Doesn’t this mean that a compromised device with passkeys on it is worse than a compromised password since the passkeys can’t be rotated? I feel like the answer is obvious so there must be another angle I’m missing
Passkeys can be rotated, of course. The question was whether they should be rotated on a regular basis.
What kind of compromise are we talking about? Was the device stolen? Then yeah, you need to rotate passkeys (and all your passwords, and remotely cancel all your live sessions, none of which is new).
Was the device hacked from afar and the data read off of it? The passkey is probably fine. You can rotate it if you want to, it's not a bad idea, I probably would to be certain, but you're not pwnd even if a bad guy got a shell for a while, heck even if they got a root shell.
I understood the question to be "should passkeys be rotated regularly" to which the answer is probably no because there's not really a compromise mechanism that periodic rotation defends against as far as I know.
Rotation defends against secrets that leak through normal use and without your knowledge, like a password entered into a phishing page or snooped over your shoulder or cracked from a breached hash. Passkeys aren't vulnerable to those things because they never travel over a network, are never seen by the server, are never seen by their own users.
You change the locks on your house when a key goes missing, or is known to be in the hands of somebody you don't want getting in, it's not something you do every three months just in case. Same with passkeys.
Isn’t autotune something that you give an input and params and get the same output every time? I don’t think it’s generative in the sense that people mean when they say generative AI.
If I’m right, is that different from a paint splatter brush in Photoshop? It “literally generates” a splatter without you having to place every drop.
Generative AI like LLMs and image diffusion models are perfectly capable of being deterministic. I have seen it repeated a lot that they aren't and that simply isn't true.
edit: to answer the second part, photoshop brushes are absolutely generative but I'm not sure they are AI.
It’s totally possible, but would seriously need to not use much parallelism, and definitely not going to use the GPU much. So it would be really slow, but possible.
I don’t understand either. Usually someone responds with something like “the local <whatever> only posts updates on <app> so what choice do I have” or something to do with peer pressure or FOMO.
I don’t doubt that people deal with those problems but they seem like better ones to have. But it seems like a lot of people just cannot imagine living without the apps anymore.
BSD == Birch and Swinnerton-Dyer I think? I am also uninitiated. I enjoy learning about the millennium prize problems but BSD is one I don’t have a very good understanding of.
BSD is hard to appreciate because it connects a function that only now is known to have the right properties for the expression on the left hand side to a group we know next to nothing about, plus other mysterious factors each of which could be a few months to really understand. Proving the function exists? That went a bit beyond what was needed for Fermat's Last Theorem. Number theory demands breadth as well as depth. So no surprise it's hard to understand.
Over time I have come to trust Costco’s curation. Their standards seem high, and there are definitely products and brands that they sell that I don’t like, but those are subjective tastes vs objective low quality in my experience. I don’t buy everything there, but I take note of the brands and products that they either keep for a long time or dump quickly.
reply