> There is very much a situation where people in frontier labs have access to exceptional capabilities that are being kept from the rest of us, and they're using it to strip-mine technical and scientific problems.
If these capabilities were available to the public, someone somewhere would make a biological weapon or create a virus we've never seen before that could kill many millions of people.
Stanford researchers have demonstrated it’s possible [1].
Biologists already addressed this idiocy a few weeks ago [1]. Making a biological weapon requires facilities that only some nation states - and comparable companies- have access to.
AI isn't going to magically assemble a DNA sequence for you and a computer design is not a guarantee of something that works.
AI restrictionists love to pretend that their toys will, with the power of intelligence, magically bypass fundamental limitations of reality to conjure up fantastical weapons of mass destruction if they throw enough computers at the task. Unfortunately for them, that is not how the world works.
Not to mention that making an actual novel virus requires thousands of dollars of equipment, serious lab skills, and even then is so dangerous that the wannabe terrorist is more likely to infect and kill themselves than cause mass causalities.
It's the equivalent of making pipe bombs at home.
The instructions are out in the public, but that's not a problem because the idiots that make pipe bombs blow themselves up more often than they succeed in doing terrorism.
From my experience, passkeys work great in the Apple ecosystem. Adding a passkey for a new site on my Mac results in that passkey syncing automatically on my iPhone and iPad via iCloud.
"But what if I lose all of my Apple devices in a freak boating accident?" people often ask or something like it. Apple has a procedure for this [1].
You can contact your "recovery contact" (a trusted friend or family member) that can help authenticate you to regain access to your account, especially if you're locked out or forgot your password.
On a new device, you login to your Apple account, make sure iCloud Keychain is enabled, and all of your credentials, including your passkeys, sync to your device.
I get it—not everyone wants or uses iCloud. Apparently, you can use 3rd party password managers like 1Password, Bitwarden, etc. to backup and recover your passkeys to use elsewhere.
Here's a video of an export from 1Password to the Passwords app on an iPhone [2].
But what I don't understand is how are passkeys improving what Apple provides here. You could have just done this with passwords and had all the ecosystem benefits you outlined.
You still need a password to exist, so while the passkey won't activate the user can still leak the account's credentials.
To cover that gap, you get rid of passwords altogether, and now users lose access if the passkey fails to sync or isn't available on one of their devices (let's say a Kindle Fire tablet)
Passkeys being bound to the domain is neat, but not without tradeoffs and practical workarounds. At least that can't be the only aspect to look at when making a choice.
Sometimes the url for the login page changes or I'm logging into a different part of the site and my password manager doesn't recognize it. My university used Duo for authentication but depending on which resource you were trying to access, the subdomain might be different. How would I immediately know that I had just typed in my credentials to a misspelled domain or a hacked user account on a school web server displaying a phishing login? That last one would be even more nefarious because my browser might not even display past xyz.abc.edu/ and it would even have a valid SSL cert. Even if my password manager didn't recognize that URL and I manually typed it in, my passkey manager certainly wouldn't even attempt sending a key.
The real problem is that companies/institutions should procure one domain name, and stick with it. There's no reasons so need to be redirected through 6 domain names when signing into Microsoft, all of which look like a phishing attempt URL.
The 1password integration works great IME. When a site supports passkeys, 1password seems to offer to save the passkey, and at login time, a little popup appears from 1password asking if I want to use my passkey, and I can either enter my password, or use TouchID to unlock 1password.
I use this across iPhone, MacOS and Windows, and haven't run into any issues.
For security? If you're not using a password manager, that means you're using the same password for almost every site. Which means every site is a point of failure for every other. This means some way of generating and saving random passwords for each site (i.e. a password manager) is absolutely required for security. You are welcome to use the password manager that comes bundled with the device you paid for (apple, android), or use paid cross-platform ones like 1password (which works well), or use free cross-platform ones (in which case you might get what you paid for).
I put passkeys in both iCloud and Bitwarden. I count on having access to one or the other, or at least being able to recover access to one or the other, but it’s the same situation with my passwords generally
In fact I quite like having separate passkeys for each manager instead of one password and -maybe- separate TOTPs (usually not) shared between them
As mentioned a cross-platform password manager like Bitwarden is the way to go in this case. But yeah, the vast majority of internet users don’t use one.
So the solution to my iDevice dying is that I have to buy a new one to maintain access to my accounts and have no option to move to non-Apple hardware?
Usually you can setup an alternate 2FA like TOTP, a recovery SMS, or something else you can use to prove who you are. And then once you're into the site, wipe the current passkey and setup a new one on your current device.
But if I can use any other form of 2FA, there is no way I'm using a passkey. The only way I would ever do so is if I have no other option.
I cannot think of any innovation that has required more defensive pleading for people to use it than passkeys. When a HN article has to be titled "passkeys are not a trap", the concept has already lost.
Seeing how effortlessly 1Password supports exporting to other clients really makes me want to use 1Password more. How does it handle other fields - Apple Passwords has like 5 fixed fields while 1P has dozens and custom fields?
> But you can’t simply switch to Android without recreating every single passkey. Sounds like vendor lock-in to me
Not so fast. Migrating passkeys from iOS to Android is possible now; migrating from Android to iOS is still being worked on.
Ricky Mondello's team at Apple created the Passwords app which brought passkeys to iOS, macOS, etc.
The entire presentation is worth watching if you’re interested in passkeys; the the clip below starts at 24:00 mark where they talk about migrating between platforms.
Starting with iOS 26.5, you can choose to move passkeys and passwords
from Apple Passwords to Google Password Manager. However, Android still
needed "a future update" to receive them. That same update is meant to
add transfers from Android back to iPhone [1].
The FIDO Alliance created a specification in 2024 called Credential Exchange Format [2] for moving credentials including passkeys, between passkey managers on the same device and across platforms.
In other words, being able to move passkeys between devices and platforms has always been part of the plan.
Right. For clarity: the choices are "use a third party authentication mechanism (like passkeys)" or "roll your own". And among vendors that continue to roll their own authentication, even the largest and most capable (like Amazon) don't try to do crypto like the upthread commenter was suggesting. It's just not practical unless you control the hardware platform. Passwords and telephone-2FA remain the rule.
> Apple refused to support it because they wanted to patent-laden alternative to thrive.
Where do people get this stuff?
Apple finally supported WebP in 2020, 10 years after it was released by Google. Firefox added WebP support in 2019, a year before Safari. Was Mozilla also part of conspiracy to undermine WebP? Come on now.
Seems to me neither Apple or Mozilla wanted to be forced to support a format they had no say in developing. Usually there's a process for coming to consensus on standards.
WebP is ubiquitous now, not the case in 2010 when it was released.
It had advantages compared to JPEG, but not enough at the time to justify changing workflows, etc. WebP initially had better compression than JPEG, but as encoders/decoders improved (MozJPEG, Jpegli, turbo-libjpeg, Guetzli) the lead WebP had mostly went away regarding compression and visual fidelity.
Going forward, WebP is becoming less relevant by the day; it doesn't support wide gamut color; it only supports RGB. It's max pixel count is quite limited compared to AVIF and JPEG XL. Newer formats have use cases beyond the web; WebP doesn't.
That's wrong, you declare this with an ICC profile, done.
Lossy WebP has an important limitation in being YUV 4:2:0. And it's strictly 8-bit. That is the actual reason it doesn't replace JPEG, which is rarely even implemented to a greater extent.
Lossless WebP replaces GIF. Despite much better compression, it doesn't replace PNG, which supports 16 bits, and has stronger metadata support.
There were obviously some internal politics going on—Google joined the Alliance for Open Media, a consortium of the who's who of the media/tech industry: Apple, Facebook, Microsoft, Amazon, Netflix, Nvidia… the list goes on. They supported AVIF as the next generation image format.
Google apparently wanted to be one of the "cool kids" supporting AVIF. When they removed the JPEG XL code from Chrome, they created the excuse that there was little demand for it, along with some other disingenuous talking points that didn't quite make sense. Ironically the project that ended up becoming JPEG XL was started by Google employees in Switzerland.
Anyway, I’m glad Google is supporting JPEG XL now. I wanted to use JPEG XL files for a project I started a month ago, but it was a non-starter with global usage under 20% at the time.
https://nerdy.dev/cascading-secret-sauce
reply