This approach also assumes that you then compile the browser from source yourself (and also do that for each future update).

Yeah, and we know it's relatively common for open source projects to end up with malicious code in them unless the project has maintainers that can be trusted.

I have LibreWolf installed and I use it from time to time (although I prefer Brave), but I don't have that much trust in project as is. I think if it had sponsorship and could afford to pay a few reputable pro-privacy developers to maintain the project then there's less risk, but as it stands is anyone honestly looking through all the source code to validate their pro-privacy claims? And even if they did, could you trust them or their releases?

But you can also use passkeys from a computer, no separate mobile device needed!

And for services (like AWS) that don't (yet) support passkeys, a hardware token like a YubiKey is also an option.

“Passwords are fine” only in a theoretical world where everyone uses passwords “correctly” and securely. But in the real world people don’t, so passkeys are a much better and easier method.

I fail to understand how educating billions (?) of people about proper password hygiene is faster or simpler than moving all authentication to a “tap this button to magically log in” method.

> passkeys are a much better and easier method

Disagree. This isn't possible with passkeys:

- logging into a service with email and brain-stored password from any device

With passkeys, your phone becomes your password, so don't break it, lose it, let it die, forget it in the car, become too old, let your kids use it, etc

> “tap this button to magically log in” method

That only works if the device you tap it on is the same device with the key, while that's not always the way for many people (sync may or may not be set up or active)

you either can remember all your passwords and then you are fucked or you use a pass manager

passkeys will be stored in a pass manager and they can be recovered with device pin and master pass, I think they will be exportable too

so yes, you can log in with brain stored stuff

I guess you need a device to log in? then you log in to your pass manager and you can log in to anywhere

only this way you have to remember a passcode and a master pass, not 1000 passwords and you need your master pass 5x/10 years and your passcode every other day and you log in with your device and your biometrics

passkeys have issues but what you are saying is pure shit

> so passkeys are a much better and easier method.

I'm old. What's the difference between a pass word and a pass key ?

> tap this button to magically log in” method.

And how exactly is "this button" authenticated ?

Passkeys are basically enforced password managers with random passwords. There's some more complexity below the surface, but for the user, that's it.

good point

pass manager is needed and that is one of the key differences

it is good but also a challenge for some people, especially if the 3 bigs cannot sync because normal people without pass manager begin to use Apple, Google, Microsoft pass management... if they have all 3 devices, all of them...

what I do not understand, what the heck is the goal, one passkey per service and total sync or a domain (server) has to create and manage 4 passkeys for 4 operating system providers if user does not use a total syncing pass manager?

that is the problem since those who use pass managers are normally ok but those who dont, and wont register/trust/pay for one, begin to use A/G/M/L pass managers and 4 pass manager accounts must be secured?

and then you begin creating 4 passkeys for each website?

It's even better than that. They don't give any secret data to the service you are using.

I read this all the time, ist it true?

isnt public key a bad wording suggesting it should or can be public?

I would call it verification key and keep it secret on the server

only thing it need not to be hashed, it is already "hashed" meaning if it leaks it has 128 bit security or so

if I get it well, the private key can be guessed from the public key from huge alien resources so it is actualyl like an already computer intensive hashed 128 random password from a 2^128 domain?

I do not think the public key is to be posted on twitter or should not be guarded at all... it is just not the signing key and it is 128 bit strong away from it

It is 100% fine to have adversaries know your public key. Asymmetric key crypto is not the same as "already hashed private keys." You can happily use a 4096 bit RSA key if 112 bits of effective security isn't enough for you.

you dont quite get my point

i compare password hashing on server with passkeys where you store the public key on the server... we are told to hash computer intensive preparing for the worst that the server is breached and an attacker has the stored hashed (salted, peppered) password... then with brute force if you hashed computer intensive and the password was not weak, it can be i dont know 60,80,120 bit strong?

well you can actually get the password from the hash but if everything ok, infeasible... i guess it is the same with getting the private key from the public key, it is possible but with ecdsa256 i read 128 bit strong or so

i dont want more security i just find it interesting that nobody says the hashes are not a secret... ok it is more problematic since weak passwords remain much weaker hashed or not

i would still say if possible keep your verification key to yourself... and if it leaks, no problem

i would call them secret key (private) and verification key (public)

but i dont know much about this and i guess by digital signatures they are really public? but hey may be even stronger

There's more than one way to expose a password. You can have it phished, for example. Passkeys are immune to this.

You can use the terms you want. Other people will use normal terms.

fishing is another topic we did not talk about passwords vs. passkeys

we talked about whether a public key is actually a similar secret than a well managed (hashed) password

well it is not up to you to decide what terms are normal the language, concepts evolve

if you want to understan things better than you do know, sometimes you go 1-2 levels deeper and think for yourself

a public key has a security strength, lets say 128 bit a computer intensive hashed strong password can level this if you generate unique very strong passwords for each site with your pass manager and(!) they hash it well, it can be compared to giving a public key to the site

in this sense your argument which you just copy from other people is false

a good argument would be that a public key that we give the sites has 100% strong security and the password will not travel from the client to the server, whereas plenty of domain service provider implement security bad so you have to rely on them

in addition, computer intensive hashing on the server is more electricity and cpu|memory usage

please try to talk about the actual topic and dont try to derail the conversation like it was about whether passkeys are better or not... hiding behind something you declare normal is also bad practice...

just debate the only thing I said: actually, you do give a kind of well guarded secret to the server and it is not like a public key should be advertised

I do think it is a very intersting thought

and, of course, if a password comes from a weak domain, you can hash minutes, it will never be as strong as a public key

> I'm old. What's the difference between a pass word and a pass key ?

Password: You have to choose a good one using your brain or a password manager of your choice, and you have to remember it using your brain or a password manager of your choice.

Passkey: Your device generates it for you, whether or not it is sufficiently random, and long enough is not up to you. You don't even have to worry about it. Your device stores it for you. You don't have to remember it in your brain, you don't have a choice if you want to use a password manager or not. The passkey is stored in something which is functionally equivalent to a password manager.

> how exactly is "this button" authenticated ?

What are you asking? How is it authenticated between the server and the client? Or how is it authenticated that the person pressing the button is the right person on the client side?

The button is authenticated through the phone biometrics for example.

no button is authenticated

you start a process by pressing the button and authenticate via having the device and using your os account biometrics/passcode

then your pass manager signs a challenge with the passkey proving that you come from a trusted device (you are logged in to your pass manager) where you are the os account owner

Password is something you know and pass key(or a physical key) is something that you own.

> so passkeys are a much better and easier method

Thing is, most people don't understand passkeys. If you want to be secure, then you want to understand why and how you're secure; a pinky-promise that you're secure doesn't cut the mustard.

I do have some understanding of this kind of technology, having written for myself an OAuth server back in the day. I gave up on the server, because the services I wanted it for (bank, tax, medical) didn't accept OAuth, and because it was much too hard to understand.

Passkeys involves more third parties, and is even harder to understand.

There is this additional post:

“Someone who works at Meta reached out and advised me to rename the filters asap.” [1]

So maybe the issue is simply that Pixelfed is using identical filter names.

[1] https://mastodon.social/@dansup/109596825332511647

Never heard of Pixelfed, but it's sort of shady that, the moment they received notice that they shouldn't be copying a trillion-dollar company's product 1:1, they immediately cry that they need more donations.

Just rename the filters, and maybe make tweaks so they aren't exactly the same, and then suddenly Meta has no standing.

> Never heard of Pixelfed,

You may not have but that community is actually very active. I posted 5-6 photos on pixelfed and it had more engagement than my total Instagram engagement over 5-6 years.

I don't doubt it. I just wanted to specify that I've had no prior bias one way or another with regard to the service.

Your insta is probably shadowbanned (or whatever nonesensical synonym they’re using nowadays to describe shadowbanning style moderation).

Well. The fact that there is way less photographers on it may help.

This doesn't feel like a helpful response.

I understand that pixelfed is federated, but I still knew exactly what the commenter meant when they said they posted "on pixelfed". They meant they posted on an instance running the pixelfed software.

It seems like it was effective communication to me, and your correction seems both dismissive and unhelpful.

Yea. And you’re not “on the internet”. It’s a series of nodes that talk with each other and route requests between them. /s

There is no strict technical definition of “on” in this case.

how is an open source project asking for donations "shady" ? Is my money going to go to some nefarious ends?

This is Hacker News. OSS is supposed to be a good thing.

I just gave them $50, support creators, especially here where we are all benefiting as creators ourselves.

The shady part to me is Pixelfed vaguely mentions that Meta is "threatening legal action," and then they ask for money immediately after. This paints a David and Goliath tale, where Instagram sees a small startup taking away their users, and is trying to sue them into oblivion, and our donations will directly help. Instead, a later follow-up posts reveals "Well it's just due to the filter names."

I'm sure Pixelfed is a much better alternative to Instagram (I use neither), but the immediate segue from "Meta is threatening legal action" to "Please donate" implies that donations will be used to cover legal costs, when it sounds like the problem is pretty easily solved.

If you run an open-source project funded by donations, it is ok to ask for them every time you get any publicity. There is nothing shady about that.

Well, with a multi-billion dollar company knocking on the door, they know they may need absurd amounts of money for lawyers, so it makes sense to ask for donations should the situation escalate beyond what pro-bono lawyers can handle.

At the core, the problem is that the US doesn't have many protections for individuals and small businesses that need to fight against mega-corporations. It's simply infeasible to achieve anything outside of small-claims court. Europe is a bit better, but not by much.

If I were a small open source project with the prospect of a legal battle on the horizon, I’d want to start raising money for it before, not after, the litigation begins.

It appears that in this case, litigation is avoidable. The project would be purposely engaging in a legal battle at their communities dime over some names.

You’ve heard of them now :)

Good for them to call out bullying to spread awareness of their product.

I like how you call this bullying, when all they did was rip off another company's product interface 1:1 and then cried foul when they got called on it. Imagine it were reversed. If a large and well financed corp released a product that was an exact copy of a small company's product, you'd blame the bigCorp for stealing the work and using their industry position to annihilate the small company.

Then again, I guess nobody gets fired for bashing Meta. (In this one case, I'm actually on Meta's side. Might be a second time for me)

i mean there are thousand of small photo sharing apps, and instagram was hardly the first... Naming the filters the same seems a bit stupid though...

Yea. That’s the part that is ripped. Making a new photo sharing app shouldn’t be controversial.

I like Pixelfed, but it was naive to rip the filter names and think that was somehow ok. It was also a totally unnecessary thing to copy. An imitation filter could be called anything and people will be able to tell (assuming you did a good enough job imitating).

Bullying? Really?

Seems that they have done just that.

https://github.com/pixelfed/pixelfed/pull/4037

Or maybe it's a good thing that they are standing up to a 'trillion dollar company'. More people should be doing this.

I mean at least Meta chose incredibly original filter names, such as

Juno, the ancient Roman goddess, a word in use for over 2000 years.

Clarendon, the wikipedia page at https://en.wikipedia.org/wiki/Clarendon lists approximately 40+ different uses, from place names to typefaces.

Lark, well, do I have to add anything here?

Ludwig, uhmmm, Beethoven's estate is about to be sued?

Lo-fi: Yes I never heard of this word before in the context of photography. True originators.

Please stop the trademarking of common words and cultural heritage that belong to all of us.

A trademark isn't "you don't get to use this word because I own it now", it is "you don't get to use this word in this context as it is confusing". If you want to name your restaurant Ludwig, go ahead: you just can't name your filter Ludwig. With the exception of Lo-Fi, where maybe you could make a defense, these names are non-obvious and have never been in common use to describe a set of modifications to photographs. Just because Clarendon isn't a unique word does NOT have ANYTHING to do with whether or not you could trademark it for something.

You can't just say "durrrr... I've heard this word before!" you have to actually show that that word has been connected to that context and isn't some otherwise unique usage, and I simply don't see how you are going to claim that for these words: if you show those filters to people and ask them to describe them, the only reason they would say "Clarendon" is because of Instagram's prior usage carefully associating that word with that filter behavior: if you believe otherwise you have to show THAT, not that the word itself has been uttered by someone in the past.

Indeed. Microsoft Windows and those holes in your wall have coexisted for decades without any trouble. (Not so for Mike Rowe's software company, though: https://en.wikipedia.org/wiki/Microsoft_v._MikeRoweSoft)

Why is it confusing to use “Ludwig” as a filter? Nobody is going to get confused what site they are on based on the name of a filter. In fact, it’s less confusing than having to rename filters for each product.

I get that it's about context. But to me this is meaningless, why should any company be able to restrict the usage of common words in a business context?

As a sidenote, Lo-fi has definitely been used in the context of photography before Meta decided to use it as a filter.

If they both had a filter named Lo-Fi you’d have a point. Having all the same names makes this very obviously just plagiarism.

You can say the same for Apple. I think the trademark applies when a common word is used in a distinct business case. Here the word is used as a filter name, for instance. That application is unique.

This sounds so stupid. Imagine if the inventor of first button had sued others for copying shape and it's shadow

That would be as silly as a computer company getting a patent for a rectangle with rounded corners.

What are the names of the filters? I’m not familiar with either app and the commit “renaming” them only inserts the letter `i` in a UI template.

This person submitted a pull request to actually-rename them, which conveniently shows the full list: https://github.com/pixelfed/pixelfed/pull/4038/files

Thanks. From Supernault’s framing I’d expected generic terms like sepia, grayscale, invert, etc. but actually they’ve reproduced forty arbitrary, artsy words that sound like they could have come from a fashion brand name generator. Hard to see that as “being sued over css”.

That happen to exactly match Meta’s arbitrary list of artsy words. Clearly, they copied the names.

That's one of the funniest things I've seen this month, I had no idea this existed. Making it such a carbon copy yet with a federated backend is something that both feels like a huge feat and something like an amusingly naive oversight.

Honestly impressed as can be but can certainly see that they could have at least tried to differentiate it from its inspiration at least somewhat, like that's just poking bears in eyes with sticks.

I think the main problem is that SMS sender numbers can be easily spoofed (might depend on country, operator, …), so relying on “this message came from where it says it came from” is not really possible.

It might not be an issue for some types of usage, but sounds risky if used for account security/recovery/etc.

If you keep your number private it won’t matter. In fact you could spoof the number on purpose for an extra layer of security.

Phone number verification (of any kind) is supposed to make sure that the phone number provided belongs to the account owner.

If the number is not actually validated in a secure (enough) manner, there's no point in using phone numbers at all.

This is not specifically about Cloudflare’s “challenges“/etc, but —

The reality of operating a big site/service on the internet in 2022 is that it’s sometimes necessary to use methods that annoy a few people (with very non-standard browser settings) in order to protect the service as a whole from a million bots trying to attack it at any given time.

> operating a big site/service

This sounds like a very plausible argument. I've heard many of the arguments and don't dispute the threat model to something like Cloudflare.

And yet something about it still doesn't add up.

It turns power into a weakness.

How is it that much smaller sites - still able to serve something as simple as a plain-text blog to millions of users from a modest rack shack - operate perfectly well without any impediment?

Wouldn't an operation with all the power, might and money of Cloudflare be able to do a better job and still maintain the QoS (accessibility, interoperability etc) as Basement Bob with her Raspberry Pi?

Remember, all I want to do here is read a static web page of (I guess) less than 1000 words.

I'll take a punt: if "defending against millions of bots" is Cloudflare's business offering, then being able to serve a static site off a Raspberry Pi doesn't look good :)

Is your claim that Basement Bob’s raspberry pi could withstand the kind of attacks that companies like Cloudflare handle?

Eg - https://blog.cloudflare.com/26m-rps-ddos/

I think the parent comment's claim is that serving a CAPTCHA page to potential attackers may actually be more resource intensive than serving a lightweight page that has the actual content on it.

So, you posit, that Cloudflare has never thought of this before or weighed the pros/cons before building an entire business out of it? Sure.

Typically, the pages that Cloudflare protects are not especially lightweight or efficient.

No. It's that Basement Bob's Raspberry Pi doesn't need to.

I don’t think your line of reasoning was very coherent, and displayed a lack of understanding of reality.

In reality, a crypto wallet is better compared to a bank account, though. Most people don't carry their life savings (or comparable amounts) in cash.

> In reality, a crypto wallet is better compared to a bank account, though. Most people don't carry their life savings (or comparable amounts) in cash.

I would think it was the exact opposite.

A 'regular' bank account has reversibility, and so if there are some shenanigans you can (potentially) get your money back. With a cryptocurrency 'bank account' (wallet), if anything bad happens you're SOL.

In Estonia, you can link a phone number to your IBAN. When making payments, the sender just needs a phone number, and the corresponding IBAN is automatically looked up. (The lookup service is managed by the central bank, and used by all (major) banks.)

Same in Poland, thanks to BLIK payments. Works across all major banks. https://iko.pkobp.pl/iko_en/features/mobile-transfer/

There's a similar system in several country (Spain as well for example, called Bizum). It's a shame that it's not a Europe-wide system.

We have that here for Zelle, which is built-in to some banking apps, making it really easy for most people to achieve this. You can alternatively give them a name or email as well. Zelle is not perfect but I have used it often just because it is built-in to my banking. I just wish I could have multiple bank accounts hooked up to it properly, not sure how to sort that out.

The same exists in Spain (albeit with limits per month), it's called Bizum: https://bizum.es/en/about-us/

I don't think I've seen this, do you have a link to learn more?

It's apparently called “proxy payment”: https://www.lhv.ee/en/proxypayment

But surely it’s possible to use methods other than what currently seems to be the first and only solution: “your account has been banned, bye”.

For example, if an automated system thinks an account is sending spam, enforcing a (very low) outgoing email rate limit would be a much more reasonable first step.

I’m curious: why would you consider Slack to be “simple”?

I see Slack as an incredibly full-featured app. As always, many people might not use all the features, but that doesn't mean that nobody does…

I'm comparing it to applications that may have somewhat more reasons for slow startup times, like mentioned below in the thread (think: Photoshop, Maya, Unreal Engine, etc). Not a chat application.

I'm not saying Slack is not full-featured, but it's definitely not on the same scale as some of these other applications.

No, they're certainly not just chat applications, but if you think that Photoshop is an image editor that is somehow at the same level of complexity as Slack I'm not sure what to tell you. We'll have to agree to disagree!

Because very very little happens in the client itself. Basically any button that does something is just an api call out to their servers and an update to the view. You can see this yourself when you're working on a higher-latency network connection -- damn near every click gets you a spinner or a pause of some sort before things happen.