Hacker News Reader

Why not, it seems to be coming to 1Password: https://www.youtube.com/watch?v=lYFxfchhR1g

They've already put this WebAuthn teaser up: https://www.youtube.com/watch?v=lYFxfchhR1g

Raferton I cheated on my Microsoft interview (2019)

I think you missed "since then" preceding the second quote.

Don't forget they're getting sued by a large customer of theirs too, claiming their solution doesn't deliver what was promised: https://www.pymnts.com/legal/2022/authentic-brands-sues-bolt...

Raferton Show HN: React Routing in 120 lines (including comments)

Isn't that the gap the likes of Next.js are filling?

Raferton Apple, Google and Microsoft Commit to Expanded Support for FIDO Standard

The actual exchange with the server is using public key cryptography. How you unlock the key material locally could be a number of ways: PIN, password, fingerprint scan, voice recognition, etc

Raferton Ruby YJIT Ported to Rust

YJIT benchmarks can be found at https://speed.yjit.org/

The Rust port doesn't change performance much according to the pull request description.

Raferton Stories of reaching Staff-plus engineering roles

https://charity.wtf/2017/05/11/the-engineer-manager-pendulum... is a great read on this.

Raferton Apple unveils contactless payments via Tap to Pay on iPhone

The PCI Security Standards Council has been working on the Secure PIN on COTS (SPoC) standard for a few years: https://blog.pcisecuritystandards.org/new-pci-software-pin-e...

Raferton UUIDs are popular, but bad for performance (2019)

The UUID type index in Postgres is optimized: https://brandur.org/sortsupport

Raferton Why is using SMS bad for 2FA?

You might want to look into what the FIDO Alliance is doing with WebAuthn. The problem is already being solved.

Raferton Stripe Payment Links

Shopify has had the Buy Button for years. Combine with the Lite plan for $9 a month (https://www.shopify.ca/lite) and room to grow if the business takes off without replatforming.

Raferton Payments down 20% in my SaaS after EU introduced PSD2

100%. 3DS is for card payments and using Netherlands and Germany as examples here is just plain bad - in these countries bank-based payment methods are more popular: iDEAL in NL (which has used 2FA for years), Sofort and Giropay in DE.

See: - https://www.adyen.com/knowledge-hub/guides/global-payment-me... - https://stripe.com/en-us/payments/payment-methods-guide#paym...

Raferton Bob Cassette Rewinder: Hacking Detergent DRM

My brand new Kitchenaid dishwasher has the prewash compartment on top of the normal compartment - effectively making it a measuring cup throwing its contents into the tub once you close the door.

Raferton Bob Cassette Rewinder: Hacking Detergent DRM

> Proprietary cassettes for dishwashing machines? That's next level.

I was in the market for a new washing machine and noticed the Miele W1 machines now have something similar called "TwinDos". You can still add detergent the old-fashioned way but it had me wondering if this is a lead-up to the same business practices we see with Nespresso and inkjet cartridges.

Raferton What I Wish I Knew About U2F and Other Hardware MFA Protocols

I think you're confusing the cloud-assisted Bluetooth (caBLE) transport with actual built-in device keystores. Google is testing this on their properties while it's being standardized in CTAP and WebAuthn, see https://github.com/w3c/webauthn/issues/1381

Raferton What I Wish I Knew About U2F and Other Hardware MFA Protocols

TPMs are also sold separately that which can be plugged in to motherboards, e.g. Gigabyte (https://www.gigabyte.com/us/Motherboard/GC-TPM20-SPI-20) and Asus (https://www.asus.com/Motherboards-Components/Motherboards/Ac...) to name a couple.

The article has a couple of other weird faults, too:

1. I'm not sure why the author is complaining about FIDO2 having backwards compatibility with U2F/CTAP1. The article even incorrectly claims FIDO2 is "a 3rd incompatible standard" only to counter-argue the point a few paragraphs below explaining CTAP? People not having to throw away their perfectly fine old devices is a good thing in my book.

2. "All FIDO standards are web-centric and aren’t designed with any other client software in mind" the first part is true, the second part not so much. For example FIDO2 supports silent authentication (no user interaction) while WebAuthn explicitly does not[0]. It also supports the hmac-secret extension[1] which is used for offline authentication with Azure Active Directory[2] and IIRC no WebAuthn browser implementation exposes this extension to web apps.

[0]: see e.g. discussion on https://github.com/w3c/webauthn/issues/199

[1]: https://fidoalliance.org/specs/fido-v2.1-rd-20210309/#sctn-h...

[2]: https://docs.microsoft.com/en-us/azure/active-directory/auth...

Raferton Things I learned while developing a billing system

> Store money including the smallest possible subdivisions.

This is fine as long as everybody follows ISO4217. In my experience many 3rd party systems _mostly_ do it and of course you get bitten by the edge cases.

For example, Stripe decided HUF doesn't have 2 decimals (I know that's how it's used in practice today but we're talking standards and system interoperability here), or that ISK subdivides into hundreds ("cents") in contrast to the ISO tables. Compare https://stripe.com/docs/currencies with http://currency-iso.org/en/home/tables/table-a1.html. As Stripe notes for UGX, backing out of this is nearly impossible because of the subtle break in backwards compatibility. And who knows how other payment providers deviate in their own way.

For my own sanity and that of my coworkers (e.g. easier analysis for extracted tables in the data warehouse) I strongly prefer avoiding this headache and use decimal instead. You can do the appropriate rounding for a currency in your money object as for example https://www.martinfowler.com/eaaCatalog/money.html does.

Raferton Fintech Comes to America at Last

According to https://www.ecb.europa.eu/press/pr/date/2012/html/pr120725_1... it was part of the SEPA migration but as a customer I remember quite a lot of card skimming happening too at the time, and banks accelerating EMV rollout to stop that.

Raferton Efficient blockchain architecture based on FIDO keys

That is Yubico's flavor of U2F attestation. U2F has been succeeded by WebAuthn, you'll probably want to look at https://www.w3.org/TR/webauthn-2/#sctn-defined-attestation-f... instead.

Raferton Tesla’s charging stations left other manufacturers in the dust

> As a port, CCS2 is backwards compatible to CCS1. You can take a CCS1 (J1772) cable and plug it into a car with a CCS2 port. And yes, the J1772 (CCS1) is by far the standard connector in the US market. I see that connector everywhere.

CCS type 1 (J1772) and type 2 (aka "Mennekes" used in Europe) are not compatible? Both are described in IEC 62196-2 so I am not sure which other connectors could be compatible here.

> And yes, Elon could easily say "Tesla is moving all production to CCS2, all future Teslas manufactured after today will be CCS2, all Supercharger stations will be retrofitted with CCS2 cables"

This already happened in the European Union FWIW.

Raferton Tesla’s charging stations left other manufacturers in the dust

Counterpoint: I use the Circuit Electrique network (owned by Hydro Quebec) and their infrastructure has been great. Level 2 curbside chargers are found throughout the city and they app works fine. There's a few super chargers outside Montreal but nothing worth driving out of the way for.

While digging in to how their network is built, I found out it seem their infrastructure is from AddEnergie, a Quebec company that's also the provider for the eCharge (New Brunswick) and the BC Hydro EV. They have their own consumer brand for home chargers and public charging network across Canada called FLO. They seem to be growing fast (closed their series C last year), their product seems to be pretty good, so it doesn't have to be all terrible.

Raferton That's not how 2FA works

Have I got good news for you: https://webkit.org/blog/11312/meet-face-id-and-touch-id-for-... - ICYMI WebAuthn is the successor to U2F.

Raferton What's good about offset pagination; designing parallel cursor-based web APIs

How do people even figure out they need to be on page 10? Sounds like a filter of some kind (e.g. before a date) would be better, except they trained themselves to use x amount of pages to approximate.

Either way, 10 pages isn't so bad but tens of thousands can become troublesome as explained on https://shopify.engineering/pagination-relative-cursors

Raferton BMW to shame out-of-warranty UK drivers with smart billboards

> CarPlay is a subscription

I've been looking at BMWs this year and IIRC they backed out of this after the backlash: https://www.autocar.co.uk/car-news/technology/bmw-u-turns-ap... - agree with your other points though.

Raferton Shitlist Driven Development (2016)

The Ruby-based tooling has been released as open source: https://github.com/Shopify/deprecation_toolkit

Raferton Face ID and Touch ID for the Web

That's correct, but 1Password stores a static secret (the password) and this may be re-used by less security-minded folks as you probably know. WebAuthn servers only store a public key which is useless in case the server gets compromised. WebAuthn also is phsihing proof by having browsers verify the domain the credentials are used for.

See more at https://webauthn.guide/

Raferton All Your Passwords Are Belong to FPGA

WebAuthn is well supported across all major browsers and can be used for multifactor login without username and password.

Raferton All Your Passwords Are Belong to FPGA

WebAuthn does this pretty much.

Raferton What changed in OpenSSL after heartbleed

BoringSSL is still alive, Tink is something completely separate.