• 0 Posts
  • 26 Comments
Joined 2 years ago
cake
Cake day: August 8th, 2023

help-circle

  • A passkey is a public/private key pair used instead of a password. You store the private key, and the website stores the public key. Data encrypted with the public key can only be decrypted by the private key, and vice-versa.

    This means you can share the public key freely with the website, and even if they get hacked and the public keys are stolen, they’re useless.

    When you log in, they send you a challenge encrypted with the public key, and since you hold the private key, you can decrypt it, create a response to it, re-encrypt it with the private key, and send the response to the website; which then decrypts it with the public key to verify it.

    The initial spec was that each device would have its own passkey and store it in a TPM (that thing Microsoft requires your computer to have for Windows 11), which is a secure memory storage location that only the kernel can access.

    However BitWarden is also able to store them and make them portable. (I think the standard was loosened to allow for this? But don’t quote me on that.) So, now you can have one passkey for the site and it works anywhere you can use BitWarden’a browser extension.

    TLDR: more secure than a password, nothing to forget, stops passwords being stolen.


  • Community names are unique if you account for the instance name.

    This is a bit confusing as usernames follow a similar, email-address-like format.

    I would enjoy there being just one community for a given topic that spans all instances, and moderators can either take actions that are instance specific or “global” (happen everywhere) but again that can get complicated fast. Who gets that global power? What if there are disagreements? Can an instance revoke a global action for just their instance? How much extra work does that create? How do instances handle backend storage for stuff like that (do you want CP deleted globally? I’d imagine so because it’s illegal to store it. Who decides to block an instance out of a community for posting offensive/illegal content; and how do you prevent all that from being abused for non-offensive content that instance mods find disagreeable?)