DuckDB NPM packages 1.3.3 and 1.29.2 compromised with malware

Post by diggan » Wed, Sep 10, 2025, 7:16 PM UTC

yawaramin wrote: post #290

diggan wrote: post #280

Earlier quoted context omitted.

> Yes, the idea you are presenting is that the human being must manually check for mistakes. Not at all? The password manager handles that automatically, have you never used a password manager before? > Passkeys will automate and enforce the check What happens to the passkey when the origin changes, is it automatically recognising it as the new domain without any manual input? Curious to see what magic is responsible…

> Not at all? Yes: '...you double-check the domain.' That's manually checking for mistakes. > What happens to the passkey when the origin changes, The passkey won't work at all. You will just have to create a new one.

Post by diggan » Thu, Sep 11, 2025, 6:56 AM UTC

yawaramin wrote: post #292

diggan wrote: post #291

Earlier quoted context omitted.

> Yes: '...you double-check the domain.' That's manually checking for mistakes. Yes, but that's only when the origin changed compared to when you added it to the password manager. Same thing for Passkeys, won't work if the origin is different, so you double-check that the domain in your browser address bar is the correct one. Obviously normally you don't do anything except click on the account that shows up, since th…

With passkeys there is nothing to check manually. If it works, you know it's the domain you registered on. If it doesn't work, you log in with a non-phishable auth method like emailed magic link, then register a new passkey. You could claim that a phishing site could set up their own passkey registration system–but that still wouldn't give them access to the target's real account.

Post by int_19h » Thu, Sep 11, 2025, 11:45 PM UTC

parliament32 wrote: post #288

cuu508 wrote: post #254

Earlier quoted context omitted.

Use WebAuthn as the second factor. Passkeys are a single factor authentication, and a downgrade from password+WebAuthn.

Depends on where you store them. If they're in TPM (like WHFB) it's two-factor (because you need the TPM itself, something you have, and PIN or biometric to unlock it, something you know/are). But if you're just loading keys into a software password manager, yes, it's single factor.