aleksejs

The new Pebbles, probably. They have very nice hardware, long battery life with always-on screen, open software, and an active developer community.

https://repebble.com/

It's in the spec because enterprises use it for corporate authentication scenarios, where they do have legitimate reasons to restrict which kinds of authenticators their employees can use.

Right, if you phish the credentials to an account that is not protected by a passkey, one thing you can now do is set up your own passkey on it. That's exactly what passkeys would've protected the victim against!

The other articles you've linked also describe attacks against accounts that allow non-passkey logins, or attacks that require a compromised browser.

The article describes a straightforward phishing attack that works specifically against accounts that are _not_ protected by passkeys:

> Depending on which multi factor method the account uses, the victim sees a matching fake screen, whether a one time code prompt, an authenticator app number match, or an SMS page.

The only sense in which passkeys have anything to do with this at all is that the attackers used the word "passkey" in their emails. When a phishing campaign with the subject line "Your Mailbox is Full, Log In to Fix Now!" succeeds, that does not demonstrate an interesting vulnerability inherent to your mail server's mailbox size limits.

> The obvious way to satisfy people is to remove support for remote attestation from the spec.

If you presume bad faith on the part of basically the entire WebAuthn implementer community, how does this help?

The consumer passkey authenticator implementations of today do not provide attestations, passkey relying parties do not consume them, and both would need to intentionally ship changes to enact the scenario you're worried about. If you're worried about both of these colluding to lock you out of your accounts, it seems naive to think that changes to an (intentionally malleable, extensible) spec will protect you.

> re-enroll attacker's key or register attacker's passkey

Can you walk me through how that would work?

That's an odd point to make when in the actual world we live in, Cambridge was where the first COVID vaccine was developed.

I really like the _idea_ of a QWERTY phone, and halfway through this page there's a section showing how you can use special characters to invoke commands (presumably by just typing at the home screen?), like "- buy milk" to add a todo entry or "? aviation recipe" to search. This sounds great, and somewhat difficult to replicate on a touchscreen!

But I'm not convinced anymore that the actual typing experience is any good. Way before that exciting section, there's a video where somebody takes two full seconds to type "Hey bro you" on this phone's keyboard. I tried: in the same amount of time, I can type "Hey bro you mean everything to me" on my Pixel's default keyboard.

Fascinating times we live in, when "the last hypervisor bug" in what is presumably one of the most hardened pieces of consumer hardware can be found by "noobs" and "slop kiddies".

Allegheny County in Pennsylvania is one such department without a separate number. I don't think it's that uncommon.

Is your heat sink entirely unmodified? Opening up the fins should make it a lot easier to cool.

Meta glasses do have a recording indicator.

You will surely not have a good time enforcing the terms of a legal document that explicitly spells out that it is intentionally obfuscated from the party it intends to bind.

I think the actor they were monitoring was not tracking real launches but rather simulating where a hypothetical balloon launched from their territory would land.

This is an official USPS service available to anyone willing to attach their address and "a statement guaranteeing payment of postage due on delivery" to their keys! Which is neat but kind of awkward if that's also the address of the door the keys open.

(per section 1.6 of USPS DMM 133 at https://pe.usps.com/text/dmm300/133.htm)

I'm not sure I understand the intended message here. The author seems to describe their own project as "cover[ed] ... with invasive advertising" while saying that new technology accomplishes the same outcomes "faster, cheaper, and [with less maintenance burden]". So what exactly has been ruined?

> If you go looking for the public record of what Mythos actually found you land on roughly 40 CVEs, and 28 of those are Firefox and 9 of them are wolfSSL. A browser and a cryptography library. There’s no PHP in that list, no CMS, nothing that resembles the web most people actually use.

How does one arrive at the idea that "browsers" is a category less representative of "the web most people actually use" than "PHP applications"?

I just added CEC to mine today by soldering some wires to my DP-to-HDMI adapter and having Claude write some firmware to run on a Pi Pico to inject the CEC messages at the right time.

It's not the most elegant solution but felt in the spirit of the whole BC-250 experience.

That limitation can be bypassed through the Accessibility API on Android. KineStop supports this, but for some reason does not advertise it particularly widely. You want KineStop → Settings → Fix blocked buttons.

That sounds fun too!

Buried at the bottom of the article, my favorite thing about modern Lego kits:

> One of the most intriguing features is unlocked when you press the ‘build together’ button on select sets in the app. This allows consumers to build a LEGO set as a team by delegating each builder a building task to complete.

My partner and I enjoy assembling Lego kits together, but with paper instructions parallelizing the work is pretty tricky (usually we end up alternating one person doing the actual assembly and the other picking out the correct parts for them). But with the LEGO Builder app, it dynamically generates two parallel sets of instructions. It works great even if you're working at different paces.

This is one of those software features that delights me both as a user and as an engineer. It probably was not that complex to implement (once they had the building steps in a machine-readable format), but it's a great use of its medium, something that you genuinely couldn't do without software.

The camera (even the regular model) does not have its own GPS receiver at all. It relies on a smartphone to transmit GPS coordinates over Bluetooth.

This is pretty common in modern cameras, presumably because most photographers expect to be able to turn their cameras on and off very rapidly, and it would be difficult to maintain a GPS fix with that usage pattern.

You can install a custom operating system on (a non-carrier-locked model of) every phone Google has ever made.

> This is imperfect, as CAA record validation is not mandatory yet. But by March 2027 all the CAs a supposed to have support.

Is that true? My read of Section 1.2.1 in [1] suggests CAA checking has been mandatory since 2017‐09‐08.

[1] https://cabforum.org/working-groups/server/baseline-requirem...

The jabber.ru post referenced here presents clear evidence (in the section titled "Network") that the malicious actor was able to reroute traffic going to the legitimate jabber.ru server. An attacker in this position does not need an RCE to get a cert, they can just get one issued the normal way, because they do effectively control the IP address that the domain is pointing to.

The leasing company leases these cars to Uber drivers in NYC, who presumably did not get cut off.

> It doesn't provide a useful security feature, but it does lock out competition very well.

This seems to presuppose that service providers using reCAPTCHA are either clueless idiots or actively expending resources and lowering their conversion rates to support the supposed Google/Apple duopoly. That does not strike me as a plausible claim.

TFA is authored by the developers of an alternative operating system that can be freely installed on every Google phone since Pixel 6.

It argues no such thing. Of the 20 instances of the word "interest", 19 are obviously referring to the interest that the IRS will charge you on your balance if you don't pay your taxes by the due date. The one remaining one is this:

> Overpayment interest for the 2020–2023 disaster period.

and refers to the interest that the IRS will pay you if they owe you money (a refund) that they don't manage to return to you in a timely manner.

(All of this is explained on the main IRS website: https://www.irs.gov/payments/interest)

It's a cultural difference thing: https://russian.stackexchange.com/questions/13142/what-do-or...