You can't really do this with images either. The least AI-looking images in the post are ones that have the least amount of content, the fewest things to mess up. Once you introduce more detail, it starts converging on the same flaws you usually see, just covered up by a thin veneer of a different artstyle.
Have you spoken to a young person recently? Like at all? Say what you want about thinking that an AI-gen poster actually signals high competency to you, but acting like there's not a huge swath of people that hates AI and trying to dismiss them out-of-hand as an extremely online fringe just seems irrational. No, there are a lot.
Bikeshedding at an event is something like arguing about where to put the snack table. Raising awareness in the community about the event is vital, because this is what decides who will come. If you spend your time solving other problems and then few people come because they were put off by posters that to them signal "This is something we don't really care about", then it did matter after all.
The difference between them, as pointed out elsewhere in the comment thread, is authenticity. A basic, unassuming poster made by an amateur conveys a simple, grassroots event with no frills. A professional poster made a by a graphic designer signals effort and attention to detail. The average AI-generated poster says that the organizers don't have time or money, but really want to seem like they do. It's like how people tend to perceive someone who wears or owns an obvious knockoff of an expensive status item - it's seen as worse than having the real deal and worse than having nothing at all, because that person is trying to create an appearance of something that's not true.
Poor victim Russia. They were forced to start the war, really. Had they not embarked on their campaign of conquest and genocide, NATO would surely have invaded on the 25th of February and killed them all. Luckily, Russia showing their might by stalemating a war against a neighbor a third of their population has deterred evil NATO from directly invading, like what they were surely planning to do. It's evidenced by the absolutely nothing that NATO did towards Russia in the preceding decades, but if you stomp your foot enough about your neighbors freely joining an alliance explicitly designed to safeguard against Russian bloodthirstiness, then you can almost make yourself look like the victim. Almost. At least the Russians buy it, they've been printing the same shit in their media for over a decade now and they can't get enough of it.
Russia has been criminally naive in its dealings with the West. Had they been more firm and realistic they would have never allowed the wall to fall and Warsaw pact to disband.
They have no choice now but to reassert themselves.
I hope we all survive or if it comes to it let the death be quick.
Note that Warsaw pact fell not because russia allowed it to, but because russia was too weak to do anything about it. You just lost the cold war and became 2nd or 3rd grade country. You should wake up and let go of your imperialistic ambitions. You no longer matter that much, all you can do is try to destabilise other countries, but that's not enough to matter. An annoying fly is not superpower.
What if you just can't have internet on your phone? Like if the computer is connected via Ethernet and there's no wifi network you can connect to? What if you're abroad and have no roaming? And the ultimate question about a person that the modern world can barely conceptualize - what if you have a dumbphone? Or what if your smartphone is lost or stolen or dead and you need to access some account? That last one has happened to me, and I sure am glad I know the key passwords that I need for survival.
These may seem like nitpicks, but there's probably a thousand rare scenarios like these that exist. You inevitably have to consider them when you're moving from punching in letters and numbers that you remember in the normal, low-tech way to a complex networked two-device workflow.
If my phone is lost or damaged, I would buy a new, cheap Android phone and sync my passkeys to it. But I am curious why one would need to login to a website in order to survive? If one did have say a severe medical condition that somehow required a website in order to manage, I guess I would concede that maybe passkeys aren't the best way to secure such a life-sustaining website.
> But I am curious why one would need to login to a website in order to survive?
They use bank like Ally or Discover with no physical branches.
They use a mortgage provider like Rocket mortgage with no physical branches.
They use a medication delivery service with no physical customer facing pharmacies.
They have an employer that only facilitates reimbursement for expenses via online tools.
etc...
I guess "survive" has a sliding scale, but if I lost access to critical accounts... my life is going to FUCKING SUCK in a non-trivial and very impactful way almost immediately, on many fronts.
And if your answer to that problem is "well, just call them"... then we're right back to the point the article is making: "An account’s security is still dictated by the weakest recovery method"
Passkeys aren't a meaningful improvement in security - assuming you do actually have decent password hygiene like a password manager.
If your phone is lost, how are you going to sync your passkeys to your new cheap android? In a passkey-only future, you cannot login to your Gmail account without your passkey, which is only on your phone, which you've now just lost.
What am I missing? Either we retain passwords as backup for a lost or stolen device - in which case, all the security concerns are still there - or we only use passkeys, in which case we've added a clear nonrecoverable point of failure in the system.
What confuses me is that for a long while we told people to not write their passwords on a sticky note, to not write them in plain text somewhere.
Then we introduce all these "security" mechanisms that make it literally impossible to recover an account without backup codes.
Where do you store the backup codes? The average person, if they store it at all, will store it on a plain text file or in a sticky note.
Except that this creates a much more brittle system. Systems are safe when they are routinely tested/used. If you routinely have to enter your password, you are aware you need it. If you don't need your password, and you never have to enter your backup codes, you won't feel the importance of them until you actually need them.
It's the whole "I have backups" vs. "the backups actually work" problem except it's pushed onto the users who have zero technical knowledge.
FWIW my break-the-glass actual use of backup codes is for access to my password manager.
Everything else which has ever given me a backup code... gets stored in a secure note in my password manager.
It is just another knowledge-based factor. It is one that they are reasonably sure you aren't spreading around the internet. It is one that the site gets to pick rather than the user. But in reality, they are a often just a way to try to reduce some support and identity verification costs.
The path to get to the password manager is the case where the backup codes truly matter, because without them there may not be a way for support to restore access. Those codes may be your only way of regaining the master encryption key.
But that also winds up being part of the trade-off of security vs user friendliness. Some password managers are way easier to get back into.
Doesn't being able to sync your passkeys by entering your conventional password somewhere eliminate the whole point of passkeys? It just shifts the point where you can enter the password to recover your data to a less convenient place. And if your entire stack is passkey-protected (which I'm pretty sure is the case most of the time) then the secondary phone won't do anything for you.
When I said "survival", I meant it in the "being able to make do with few resources in a time of crisis" way, not that you will literally die if you can't access an account. Losing a crucial device without a fallback of being able to log in somewhere else quickly can mean immediately losing access to payments (the most crippling, especially if you're not home), being stranded in an airport or even not having an identity document (in countries with digital ID systems). Any of these happening can lead to enormous losses in time, money or worse, depending on when and where this event hits you.
I think there exists a vein of contempt for anyone not fully embracing our bold new world, so many implementers etc. get the double bonus of alienating and frustrating all of the non conformers
What? Did you read the thread? I never said passkeys can only exist on phones. The whole conversation is about "how do I log on with passkeys if something happens to my trusted device?". The parent comments talked about just using your phone, I'm saying there's lots of situations where someone might not have access to either a phone or an internet connection for it. And when this happens, you really don't want to be left without a way to access all vital digital services.
> I'm saying there's lots of situations where someone might not have access to either a phone or an internet connection for it. And when this happens, you really don't want to be left without a way to access all vital digital services.
And when that happens I'm usually glad my credential is a passkey on my keyring, as chances are if I don't have my phone and I haven't auth'd on to some computer I almost certainly don't have access to my password vault. But hey, my passkey works just fine without my phone. And I can trust that once I unplug my authenticator and log out of that session, there's no long lasting credentials left behind. I don't get that with passwords.
Wouldn't I have the same problem with passwords? I would lose my phone and be unable to two factor log in to my Gmail account or bank from someone else's device?
With 2FA? Yes. 2FA is almost just as stupid and almost just as bad for regular users as passkeys are, but it got adopted due to historical loophole - by far the most popular form was TOTP delivered via SMS, then "authenticator" apps, both of which keep the code transferable - you can receive it on one device, transfer to yourself or someone else (which is a feature, not a bug) via any channel, and get it to work. Passkeys were created specifically to close that loophole.
Plus, SMS didn't allow for vendor lock-in, which is arguably why they're so hated in security circles (SIM-jacking is real, but doesn't scale anywhere near enough to warrant deprecating it as mechanism for regular users).
I have over 2,000 accounts. The majority of them have unique passwords. I can count the services that have passwords that I know on one hand, with quite a few spare fingers.
Passwords just don't provide a broad recoverability benefit once you commit to doing strong, unique passwords.
> Passkeys were created specifically to close that loophole.
Credential sharing? I have a family share with passwords and passkeys in it. Passkeys most certainly didn't stop this.
They did add friction to having a user being duped to share their password to someone claiming to be tech support, since you can no longer request plaintext secrets be sent over arbitrary channels.
> Plus, SMS didn't allow for vendor lock-in, which is arguably why they're so hated in security circles (SIM-jacking is real, but doesn't scale anywhere near enough to warrant deprecating it as mechanism for regular users).
SMS is an ugly user experience and more importantly is expensive. Now a lot of services do emailed codes when they don't have a regulatory reason to require SMS - an even worse user experience, but less expensive.
We have authenticator apps which use a standard OATH setup, and quite a few platforms which have integrated support to try to sand over the worst part of the UX. Unfortunately they just didn't become popular, and OATH fails the same regulatory requirements that emailed codes fail.
Passkeys are not meant to have a vendor lock-in story. Credential exchange allows for credentials stored in consumer credential managers to be imported into another credential managers. The platforms have added infrastructure specifically to make this easier for users.
The exceptions are when enterprises run their own passkey stores, or when the user explicitly picks a solution that doesn't allow export (like a physical Yubikey).
No, it's fine. Most common example, I log in to my bank, they send an SMS, I copy the code and paste it into the web site. Works fine and I don't have to pick up my stupid phone, like I would if I used an authenticator app instead.
"and more importantly is expensive."
Not for me. The bank made several billion dollars last quarter, don't think it's a big problem for them, either.
But the problem is that you can't really backup passkeys and because people are frankly frequent tricked into using them, they have no good recovery options.
I know plenty of people who only have a phone, no other devices. They don't backup that phone, they should but they don't. They don't use a password manager either, maybe they should, but they don't.
My issue with passkeys are that they are designed for a reality that don't exist, or at least only exists for people who are already doing a lot to secure their devices.
They are designed for a wealthy technologically inclined user with a very stable lifestyle and trusted resources and connections to other people. You know, the exact people who developed them.
> But the problem is that you can't really backup passkeys
The individual passkey? Maybe not. But I don't really need to backup the passkey, I can just have backup passkeys or other backup authenticators, including complicated stored one-time passwords.
To answer your earlier hypothetical, I'm out traveling and I'm mugged. Well, hopefully, I'm not mugged in the part of the travels where I'm carrying truly everything at the moment, and I can just go back to the hotel room and re-auth with a device I saved there Problem solved, no big deal. If I lost truly everything while I'm out, I'd do as suggested elsewhere here and call home to get a trusted friend/family member to read me off the one time password saved at home or whatever, or figure out some way to get me money to get home. Chances are I'll end up having to work with the embassy anyway.
> My issue with passkeys are that they are designed for a reality that don't exist
The reality of passwords being hijacked is absolutely a reality of today and is a constant issue for tons of people.
> I know plenty of people who only have a phone, no other devices.
And I really don't get why we can't also teach these people to also have a little token they use that can also be a part of their online identity. And sure, for certain kinds of accounts have appropriate levels of recoverability, but for the normal authentication workflows its so much better in so many ways.
>They are designed for a wealthy technologically inclined user with a very stable lifestyle and trusted resources and connections to other people. You know, the exact people who developed them.
And here you go posting
> I'd do as suggested elsewhere here and call home to get a trusted friend/family member to read me off the one time password saved at home or whateve
If you read what I posted you see why you live at a particular place of privileged and are seemingly incapable of putting yourself in another persons position where these things do not hold true.
"If you are a white male earning over 100,000 a year in a stable relationship with living family members, excess savings in the bank, in a stable first world country everything is going to be fine and the rest of you can get fucked" --what you keep repeating in different ways.
I mean I was pointing out that you were being racist and sexist from a position of privilege without realizing you were doing so. A kind of systematic failure caused by not realizing our choices as developers has real world impacts on the less privileged.
You're being racist and sexist by assuming wealthy westerners or those in stable relationships or those being able to call home to family are white males. If that's not racist I don't know what is. I don't think it takes being a white male to be able to call home to family when traveling internationally. You're assuming a point of view is invalid due to someone's race and gender.
Quit being racist and projecting identities on people.
This is about people who would have a hard time recovering digital identities. I imagine there were lots of white males fleeing war in Europe who probably struggled to get access to accounts backed with things like passkeys and other forms of 2FA. But I guess to you their struggles don't matter.
Its almost like you including gender and race was just your own projections of your own hatred for a particular group. You should probably think about things when painting people with such a wide brush of "white males" when trying to paint people in a derogatory fashion.
I spent a chunk of my life homeless. Don't project some identity on me that's not valid, or that I just totally lack some perspective due to your assumption of my race or gender. Its not a fair thing to do, its literally racist and sexist.
You could have tried to make your point without throwing in racist and sexist comments by just saying "wealthy western software developers" or whatever.
Do you have a plan for getting home without access to any of your accounts? And one of the problems with passkeys is that it's unreasonably difficult to keep a backup key.
You're asking way too much foresight in this thread I guess. There are some people who have lived lives without any series of unfortunate events, they can't even imagine what the world can serve up.
If nearby (some country) any credit card or even my ID card will get me home. I can walk into a branch of my bank and - with some waiting and paper work - I should be able to get enough cash to get myself home.
Abroad I’d head to the nearest consulate of my home country. Might be difficult to get to if it’s in a far away city. Hard to prepare for abstractly.
Great, now I just need to get back home to use my uncompromised accounts (which would have still been protected by my device as long as the thieves aren't NSO Group, but whatever). Gee, it seems my tickets back home were taken with my stolen phone! Not to worry, they sent me an email confirmation, so all I need to do is log into my passkey-protected email on my friend's phone and have them download my ticket in addition to theirs, or print them at a public computer. Oh wait
As long as you still have your passport, which you’d need for international travel anyway, you can get your boarding pass at the airport without any hassle.
Nature has existed at a relative equilibrium for billions of years. It changed, but there was never a single thing that could take over the entire system.
It took humans a few hundred years under the current system to start a mass extinction event and begin dismantling the ecosystem we rely on. And we are ready to go 10x further if it means someone somewhere else makes a few more dollars.
Cancer is the most apt comparison, actually. At a system level we don't care for survival or long-term viability, only immediate replication and exploitation.
That is - a anthropomorphization of nature- assuming what is nice and "stable" to me, is not actually furiously attacking one another.
Nature had buildup of warfare materials (the plastic that was trees before fungi digested it).
Nature had campaigns ebb and flow, due to iceages and warmspells, had island holdouts being wiped-out by systems adapted to furious combat on continents (invasive species).
Your picture of nature is very much distorted by a rejection of a rather cthullian reality.
What you mistake for peace is a coldwar equilibrium, where all sites furiously roll the dice of research for new war-tech- and then humans came along. Humans are very much a natural system doing natural things, very successful though.
Cancer is natural, "natural" does not mean good. This focus on things being "natural" is very strange when we're discussing artificial constructs like the economy or technology.
Technology and capitalism are not natural phenomena, they are political ones.
You are conveniently ignoring the comparison to cancer. Capitalism and cancer both demand growth at the cost of everything else. This is what leads to them destroying the systems they inhabit.
The parent has to do with permission, not stealing. Imagine if your neighbors could have an exclusive license to buy the new obviously superior tractor which you will never be able to obtain no matter what you do, simply because you're not them. This is legal today, the argument is that it shouldn't be because it punishes competition and lets the rights-holder wield too much power over the market.
It does make sense. Customers have always judged businesses on factors besides their direct output. If the coffee shop's customer base has a significant amount of artists and artists do not like AI aesthetic or are upset by seeing AI output getting into places they once frequented, they have every right to stop patronizing the business and tell their friends, even if the coffee is the same.
Honestly this entire "businesses can't be criticized" theme of this comment section is ridiculous. So what, if a small business started draping themselves in Russian flags and painting Zs on their windows, would I also be panned as an insane culture warrior on HN because I'm "forcing my opinions on them" by refusing to be a customer of that business, even if I went there before the change?
This is ludicrous, I'm sorry. People are treating this minor social scuffle like they're going to burn the business down. No, they're not saying 'work with us or die' unless you read it in the most hostile way possible to be terrified of something mundane. To them, the AI is the problem, if the owner took it down and replaced it with a Microsoft Word printout, they would be satisfied. Trying to recommend an artist they know may come off as an advertisement or as trying to get ahead of the owner claiming there's no one who can do this kind of work, depending on how charitable you want to be. But no matter how you read it, this isn't a mob boss forcing you into a protection racket. It's just some guy who probably wanted to name and shame on a Facebook group but decided to hold off for one day.
reply