, IMHO. I have kept all of my private SSH keys in secure hardware for a decade, so perhaps I'm more used to carrying a physical key than others, but IMHO it's all better, all around.

We should eliminate passwords, and that has nothing to do with remote attestation, age verification, or anything like that.

For 20 years, I've only known two to three passwords at any time, and those are login passwords for separate boxes or corporate/home accounts. Beyond that, hardware access should solve everything, and I shouldn't have to type any passwords anywhere. Every account needs granular credentials, not shared credentials, but no user should have to memorize passwords beyond one per work domain.

I think the problem was that there wasn't a "Best Practices" way of using them when they were launched, which really prevented describing them in a consumer-friendly way.

And web site implementors couldn't follow that golden path, or describe the golden path, so there's fragmentation in usage and meanings and practices, making it far more confusing.

I love passkeys, I want to eliminate any and all password-based logins and switch entirely to passkeys. It's such a better experience, it's a "physical" key that can be backed up to multiple devices, and thinking of it like a key for a physical lock really gets at the core of its capabilities. But locks can be used in many many ways! Maybe you need to open the lock and still tell the guard a password, which is weird, but how most websites still operate.

Exactly, it is in fact very informative to look through their examples, because it shows a very robust system that's catching very very rare cases, and if there were more widespread fraud it would be very evident through the same mechanisms used to catch these very very rare cases:

https://electionfraud.heritage.org/

Every case I checked was something like this, here are two that I randomly clicked on from my state right now:

Alex Campbell, Republican city councilman and mayor pro tem of Crescent City, California, falsely claimed his residence was within city limits when submitting his candidacy for councilman. Campbell was charged with two felony counts of perjury and one count of false declaration of his candidacy and pleaded guilty to one count of making a false declaration of candidacy. He faces up to two years of probation and $20,000 in fines for his charge. https://electionfraud.heritage.org/case/200148

Nickey Huntley was involved in a scheme that offered cigarettes and money to homeless people on Skid Row in exchange for fake signatures on ballot initiatives and voter registration forms. This resulted in hundreds of fraudulent signatures. He pleaded no contest to one felony count of circulating an initiative or petition containing false, forged or fictitious names. Huntley was sentenced to 3 years’ probation. https://electionfraud.heritage.org/case/201251

In addition to the immediate gains of engagement, the ability to manipulate public opinion through campaigns like this are pretty explicitly the goal of some Silicon Valley oligarchs, especially the PayPal Mafia. They believe that they can control the monster that they have created in their own favor. Time will tell!

Each California county maintains a list of registered voters. Every voter gets sent a ballot in the mail, but is also allowed to vote in person. The consequences of this are that every single ballot and voter are tracked carefully.

Additionally, a person can vote anywhere in a county, so all in-person voting sites maintain connectivity to that somebody doesn't go to multiple voting sites and vote multiple times, in addition to tracking the mail-in ballots.

When voting in person, you provide your name, address, and sometimes age, etc. in order to disambiguate you as the particular person.

Mail-in vote counting happens with outside observers watching, with verified signatures.

So the system protects against each registered voter only voting once.

Registration of voters is usually tied to driver's licenses, when you file a change of address you can check a box to have your registration updated. If you're a new voter, you can provide or drivers license, or if not, the county will follow up with you to obtain other information to ensure that you're not registered by other means and are in fact a real person with that name and address.

anyone simply vote by claiming they are who they say they are?

Of course they can! That's only just and fair.

If you tried to steal somebody else's identity and vote as them, that would get flagged for multiple voting. Additionally, local political campaigns get lists of every registered voter, as well as which elections they voted in and party affiliation (if they chose one), which they use to campaign and knock on doors. Campaigns have sophisticated information systems to ensure that they don't bother the same voter multiple times, to indicate likelihood of voting and whether the canvasser thought the voter was going to vote for their candidate, etc. If there were a batch of fake voters somewhere, that would show up pretty quickly in these campaigning efforts.

Could be coincidence, could be a data leak from Meta that wasn't reported, could be outside groups using LLMs to match profiles of text to external sources that do have your name...

It's a wild world out there in political technology, and I probably can't even guess what's going on with half of it.

Way back in the early 2010s I went to a data science meetup, way before facial recognition and face processing was easy, and found out that Facebook was tracking the faces in every photo, building databases of locations, times, and people out of it all, even for people without accounts, etc. And that was just a side project! 15 years ago!

For motivated groups operating without the usual bounds of being part of the US government, the sky is the limit in what they can do. Buying data from Thompson Reuters is really mild compared to what I'm sure is going on inside of PACs within the US. When you add in the state groups operating outside the US on US social networks with the goal of spreading distrust and disunity, I have zero doubt that it's possible somebody is scraping the replies to political articles and trying to take control of accounts that show any interest in politics, to use those accounts for other purposes because they appear to be valid accounts instead of bots.

(We're not supposed to talk about downvotes, but boy have I seen my comments fluctuate up and down at the top, which is highly unusual. In most web open forums I take part in, anything connected to this brings in lots of "new" users, some or many of which end up being bots. I upvoted you, for the record.)

Having ICE buy data from a data broker to fabricate evidence for a well disproven conspiracy theory? This is still shocking, absolutely shocking!

I will retain my right to be shocked and angry about government overreach, thanks.

You are making up things, and then saying others are being disinformed?

California's elections are widely audited, observed, and secure.

Stop spreading lies.

What do you mean "there's no way to tell because of the margins in a few districts"?

Anybody looking with an inquisitive eye and no preference for the outcome reaches an extremely strong concision, that there was no voter fraud that could have influenced the outcome.

This is shocking and scary amount government over reach, to fabricate evidence of something that everyone knows is false...

We are really through the looking glass here, folks. Watch the confirmation hearings where potential appointees are asked to simply state factually who won the 2020 residential election. The amount of dissembling, avoidance, and inability to say that the emperor has no clothes..... it's just shocking.

This sort of rank corruption, of turning a government against its own people to subvert democracy... that more people aren't out in the streets about this makes me quite angry. We live in a state of continual shock of how bad things have gotten, I guess

It's funny because Anthropic is harming my use of their product, to not even stop the supposed theft of their thought chains. Something that any other supposed upstarts could presumably grab from Moonshot or whatever now.

And my complaint also extends to all their tool use explanations, or rather the lack thereof. I get prompted continually for tool use that I can't examine, that's a poorly formatted 1kb bash script, etc. The PM desire to hide valuable information while requiring extensive interaction has really driven the product into a very unusable place compared to where it was a few months ago. (Or perhaps that's just Claude responding to its memory of my use, and I have somehow driven it to be excessively verbose and difficult to use, which would be unfortunate... Perhaps there's a way to reset the memory.)

I have severe complaints about Anthropic's product managers on this front. Their preference for hiding, obscuring, and trying to wrest control from the user are a bit harrowing. It would be wonderful to go back to Claude Code from before March. It seems like every release destroys value for me!

The space data centers are intentional deception.

Having the wealth, of course, the glory of being the richest man to have walked earth.

Spending it is not the goal, having the wealth is.

Remember the ridiculous Tesla compensation package that he demanded? That's about having wealth, it's not about spending it.

What you describe is exactly a scam: he somehow convinced you that he's not motivated by wealth! That alone is clearly a scam, the idea that Musk is not motivated by huge amounts of wealth and high valuations is just implausible considering g his behavior at every single turn.

I'm unclear why you don't think it's a scam, because "he is a great financial engineer" seems awfully close to admitting that and then the "platform vehicle for everything else coming through the pipeline" seems to be the clincher that it is indeed a scam.

For example, he's talking about data centers in space as the "everything else coming through the pipeline" and space data centers are an obvious engineering boondoggle, but sound cool to people that don't know anything about data center design or the challenges of space engineering (ie heat rejection)

I agree, though honestly it starts with any of Musk's product presentation events, which, frankly are all absolutely terrible compared to what Jobs would put on.

Musk is good at getting money, he is not good at product design. Jobs had amazing taste, Musk has terrible taste. If Musk has a talent beyond raising money, it can be in making bold management moves, at least that's what I hear from CEOs that admire Musk. But I think in the past five years all the bold choices have not been so fantastic.

Cybertruck was when people started to see that the emperor had no clothes, i think.

In the meantime, until Musk comes up with the next big "idea" to switch to, all the current revenue levers need to be pushed to max to try to make it to that next stage, since public companies demand revenue every quarter.

A lot of their revenue is also from renting out GPUs to more productive AI companies, so depending on how long that game can keep on going (getting access to GPUs before other companies), it could last for a while too.

Gotta pay the massive coupons on SpaceX's bonds, whose yields are heading towards junk territory:

https://www.ft.com/content/3a023b95-66c3-41e1-b0ce-df752a499...

Having just flown some flights with Starlink internet connection, I really love the service, it's just amazing. But the rugpull here might actually break through the distortion field of Musk. It's really interesting to compare the reality distortion fields of Elon Musk and Steve Jobs. It took a looooooong time for Apple stock to get properly valued in the 2000s, after it was clear that they would take over consumer computing. Jobs' RDF worked amazingly well on aligning engineering towards consumer needs, and towards convincing consumers and (some) reviewers that they had created the right sort of products for the future. Elon Musk seems to have mastered RDF on investors plus consumers, and when you're chasing sky high valuations by always piling your prior failed "ideas" into your next big thing (i.e. next big gamble), it only takes a few bad gambles to bring down the entire house of cards.

You are being rude and condescending to a third party, when I think you meant to be rude and condescending to me.

You comment was ambiguous, using pronouns with multiple referents. I chose the referring that was the most charitable possible interpretation of your ambiguous comment. Your intended point is even more obviously wrong.

I prefer Pi to Claude Code these days, and use it most of the time when I can. The interaction and permissions harness is an order of magnitude better than Claude in my experience, just out of the box. I barely have time to read all the model output, much less fine tune some crazy agent harness tooling that changes underneath me daily and might or might not be documented.

Tariffs are in every way inferior to the prior administration's CHIPS act and IRA, which are in the process of being destroyed merely because they had bipartisan support.

I hear this frequently in the US business community, as an alternative to "spending".

You were asking if the US was actually preparing to invade Canada, were you not?

Did the US make any preparations for war before abducting Maduro from Venezuela or before getting into a war with Iran that cost them freedom of passage in the Strait of Hormuz?

Right up until Russia invaded Ukraine, Russia maintained that, no, that troop buildup wasn't meant as an invasion force, and a good chunk of the world believed Russia because it was a moronic idea to invade Ukraine. Trump is far more moronic and power drunk than Putin, and would perhaps not even organize troops befre invading Canada, all because somebody in the inner circle goaded Trump into it.