Yes, it’s the same as mitm. I get that it’s to avoid gendering the term but it doesn’t really roll off the tongue or preserve the existing abbreviation. I’ve heard the alternatives: machine in the middle, mallory in the middle or, my favourite, Malcolm in the middle.

My post was only meant to be a quick explanation of what passkeys are so I’ll leave it as is. I do think it’s healthy to be suspicious of big tech corporations and their motivations though so I’ll be doing some further reading.

The argument from the “it’s a trap” article is that the service you are registering to can use attestation to ensure that you are only using passkey managers that they approve.

I have to admit that I haven’t investigated this thoroughly myself but if the protocol can be abused in that way then your only choice really would be not to use the service. If it is related to banking or government services then you may not have much of a choice.

Yubikeys support device bound passkeys already.

It’s essentially just public key cryptography streamlined to reduce friction for the user. When you’re prompted to create a passkey for a service a new public/private keypair is created. The private key can then be synced to other devices for example via the iCloud keychain or Bitwarden. Obviously you have to then trust that provider to keep your keys safe. The upside is that your passkey can be automatically discovered and used to sign in without using a password. Alternatively the private key can be device bound but the downside is that if you lose the device you lose the private key too.

I hope this becomes the norm. Having tried to form a bargaining unit myself I can tell you it’s an uphill battle. Some workers are vehemently against it still and they will successfully encourage others to act against their own class interests.

A Google employee claimed in 2022 that they had sentient AI. He was sacked. What were his motivations? Do you believe he was right?

They aren’t a homogenous group. They don’t all believe this. The “AI will kill us all” narrative just sells really well.

When trying to organise colleagues you need to exercise a certain level of trust or it will never get off the ground. Unfortunately boot lickers will take advantage of that. It’s to be expected.

I think you’re jumping the gun a bit. They’re just saying that requiring a phone number added a barrier against spammers and they want to be sure this change doesn’t open the flood gates.

From the article:

"We gotta figure out some way to induce a cost for signing up without a phone number”, Kret said.

It’s unclear whether this means that registration without a phone number will become a paid feature.

However, “cost” does not necessarily mean a monetary fee; it could also refer to another barrier designed to prevent abuse.