Are you sure about that?

When I open up the import function in KeePassXC I can pick 1Password(.opvaul), Bitwarden(.json), Proton Pass(.json) and a couple of other file formats.

PS: Oh, wait. That only works for the passwords while passkeys simply get ignored? Okay, that’s dumb.

Because of this discussion (and because I hadn’t looked at passkeys for quite a while), I did some testing…

And passkeys integrate seamlessly into my keepassXC to get backed up with all my regular passwords. So software- instead of device-based passkeys that can be properly transfered, synced or backed up work…

The problem is that tech-minded people that use password managers and think about security and backups are not the primary target group that passkeys should protect from every-day phishing attempts in the first place. And when it’s supposed to protect the common user effectively and conveniently/frictionless but then instantly destroys the effect by advising to set up another login method it makes no sense.

Yes I can backup a software one. But that’s not the point. Passkeys are advertised as the future for common people as they eliminate the biggest issues: phishing.

But then they don’t advise people to use software passkeys, back them up and keep them save. Instead they tell them to configure an alternative/recovery login alongside the passkey should it be lost or damaged.

They take a security feature, instantly remove the additional security and make it into a “you don’t need to remember and type your password”-convenience thing. Yeah, great. A password manager could’ve already provided that convenience.

So in the end those more technically-minded that will look at this and decide to use a software passkey so they can back it up will get some additional security they need much less (they are not the primary target group for phishing), and some convenience they already had (because they are already using a password manager).

Passkeys aren’t controversial because they are bad. They aren’t. They are controversial because the actual way they are used makes zero sense for the purpose of added security. Which raises the question what the actual goal is.

Passkeys are a good idea to prevent phishing. Using passkeys but then require a second method to login as a backup to prevent lockout when you lose your key (as many sites do) is epic bullshit. It makes an actual security improvement into some convenience feature so people don’t need to remember/type passwords anymore. Because the phishing will now ask for the alternative/recovery login to fix some alleged problem with your account/passkey…

So it suddenly does not provide additional security anymore above what a password manager would already do.

When you sell somehting as a security feature then instantly defeat the additional security to make it just about convenience the question about the actual goal feels natural…

It’s mainly controversial because the actual use contradicts its purpose. Passkeys are phishing-resistent, which is still the main risk for password in real world scenarios, and are a good idea.

But the websites supporting it put out big warnings when you don’t have another method to login configured. And they don’t actually advise you how to backup your passkey and keep it safe, but instead want you to set up an alternative way to login or recover your account. Which totally defeats the purpose in the first place.

Quite the contrary: “there is a problem with your passkey/account, please use the recovery method you set up” even makes for more convincing phishing. So why are they pushing for passkeys when it isn’t for security reasons?

A passkey is cryptographically signed by the server when it’s created.

So it does not only has your credentials encrypted which are then used to login to a server, but it also carries information about the server and only that server can request the credentials from the passkey. So unlike a password a passkey is resistent to phishing attempts as you can’t actually give your credentials away to anyone but the actual server it was created for.

Passkeys fix a different problem.

In my eyes the problem is that passkeys do not fix a problem. They just shift it to another layer…

I can backup a password however I like. I can backup a TOTP authenticator (or specifically the secret that works with every one of them) however I like.
I can not however backup a hardware device with my passkey.

And the websites supporting passkeys obviously know it and explicitly warn when you don’t have an alternative way of logging in configured as it’s possible that simple hardware damage or loss locks you out of your account. Thus the “fix for a problem” is now relegated to a shiny new way of conveniently pressing the button on a key instead of typing and remembering passwords, while the actual attack surface is still there but now sitting in alternative login/account recovery instead.

I want a key I can backup, even emulate if I want too

This actually seems possible… https://codeberg.org/r4gus/PassKeeZ

Also keepassXC works with passkeys for quite some time.

But then again these companies have internal models which are atleast couple generations ahead of what is publicly available

But do they actually? The release cycle and also how often there were obvious flaws in the releases suggest that they are all fighting aggressively for market shares and release every new perceived improvement as it comes to try to stay on top.

AI is a hideous abomination tainting everything with its existence or our lord and savior that will soon™ solve all of humanity’s problems. There is no middle-ground anymore.

And the notion that a tool can be useful for one thing if properly handled, not so useful if used carelessly, and absolutely stupid when used for a purpose it cannot actually fullfil is somehow (magic? collective brain-dead?) deemed crazy now.

PS: The only thing more insane than the discussion itself are the arguments about AI-use being unethical as it is trained on stolen data usually made by the very same copyleft guys that claim that no copyright should exist, all data should be free, and copying something is no theft!

That’s what the documentation says. I don’t know if/when that changed as I barely use docker.

Well… it’s the default iirc (192.168.65.0/24). So that’s what docker uses if there is no explicit configuration you could find.

the 192.168.65.1 address that manifested out of nowhere

Or it’s indeed the internal virtual lan your docker config uses…

Is that an actual problem or are you really just trying to fix the logs? That should be doable via headers so the real origin is preserved independent of proxying.

And as with every other of these browser lists some flavor of the month new firefox-based one wins. One that might or might not still exist in that form in another year (here it’s one that only exists as firefox release-based for a year - before that is was a fork from some old firefox version or even based on chrome at some point). 🥱

What a pile of bullshit.

Those “autonomous” AI agents are mostly a publicity gag anyway. And even if they were real…

I’m responsible when my dog gets away and eats someone’s face.
I’m responsible if my car kills somebody, whether I’m actively driving or have accidently lost control.
I’m even responsible when I just (carelessly or willingly) provide the means for someone else to break the law.

Even discussing if AI “autonomy” (if you believe in that fairy tale and don’t consider it a scam to avoid liability) matters is ridiculous. Are they now trying to tell us that they are not the ones running those AI agents on their hardware, not the ones giving instructions, and that they were completely oblivious to 100% independent actions of AI agents? Then ffs close their companies and take away those tools they are too stupid to use or control in any way as a menace to society.

We would all like to know how to do that.

Step 1: Get born with connections to deeply corrupt vile rich scumbags

There is no step 2, although an additional qualifier: Don’t have moral problems with being a deeply corrupt vile scumbag

Congratulations… you are now included in all their (often even legal, because paying off politicians helps…) scams…or as they call them: “business opportunities”

decent, smart, nazi…

You can ever only pick two.

If you use the shortlived profile and your key is compromised, you benefit from the short lifetime.

Maybe I’m just too stupid to understand how those certificates work.

But in what scenario is my key compromised but not my server? Because someone getting control of my server can just get an new long-term certificate. That was my actual point in the comment above. I understand the argument of added security if they only issue short-term certificates. But where is the benefit of my short-term certificate when someone compromising my server can just get a new long-term one in seconds?

Also we are talking about self hosting. I understand the issue of revoking certificates when you have a massive userbase where some might miss the revocation for quite some time. Not so much with the dozen max family and friends.

As of the manpages systemd-sleep looks for:

The main configuration file is loaded from one of the listed directories in order of priority, only the first file found is used: /etc/systemd/, /run/systemd/, /usr/local/lib/systemd/, /usr/lib/systemd/.

Also

The default configuration is set during compilation, so configuration is only needed when it is necessary to deviate from those defaults.

So yes, you can use any existing file from another computer as your template (root:root 644 would be the default owner/permissions for it).

PS: I tried on my PC and setting AllowHibernation=no in the config file produced a different “hibernate is disabled by config” error. Only if I remove the resume=<swap location> kernel parameter do I get the “not set up” error you mentioned but I’m not at home and only have my old (encrypted and able to hibernate) bios laptop with me. So I can’t check this for modern UEFI where systemd-sleep should automatically pick a suitable swap space and save the location in an EFI variable without any additional configuration.

You can however set the resume=UUID=<your swap's UUID> kernel parameter anyway. Even the automatic systemd/uefi setup accepts this as a way to manually select a location. So maybe you try that. If your problem is decryption of the swap at startup you should not get an error when initiating the hibernation as you do now but instead get problems when you try to restart from swap.

Washer/dryer getting their signal to start from an outside source according to electricity price (with a dynamic plan) or weather (with your own solar) actually makes sense. I really don’t care when it does my laundry as long as it’s done between me leaving the house in the morning and coming back in the evening.

The main point is that even smart appliances barely ever need their own connection to the internet. Getting (meaningful) communication from inside your home network (including from the one device that acts as your access point from the outside that has a connection) is absolutely enough.