31–40 of 46 posts
Honestly I just want government backed digital ID for this stuff. I know the concerns. I no longer care. The benefits outweight the costs, imho. I want to be able to tell a site "yes I'm Martin here's proof either ban me or let me in but stop making me jump through hoops to prove ID. And so that social sites I use will no longer have to deal with undesired non-unique accounts for bot swarms and sockpuppets and the li…
Props for sharing what's probably a ubiquitously hated opinion on HN. Here are two of my own, just to join in: 1. Social credit score system. We should all be able to point our phone at antisocial behavior and damage their score. Until then there's pretty much zero recourse against people who have hostile social behaviors that don't commit a crime (like arguing with the McDonalds employee or causing a scene when some…
Earlier quoted context omitted.
I don’t see that in the code. But you’re right that there is something heuristic you can do.
Here is a relevant discussion about it in S/O: https://stackoverflow.com/questions/67797804/how-to-distingu...
so you won't be able to log into youtube unless you have a TPM approved by Google
Honestly I just want government backed digital ID for this stuff. I know the concerns. I no longer care. The benefits outweight the costs, imho. I want to be able to tell a site "yes I'm Martin here's proof either ban me or let me in but stop making me jump through hoops to prove ID. And so that social sites I use will no longer have to deal with undesired non-unique accounts for bot swarms and sockpuppets and the li…
Props for sharing what's probably a ubiquitously hated opinion on HN. Here are two of my own, just to join in: 1. Social credit score system. We should all be able to point our phone at antisocial behavior and damage their score. Until then there's pretty much zero recourse against people who have hostile social behaviors that don't commit a crime (like arguing with the McDonalds employee or causing a scene when some…
wow! That's going to work well. Groups never gang up to bully people they disagree with.
As other commenters have said, a better solution needs to be something that is prohibitively difficult for bots to mint. I’m sure there are a few contenders in the space but one I’m aware of is [worldcoin]( https://world.org/ )
He’s done enough damage, let’s not make the creator of the problem in charge of the “solution” that benefits him too.
https://www.buzzfeednews.com/article/richardnieva/worldcoin-...
https://www.technologyreview.com/2022/04/06/1048981/worldcoi...
Earlier quoted context omitted.
So what about users that don't have any such hardware?
Use a CAPTCHA?
Earlier quoted context omitted.
What about for software implementations like 1Password and Bitwarden?
They can't fake the attestation from hardware implementations so you could just reject keys from software implementations.
It's really annoying, PayPal does this too. They only support passkeys in safari or chrome, even though it works just fine with a yubikey in Firefox. They just go out of their way to stop it from working. Really really annoying.
And they also refuse to enroll more than one token even for the basic fido2 mfa.
Earlier quoted context omitted.
Yeah, the notably missing part in README is "how this works".
What I'm scared of is some sort of cryptography becoming the death of the open web. Baking keys into your hardware and doing remote attestation. It doesn't tie you to a real-world identity except that you're locked into using an unrooted (DRM'd) device for using online services like a normal person If I had to choose between two evils, I'd rather upload my passport to cloudflare and be able to get anonymous tokens fr…
I don't want to do either. Not interested in Altman's eyeball crap either.
Bot prevention is not my problem as a user anyway. In fact in many cases scraping is very useful to me and could be used to have AI agents monitoring a website and informing me when something changes. Like a price drop.