Are you seeing your instance as a means to patiently persue a certain ideology rather than allowing free speech and open uninterupted and respectful discourse?

We have no obligation to platform pro-genocide, patriarchal, white supremacist, cissupremacist, homophobic, or otherwise oppressive speech, and more, we have a moral obligation to silence those bigoted groups, deprive them of their right to speak, and prevent them from spreading their harmful views, and not only for the mental health of our users, of whom many are members of those targeted groups, but because we know that its the modus operandi of these white-supremacist/bigoted groups to set up nazi bars on social media platforms to spread their views, get people to associate and agree with them, and grow. The correct answer has always been, and remains, to deny them a platform.

If other servers, following the line of reddit and other US social media companies, want to platform those views to increase ragebait engagement and their user counts, there’s nothing we can do about that, but at least here we can think about the long-term mental health of our users, which is far more important than user counts.

Fediverse instances are like email servers, if they call something spam and don’t want to host it, then that’s their prerogative. Arguments for “free speech” do not require them to host what you want them to host.

We also don’t buy the liberal notion of “free speech”, and think that even if there was such a thing, liberal countries and spaces don’t actually practice it. Much like all liberal countries have a long history of banning anti-capitalist / anti-imperialist speech, organizing, and communist political parties, the instance you’re on also doesn’t adhere to “free and open speech”: they’ve blocked the most popular leftist instances in the fediverse (hexbear and lemmygrad), to shield their userbase from those views.

I don’t understand why we need this division, and though you decry it in your comment, through actions or inactions, communities and moderators on your instance are allowed to amplify this division.

We have a be respectful rule here, and we do enforce it with temp bans, however it is unavoidable that some people (especially when venturing outside of lemmy.ml), encounter extremely bigoted and pro-genocide takes, and that makes them understandably angry. Still, if you see people from our instance breaking that rule, then report it, and we’ll get to it when we can.

How come you seem to allow communities who are moderated by a single user who repeatedly bans people just because they don’t like what someone says in an instant?

To be instant banned for a few paragraphs. Then being name called by that mod, in a community without any rules, and then being banned with the reason ‘Zionist’ while I am just about 180º the opposite is not the way to persuade people like me.

I don’t know the circumstances, so you’d have to be more specific, linking examples. We made the modlog public, and its possible to link to every modded item to see what happened.

I listed the challenges, how hard it was to communicate, how I was past the point of all hope to see it ever improving. Then the person said to me: “Good. So what are you going to do about it?”

Despite ideological differences, and some loud users on other servers demanding more defederations, we actually have good relations with most other fediverse server admins and runners. We don’t make demands on each other, each server has full autonomy to take mod actions on both local and federated users, and that autonomy is respected.

Brazil needs to ban facebook until we can figure out what the hell is going on.

Israel is one of the US’s forward bases, “an unsinkable aircraft carrier in the ME”, from which it can project military power and influence. The US supplies the money and weaponry, and Israel provides the settler troops, as well as a testing ground for police-state / crowd-control tactics and military effectiveness of weaponry for the rest of the western world. Its a mutual co-dependence, but the US plays the more powerful role.

If US aid failed to materialize every year, Israel would soon cease to exist, and the west would lose that base of power.

is people making assumptions about other’s beliefs based soley on their instance of choice. It’s not helpful, it’s not generative, and it’s a waste of everyone’s time.

Spot on. Taking countries as an analogy for fediverse instances, we shouldn’t make all the citizens of those countries into an ideological monolith: there’s always a diversity of views, even if some views are more predominant than others because they’re encouraged from the top.

And above all we should not be alienating and unecessarily divisive to those who, with a little education and prodding in the right direction, will side with the majority of the world’s workers. Our job is to make allies, patiently educate, and create more caring people.

I don’t doubt that these incentives also drive the push for passkeys, but passkeys are much more opaque and tightly integrated with the OS, and is thus more vulnerable to centralization.

I’m not sure what you mean by integrated into the OS. I use a FOSS password manager on android (keepassdx), storing passkeys both for apps and websites. When the browser or an app asks for a passkey, android uses the password filling service you’ve chosen (in my case keepass), and it loads up, no differently from when there’s a password prompt. I’m not sure how it works on other platforms like iOS, windows, or linux, but at least on android, you can use a FOSS password manager not integrated into the OS.

They are. Authy is the biggest offender I know.

Specific sites aren’t locking down TOTP, this seems to be an EEE scheme of Authy specifically, since as you say the TOTP codes provided by sites still work with other authenticators. I’m referring to the case where say, amazon forces you to use their app to login, or creates their own custom TOTP or passkey app, and won’t let you log into their site without it, and then you have no control over your login method or codes.

I’m sure a lot of people (like myself) would refuse to install a special custom TOTP app just to be able to use one site. They’re only hurting TOTP adoption by doing that, and thus increasing the amount of support resources they need to allocate to account hacking / hijacking.

I’m sure there are other companies too willing to go against their economic interests for various reasons, but they’re going to be in the minority.

Once you can correctly answer the question you responded to, you’ll see why its against their material interests to EEE logins, whether its TOTP or passkeys.

No, but the “normal, worst case” usage of passwords is still far worse than even that case. Most people just re-use the same password for everything. This is why almost all companies use phone numbers and text messages as a totp now.

If we’re comparing worst usage of passwords vs worst usage of passkeys, passkeys still wins.

Question: Why did these corps implement TOTP? You should be able to answer this from an economic perspective of them trying to save money.

Another question: why aren’t these corporations locking down TOTP to restrict them to their own validator apps, in the same way you’re proposing that they might do for passkeys?

That’s entirely optional and not forced. You can use FOSS password managers that store your passkeys, that can log into all those services.

If you’re referring to proprietary password managers (IE like google or apples), then that concern applies equally to all the passwords you’re storing with them. So that concern is not specific to passkeys.

I’m using a FOSS password manager for like 6+ passkeys right now, on some of the biggest sites. So this is just demonstratably false.

but in practice they’re being pushed as a way to increase lock-in

Which ones are doing this? Give specific examples of sites that are forcing you to use a specific TOTP or passkey validator.

Those two categories aren’t really meaningful, but even if you consider them to be, passwords (apart from a master password for your password manager) also should never be in the “things you know” category, because then it means you’ve memorized them, and are not using a password manager to generate completely random ones.

And unless you’ve got an incredible memory that can memorize unique passwords like “+28x@!8eaEak!” for 10+ sites, then you’re likely using a pattern or single password than can be compromised.

If you use a self-hosted password manager like bitwarden, then its there. If you use a file-based password manager like keepass, then you can use any syncing method you choose, and its no different from passwords.

Passkeys also aren’t lock-in. You control them, and your FOSS password manager likely already supports them.

Passkey is stored on propietary, trust me bro, “we will never share this with the NSA or FBI” Apple or something account where you can’t export them

No. Most FOSS password managers support them, even keepass and bitwarden. You control them, you can export them as you wish, and even use them across multiple devices. I know because I do this.

The concern is valid, but we should also look at these company’s interests in pushing passkeys, which first and foremost is avoiding all support and resources they have to dedicate to password resets and account hijacking, of which TOTP was the band-aid for, which they also push.

The software or hardware attestation is IMO a non-issue for most public sites. We have a precedent in TOTP, and they haven’t locked those down either to specific software, because they care more about adoption (to avoid the costs above) than controlling what software you use to validate.

If someone wants to say that these companies will turn on this attestation for passkeys in the future, and break a ton of logins and decrease adoption, then they should have a reason why they haven’t done so for TOTP.

Another point someone brought up in one of these posts: the remote attestation (IE locking your passkeyto a specific app or software) issue is highly unlikely to be used for public websites, because it would block / halt the adoption they’re trying to promote, and its against their interest. No website that I know of has done this for TOTP either.

They push TOTP and passkeys now because they want to avoid the costs and support around resolving hijacked accounts, and password phishers.

The use-case for remote attestation is a valid one also: say you have a really secure internal system that you want to lock down to only users of your specific passkey validator, and make sure its that specific app, unspoofed.

An absolutely crazy and true factoid from wikipedia:

https://www.yubico.com/resources/glossary/what-is-a-passkey/