• 0 Posts
  • 30 Comments
Joined 2 months ago
cake
Cake day: August 24th, 2026

help-circle









  • before I say what I’m about to say I want to be clear I don’t think Judaism = Zionism and I agree that Netanyahu is absolutely pushing that narrative to support his goals.

    That said I think your comparison to race here is quite unfair. Bigotry surrounding race, sex, orientation etc is fundamentally different than religion. It needs to be acknowledged that profiling behaviors based on race, sex, orientation etc is wrong in large part because those things have very little to do with people’s behavior or beliefs outside their narrow domain. So the only broad stroke statements to make about them are bigoted and hateful.

    On the other hand religion shapes someone’s entire worldview and how they act. I think it’s a bit of a problem that somehow we’ve convinced ourselves which cult you joined deserves as much respect how you were born. It doesn’t. And while not everyone who’s a member of the cult believes all its tenets it’s entirely fair to acknowledge that the central tenets of these cults are deeply problematic in themselves.

    So yeah lots of people who call themselves Jewish are not Zionist but that requires not accepting key parts of the central texts. So I guess what I’m saying is for Non-Zionist Jewish people I think the burden of proof is kinda on them to clarify. When you identify yourself as a member of a cult I’m gonna assume you follow its teachings unless you tell me otherwise. Similarly we can’t pretend the existence of the cult is entirely independent of the existence of fundamentalists that take its texts to the most literal and problematic extreme.

    Holy war and its war crimes have plagued humanity for literally its entire history and I think we need to be honest about the fact that while individual people who are members of these cults may not be problematic the continued acceptance of these widespread cults in the modern era totally is.








  • Really there is no way big tech can force me to use their app? Ok so you know how the open standard for TOTP is a six digit code computed from the time and shared secret? Well every student at the university of California and every employee at many companies across the US has to use an Authenticator app called duo which uses a 3 digit code generated by the app at the moment you attempt to log in. How does it do that? No idea it’s closed source. Is it even a formula like the TOTP open standard? Probably not I’d guess duos servers just send a code to both sides when you attempt a login. And would you look at that suddenly we have TOTP that I can’t write myself and I’m forced to use some shitty app.

    Now I do recognize the point you’re making but I want to emphasize it’s not about attestation being in the metadata or not. It’s about open standard compliance. As the open standard is written even if you have to have hardware attestation you can build the passkeys yourself (because this is functionality all password managers are quickly starting to have) and frankly having each passkey being device locked is good security practice to protect you from credential stealers and related malware. You’d still be in control and you could still sign in to as many devices as you want. You’d just need to make a new passkey for each one if you don’t wanna sign in the old fashioned way with a password and dual factor and such.

    The abuse scenario you describe would require a departure from the open standard. Is this possible? Of course. As I said some companies already do this with TOTP. But I don’t see that as a structural fault of passkeys that TOTP somehow doesn’t have like the article tries to imply. Both only work well for the consumer if the open standard is adhered to.


  • This is actually a terrible take. Passkeys provide a very large security benefit over passwords and have an open standard.

    It’s particularly ridiculous that they seem to think TOTP good passkey bad. They solve the same problem: symmetric persistent encryption like passwords is very weak. TOTP solves this my making it not persisting and passkeys solve this by making it asymmetric. Passkeys are mildly more convenient because you don’t have the copy a code over.

    Both also have the same potential for abuse, any service could require you use their specific app. The fact that this article makes it sound like TOTP is a perfect open standard while passkeys are a Trojan horse for abuse is ridiculous. If most services are using the open standard for TOTP why wouldn’t they for passkeys? Also not all services do obey the open standard for TOTP. I’m sure I’m not the only one who was forced to install the duo Authenticator because their institution was somehow sold on their protocol being stronger than the open standard.

    TOTP and passkeys are comparable and both with doing.