@glyph Did you quote post something?
Uncategorized
903
Posts
312
Posters
9.5k
Views
-
the folks trying to get open source developers to boycott github are barking up the wrong tree. just get an agent hired at microsoft who internally advocates to remove unnecessary duplication in the login systems. get a promo out of it, it totally makes business sense. require every current github user to use login dot live dot com. 50% marketshare reduction within the year, I guarantee you
Two things.
1) Who is there bullying developers to boycott it? WTF?!? That sounds a bit extreme considering the platform is getting more and more annoying to use all by itself by the day...
2) I'm surprised that Microsoft hasn't forced GitHub to use Azure AD for Authentication by now too...
-
@Shivaekul in our case, we probably *do* actually want the parent in question to have their own separate copy of minecraft, and so this is more of an abstract question, but I *do* imagine it will become practical soon, which is: *is* it possible to move a Minecraft purchase to a different Minecraft account? Based on the "xbox", "minecraft", and "microsoft family" information architecture I have to assume that if this is possible I'll find it on Outlook Dot Com somewhere
-
It is difficult to express how bad microsoft’s authentication system is. like it’s not just “bad” or “broken” or “buggy”, it is a world-historic interaction design catastrophe. no matter how bad you think it is, no, it’s worse than that actually.
@glyph guests tried to play XBox today. Neither I nor my adult child were able to get them in to play.
-
if this is how most people encounter passkeys it’s no wonder that they fucking hate them. it feels like getting tricked. because it is getting tricked. I was tricked
@glyph my experience of using passkeys is that if by fantastical chance every single element of the software stack I'm using is compatible, then I'll randomly get a pop-up asking if I want to log in with a passkey instead of having my password manager autofill the password. There's no time savings. And it still wants a six digit code afterwards.
Last week one of my accounts, which previously did the passkey prompt, started instead prompting my to "touch my Yubikey". I don't have a Yubikey. I've never used a Yubikey for any account. But there's no option to click to contradict the software's assumptions. (Also, most users would have absolutely no idea what a Yubikey is or why you would touch one.)
My experience of using passkeys is strictly worse than a normal password manager. Plus, it's easy to understand how a password works, whereas it seems like I'm not allowed to understand passkeys, or at least nobody is interested in trying to explain it to build user confidence that they're secure, you're just expected to believe in the magic. Engineers who have only ever used top-of-the-line Apple products and never shared devices with another person took a formidable problem (password reuse) and invented a treatment that is significantly worse than the disease.
-
if this is how most people encounter passkeys it’s no wonder that they fucking hate them. it feels like getting tricked. because it is getting tricked. I was tricked
@glyph encountering a passkey on an iPhone is a way better experience than encountering it on windows. Even still the UX is a giant mess across the ecosystem.
(Insert rant about discoverable keys)
I do hope we sort this out, but it feels like an uphill battle
-
@glyph encountering a passkey on an iPhone is a way better experience than encountering it on windows. Even still the UX is a giant mess across the ecosystem.
(Insert rant about discoverable keys)
I do hope we sort this out, but it feels like an uphill battle
@cthos this whole experience was on apple devices but there is only so much that can be mitigated
-
It is difficult to express how bad microsoft’s authentication system is. like it’s not just “bad” or “broken” or “buggy”, it is a world-historic interaction design catastrophe. no matter how bad you think it is, no, it’s worse than that actually.
@glyph this is why I try my best to avoid anything made by Microsoft. It's not just authentication system, EVERYTHING they do is like that
-
@cthos this whole experience was on apple devices but there is only so much that can be mitigated
@glyph *sigh* I am going to have to put up a rant one of these days about all the little annoying UX foot guns aren't I?
-
if this is how most people encounter passkeys it’s no wonder that they fucking hate them. it feels like getting tricked. because it is getting tricked. I was tricked
#pluralistic describes it as the "fat-fingered economy" portion of surveillance capitalism.
They deliberately redesign interfaces to increase the changes of clicking on the wrong thing.
Linking phones to identities to laptops to home appliances to home addresses to email to bank accounts & credit cards to passports & driver's licenses...
Connecting games accounts to social media accounts to college accounts...
-
@glyph my experience of using passkeys is that if by fantastical chance every single element of the software stack I'm using is compatible, then I'll randomly get a pop-up asking if I want to log in with a passkey instead of having my password manager autofill the password. There's no time savings. And it still wants a six digit code afterwards.
Last week one of my accounts, which previously did the passkey prompt, started instead prompting my to "touch my Yubikey". I don't have a Yubikey. I've never used a Yubikey for any account. But there's no option to click to contradict the software's assumptions. (Also, most users would have absolutely no idea what a Yubikey is or why you would touch one.)
My experience of using passkeys is strictly worse than a normal password manager. Plus, it's easy to understand how a password works, whereas it seems like I'm not allowed to understand passkeys, or at least nobody is interested in trying to explain it to build user confidence that they're secure, you're just expected to believe in the magic. Engineers who have only ever used top-of-the-line Apple products and never shared devices with another person took a formidable problem (password reuse) and invented a treatment that is significantly worse than the disease.
@aburka on some level I disagree, in that the infrastructure in the browser, the cloud services, the client devices etc is all tremendously valuable. (it’s not really designed for “time savings”, particularly not for people already using password managers, but for increased security for those who aren’t). I don’t want the baby thrown out with the bathwater here.
-
@aburka on some level I disagree, in that the infrastructure in the browser, the cloud services, the client devices etc is all tremendously valuable. (it’s not really designed for “time savings”, particularly not for people already using password managers, but for increased security for those who aren’t). I don’t want the baby thrown out with the bathwater here.
@aburka but I must concede that the overall, systemic effect, particularly once RPs are taken into account, is a roiling disaster. prompting for a username, a password, a passkey AND a TOTP (or even worse, email or SMS) code is confused to the point of incapacity. Complete cryptogibberish, probably less secure than what it’s replacing.
-
@aburka but I must concede that the overall, systemic effect, particularly once RPs are taken into account, is a roiling disaster. prompting for a username, a password, a passkey AND a TOTP (or even worse, email or SMS) code is confused to the point of incapacity. Complete cryptogibberish, probably less secure than what it’s replacing.
@aburka we need to replace passwords, and passkeys are a reasonable replacement for a lot of people, but the advocacy focus REALLY needs to shift from “hey users, cool feature alert, use passkeys everywhere!” to “hey website developers, standardize your fucking processes”. allow users to rehearse credential loss, set up successor accounts, ACTUALLY use passkeys as password replacements rather than bizarre MMMMFA security theater, and do it in legible ways common across all sites
-
@aburka we need to replace passwords, and passkeys are a reasonable replacement for a lot of people, but the advocacy focus REALLY needs to shift from “hey users, cool feature alert, use passkeys everywhere!” to “hey website developers, standardize your fucking processes”. allow users to rehearse credential loss, set up successor accounts, ACTUALLY use passkeys as password replacements rather than bizarre MMMMFA security theater, and do it in legible ways common across all sites
@aburka if you actually want someone to explain passkeys to you I can do it, but I can only explain what the tech actually does and how sites are SUPPOSED to use it, not what the confused former intern at amazon or microsoft who implemented it for them before being immediately fired was thinking when they did that
-
#pluralistic describes it as the "fat-fingered economy" portion of surveillance capitalism.
They deliberately redesign interfaces to increase the changes of clicking on the wrong thing.
Linking phones to identities to laptops to home appliances to home addresses to email to bank accounts & credit cards to passports & driver's licenses...
Connecting games accounts to social media accounts to college accounts...
@Npars01 hmm. I was about to object, because the economic incentives don’t quite line up the same way here, but maybe it IS the same incentive structure, just … slanted weird, and deployed vastly more incompetently
-
@glyph *sigh* I am going to have to put up a rant one of these days about all the little annoying UX foot guns aren't I?
@cthos that will be useful, but, ultimately, https://mastodon.social/@glyph/115677038638322402
-
@aburka we need to replace passwords, and passkeys are a reasonable replacement for a lot of people, but the advocacy focus REALLY needs to shift from “hey users, cool feature alert, use passkeys everywhere!” to “hey website developers, standardize your fucking processes”. allow users to rehearse credential loss, set up successor accounts, ACTUALLY use passkeys as password replacements rather than bizarre MMMMFA security theater, and do it in legible ways common across all sites
@glyph I don't really think they're a reasonable replacement for a lot of people though!
You have to solve the "I dropped my phone in the toilet" problem, and the only way to solve that is syncing the passkeys to cloud storage, that is, a password manager. So passkeys offer zero advantages over existing technology.
-
It is difficult to express how bad microsoft’s authentication system is. like it’s not just “bad” or “broken” or “buggy”, it is a world-historic interaction design catastrophe. no matter how bad you think it is, no, it’s worse than that actually.
@glyph i’m glad someone else is talking about this because the awfulness and unreliability of Microsoft’s login system—an inescapable part of the UI!—is insane.
-
@glyph I don't really think they're a reasonable replacement for a lot of people though!
You have to solve the "I dropped my phone in the toilet" problem, and the only way to solve that is syncing the passkeys to cloud storage, that is, a password manager. So passkeys offer zero advantages over existing technology.
@aburka okay, I guess I will explain then ;)
-
@aburka okay, I guess I will explain then ;)
@glyph I mean, you still have to onboard people to a password manager (one that supports passkeys). Otherwise you're setting them up to get locked out of their accounts the moment they change devices, which is actively malicious. And if you can get them to use a password manager, they can use fucking passwords to log in.
-
@aburka okay, I guess I will explain then ;)
@glyph I searched for "successor account" and got nothing, so please do
Gli ultimi otto messaggi ricevuti dalla Federazione
-
I stand in solidarity wity #MaryKostakidis
-
ILVA, una lotta durata 18 anni
https://www.peacelink.it/ecologia/a/51078.html
-
I stand in solidarity with #YanisVaroufakis
-
A golden rule:
When the #SecretServices say a politician is a threat to #NationalSecurity—as #Dearlove says of the British Green Party leader #ZackPolanski - it's time to think that the politician is acting in the best interests of his citizens:
-
They Helped Women Fight Online Abuse. They Were Barred From the U.S. – The New York Times https://blog.quintarelli.it/2026/02/they-helped-women-fight-online-abuse-they-were-barred-from-the-u-s-the-new-york-times/
-
This is utterly absurd and evil:
#HomeOffice will challenge the #HighCourt's ruling which established that #PalestineAction's ban is illegal
-
Ex Ilva, produzione solo fino al 26 agosto. Vertice al Ministero del Lavoro
https://www.rainews.it/tgr/liguria/video/2026/02/ex-ilva-produzione-solo-fino-al-26-agosto-vertice-al-ministero-del-lavoro-ecc590ab-a19d-41ac-8127-07ff3cd53909.html#amp_tf=Da%20%251%24s&aoh=17721993418930&csi=1&referrer=https%3A%2F%2Fwww.google.com&share=https%3A%2F%2Fwww.rainews.it%2Ftgr%2Fliguria%2Fvideo%2F2026%2F02%2Fex-ilva-produzione-solo-fino-al-26-agosto-vertice-al-ministero-del-lavoro-ecc590ab-a19d-41ac-8127-07ff3cd53909.htmlCome un ciclone. Tanto improvviso quanto impattante. Si abbatte anche su Genova la notizia del blocco disposto dal Tribunale di Milano sull'area a caldo dell'ex Ilva di Taranto. Il provvedimento, datato 25 febbraio, impone interventi urgenti per mitigare gli effetti delle lavorazioni per l'ambiente e la salute. Entro una scadenza precisa, il 26 agosto pena la sospensione dell'attività.
-
Recalling that tags.pub is one of the original ActivityPub implementations.
