pontilanda

Unfortunately there are so many ideas that will "never" gain ground. People are still stuck with the user/password paradigm and it will take some serious push to move to something like Passkeys, which is obviously the best if implemented correctly (i.e. provide a fallback when using a non-own device)

We need a push like it happened for HTTPS, which became widespread in less than a decade, but that basically means Google has to push for it.

Your assumption is that there's zero time between a leak and the abuse. If my password reaches the abuser after it expires, then I have been saved by the rotation.

Also rotation + "no reuse" policy essentially guarantees that eventually the password will be unique and not reused across services.

Side note: I despise rotation as much as the next guy, but I can see the value in it. If users used password managers, generated passwords and not reused passwords, then we wouldn't need such rules. But alas 1234567890 is a common password.

I hate that HN users downvote concepts they disagree with.

One can agree that rotation is good in theory and bad/annoying in practice (due to laziness). We can only argue about how much of an impact it makes, but it certainly does not reduce the security.

We all deal with "password rotation" in real life and it's inescapable: credit cards expire. And to be fair I'm perfectly fine with that because I know a leak from 10 years ago can no longer affect me. I almost wish they expired earlier.

Given PixiJS is a 2D renderer by default I wouldn’t expect performance as high as Three.js. Pixi3D seems to be a way to add the occasional 3D object to your 2D drawn application.

Are you me? This is uncannily like my experience.

Who’s going to pay for that? They’re completely dependent on Google right now.

Kinda off topic and really barking up the wrong tree. Mozilla is literally the only company maintaining a non-webkit browser (Blink is still a WK fork)

> I wonder if a large part of what makes social media unhealthy is exposing human nature to mass communication.

Bingo. I do not believe for a moment that social media company A or B is worsening society. Heck, Facebook links your presumably real identity to your content and people are still disgusting online.

No company will win by not rewarding “interesting content”. We tried that, it was called forums, and they lost out to more “rewarding” communities.

And? What are you going to do with a singular token that you don’t know what company it belongs to? But obviously those devs at GitHub don’t know what they’re talking about so they’ll gladly notify two companies at once.

It’s super easy too: take a look at GitHub’s tokens, they all start with gh.

> There isn't a country in the world which does this

Does what? The thing extra is the fingerprint but literally every modern country requires ID registration and more. My government also knows this IP belongs exactly to me. Stop spouting nonsense.

Plus this is completely unrelated.

That’s why I mentioned “depending on copy” (or more broadly “UI”).

If I’m clicking a “Generate password” button I expected a new password every time. But here it’s an autocomplete-like dropdown rather than an action. By your definition, such dropdown would show different passwords for different fields, even if the second field is a “confirm password” field.

I cannot see the issue because the regex are pre-approved by GitHub. And even then, the service will only return the string, not who wrote it. Unless GitHub approves /Jonh Doe said:.*/ there is no issue whatsoever.

It’s a combination of missing hyphens (it should be “secret-scanning partners” to avoid adjective ambiguity) and people’s inability to open links and read anything past the title. Sprinkle a bit of Sinophobia and we’re golden.

Is it a bug or a feature?

Depending on the exact wording, I completely expect the browser to suggest the same password for the same website in the same session for the same user.

Websites are crap and sometimes you need to enter the same password twice before the browser has gotten the notice to actually save the first one.