Full Width [alt+shift+f] Shortcuts [alt+shift+k]
Sign Up [alt+shift+s] Log In [alt+shift+l]
99

Passkey authenticators for consumers (May 2023)

from Nelson's Weblog [alt+shift+b] in programming

After yesterday’s post about passkeys I got enough answers to learn how to use passkeys myself as a consumer. Here’s what I learned. If you want to try it yourself, passkeys.io is a nice demo server. Passkeys work a lot like passwords do today. You create a different passkey for each website and use it to log in. Your passkeys are stored in what’s called a “Passkey Authenticator”, agent software on your computer. (Behind the scenes passkeys use public key systems that are better than passwords.) Your phone probably works today as a passkey authenticator but most sites don’t support passkeys yet. Managing passkeys — backing up, migrating, sharing passkeys between devices — is still a work in progress. Android and Apple both support syncing passkeys between devices, that’s important so you can log in even if you don’t have your phone with you. Some software can also delegate. For instance Chrome on Windows will use Bluetooth to use a passkey on a nearby Android phone. The passkey authenticator is the main user interface. The rest of this post is notes on what authenticators are available to consumers. See also this companion piece that’s a deep dive into the user experience on Android, Chromebooks, and Windows. Apple seems the best implementation of a passkey authenticator today. It’s built in to Keychain, Apple’s existing authentication product that is pretty well designed. There’s a bunch of screenshots in this article of how the Apple experience works. My Apple-using friends say it’s pretty usable. Keychain syncs passkeys between devices via iCloud. Android has a passkey authenticator built in called “Google Password Manager,” which already saves ordinary passwords you use in the phone’s web browser. Here’s Google’s docs for users about that and some technical notes on security. Android syncs syncs passkeys between devices. It’s also pretty usable but passkeys are Android-only, not available on desktop (yet). Chrome on Windows or a Chromebook has passkey support....
19th May 2023

Stay updated

Get a weekly newsletter with the top 5 articles worth reading every week.

More from Nelson's Weblog

Angkor Wat resources

I took an amazing trip to SE Asia last month, including Angkor Wat. I had a hard time finding good reading or other resources to learn from before I went, in part because Amazon is awash in AI garbage. Here’s some books and podcasts I found useful about the Khmer empire in general and Angkor in particular: Ancient Angkor by Michael Freeman and Claude Jacques. The closest thing to a coffee-table book to preview what you will see. The practical information is outdated but the pictures and descriptions are good. Empire Podcast #185: The God Kings of Angkor Wat by William Dalrymple and Anita Anand. An entertaining and fully detailed account of the Khmer empire. It’s basically an excerpt from Dalrymple’s new book The Golden Road: How Ancient India Transformed the World. Fall of Civilizations Podcast #5: The Khmer Empire by Paul Cooper. Another history, not quite as magically well told as Dalrymple but full of good information. Angkor and the Khmer Civilization by Michael D. Coe. A highly recommended history of the Khmer region. Honestly I found this very dry and too detailed, but I did learn from it. Lonely Planet Pocket Guide: Siem Reap & the Temples of Angkor. We didn’t use this much but it seemed like a useful practical guide. OTOH it dates to 2018 so things have changed. My other advice for visiting Siem Reap and Angkor is: go. It is amazing. Plan for at least two full days of touristing there. Hire a private guide and driver if you can, it is absolutely worth it. (Email me for a recommendation.)

27th Mar 2025 • 75 votes
Non-alcoholic apéritifs

I’ve been doing Dry January this year. One thing I missed was something for apéro hour, a beverage to mark the start of the evening. Something complex and maybe bitter, not like a drink you’d have with lunch. I found some good options. Ghia sodas are my favorite. Ghia is an NA apéritif based on grape juice but with enough bitterness (gentian) and sourness (yuzu) to be interesting. You can buy a bottle and mix it with soda yourself but I like the little cans with extra flavoring. The Ginger and the Sumac & Chili are both great. Another thing I like are low-sugar fancy soda pops. Not diet drinks, they still have a little sugar, but typically 50 calories a can. De La Calle Tepache is my favorite. Fermented pineapple is delicious and they have some fun flavors. Culture Pop is also good. A friend gave me the Zero book, a drinks cookbook from the fancy restaurant Alinea. This book is a little aspirational but the recipes are doable, it’s just a lot of labor. Very fancy high end drink mixing, really beautiful flavor ideas. The only thing I made was their gin substitute (mostly junipers extracted in glycerin) and it was too sweet for me. Need to find the right use for it, a martini definitely ain’t it. An easier homemade drink is this Nonalcoholic Dirty Lemon Tonic. It’s basically a lemonade heavily flavored with salted preserved lemons, then mixed with tonic. I love the complexity and freshness of this drink and enjoy it on its own merits. Finally, non-alcoholic beer has gotten a lot better in the last few years thanks to manufacturing innovations. I’ve been enjoying NA Black Butte Porter, Stella Artois 0.0, Heineken 0.0. They basically all taste just like their alcoholic uncles, no compromise. One thing to note about non-alcoholic substitutes is they are not cheap. They’ve become a big high end business. Expect to pay the same for an NA drink as one with alcohol even though they aren’t taxed nearly as much.

31st Jan 2025 • 89 votes
Legal aid charities for immigrants (2024)

The Trump administration has made aggressive threats against immigrants in the US. It’s not clear what’s coming, my biggest fear is a violent display of fascism. (Don’t call them camps!) But even if it’s a polite legal process it will be chaotic and disruptive to many neighbors. Back in 2018 I donated reactively to the Trump administration’s cruelty to immigrant families. This time I’m trying to get ahead of it. The need for the money is now, no matter what happens it is going to be a bad few years for immigrants in the US. To that end I asked on Metafilter about charities to donate to. I got back a remarkable reply listing 18 charities that all have some California focus. I donated to most of them. I want to highlight two groups in particular. One is RAICES. They work in Texas, not California, but they are well organized and effective. The other is KIND. They have a simple mission. They try to ensure every unaccompanied minor has legal representation in immigration court (something not guaranteed.) The other groups on the list are all also deserving of consideration.

27th Nov 2024 • 96 votes
AI enhanced search

LLMs are good search helpers. Here’s three search tools I use every day. All of these use an AI to synthesize answers but also provide an essential feature: specific web search results for you to verify and further research. I use these for conversational inquiries in addition to more traditional keyword searches. Phind is an excellent free LLM + search engine. The AI writes an answer to your query but is very careful to provide footnotes to a web-search-like list of links on the right. I use this mostly for directed search queries, things like “what’s an inexpensive TV streaming device?” where I might have used keyword search too. The Llama-70b LLM that powers the free version is quite good, sometimes I have general conversations with it or ask it to generate code. Bing CoPilot has a very similar output result to Phind. I find it a little less useful and the search result links are less prominent. But it’s a good second opinion. Bing has been a very good search engine for 10+ years, I’m grateful to Microsoft for continuing to invest in it. CoPilot results are sometimes volunteered on the main Bing page but you often have to click to get to the ChatGPT 4 Turbo enhanced pages. Kagi is what I use as my general search engine, my Google replacement. It mostly gives traditional keyword search results but sometimes it will volunteer a “Quick Answer” where Claude 3 Haiku synthesizes an answer with references. You can also request one. I think Phind and CoPilot do a better job but I appreciate when Kagi intercepts a keyword search I did and just gives me the right answer. Google has tried various versions of LLM-enhancement in search, I think the current version is called AI Overviews. It’s not bad but it’s also not as good as the others. Not mentioned here: ChatGPT or Claude. Those are general purpose LLMs but they don’t really give search results or specific references. In the old days they’d make up URLs if you asked but that’s improving.

20th Sep 2024 • 137 votes
8BitDo Game Controllers

8BitDo makes good game controllers. A wide variety of styles from retro to mainstream, with some unusual shapes. And wide compatibility with various systems: PC, Macs, Switch, Android. They’re well built, work right, and quite inexpensive. A far cry from the MadCatz-style junk we used to get. The new hotness is the Ultimate 2C, an Xbox-style wireless controller for the very low price of $30. But it works great, doesn’t feel cheap at all. The fancier mainstream choice is the Ultimate 2.4g at $50 which includes a charging stand and extra reprogrammability. But what’s really interesting to me are the odd layouts, often small or retro. The SN30 Pro is particularly interesting as a portable controller. SNES-styling but a full XBox style modern controller with two analog sticks, easy to throw in a suitcase. There’s a lot of fiddly details for this class of device. Controller type (XInput, DInput, switch, etc), wireless interface (Bluetooth or proprietary), etc. 8BitDo makes good choices and implementations for all that stuff I’ve tested. They seem to work well with Steam. They’re a popular brand so well tested. It helps that PC game controllers have mostly standardized around the Xbox layout and XInput. Steam can patch over any rough spots for older games.

28th Aug 2024 • 136 votes

More in programming

If we do not stop to help each other, what do we become?

Yesterday, I received this email as a response to You Can't Vibe Code Love. It's such a remarkable and powerful statement that I asked permission to share it here, in its entirety, with personal information redacted: Hey Jeff, Hope you and your family are doing well.

4 hours ago • 1 votes
You are still valuable

A frustrated Reddit post about being a condom between an AI and production made the rounds in our team. Here is why I think the opposite is true and what it means for how we review code, plan work and think.

2 days ago • 2 votes
A Short Update on Designing for Foldable Devices

And here we are three years after I wrote about the Google Pixel Fold being announced, followed now with the announcement of the iPhone Duo...(I have questions about the naming by the way). Four years ago I was talking about web primitives in the platform for the Surface Duo. My how time flies. There are CSS media features, a Viewport Segments API, a Device Posture API but Chromium based browsers are the only ones currently supporting these things. I haven't been able to find any signal yet on whether Safari will support these things in the web platform as the developer docs focus on application development. If you're interested in trying out the platform features, you can emulate the Surface Duo and Galaxy Z Fold in the developer tools. And if you're thinking, do I really have to have my website adapt to two screens? The answer is no. Adding a design to an application or dual screen makes sense if you have an experience that has two simulataneous contexts that are useful e.g. a list of email messages/inbox on one screen, an open message, email thread or email composer on the other. Here's one of my talks from 2022 if you're interested in learning more about what's available in the browser for dual screen/foldable devices. Happy building :)

2 days ago • 1 votes
Mommy bloggers react

After a write-up in the New York Times, Mommy Bloggers had two options. Either lean in, or step back. Given how popular it became after that, it's not hard to guess which option they chose. The post Mommy bloggers react appeared first on The History of the Web.

4 days ago • 2 votes
Haunt 0.4.0 released

I'm quite a bit late on this one, but Haunt version 0.4.0 was released released back in July. I haven't had much time for blogging, but I'm catching up now! This release contains a small set of improvements and bug fixes since the 0.3.0 release in 2024. About Haunt Haunt is a static site generator that uses the Guile Scheme as its configuration language. It aims to be simple, functional, and extensible. Features include: Easy blog and Atom/RSS feed generation Markdown post support Simple development server for viewing edits before publishing Purely functional build process User extensibility Notable changes Added support for HTML in Markdown documents. This was a long time coming because guile-markdown did not support it and the library was abandoned by the original maintainer. As part of my work at Spritely, we forked it, implemented the relevant portions of the CommonMark specification, and released it. Spritely's guile-commonmark fork is now considered to be the official upstream by Guix and others. A further consequence of this is that guile-lib is now a required dependency for building Haunt as we need the (htmlprag) module to parse Markdown documents with embedded HTML. html->shtml from guile-lib's (htmlprag) module is now used instead of xml->sxml in the HTML reader. It was silly of me to use xml->sxml for this purpose years ago, but at the time I wanted guile-lib to be an optional dependency. Added haunt new subcommand for creating a new site. Added default directory, template, and prefix arguments to flat-pages procedure. Added support for index metadata flag to flat pages for pretty URLs. Flat pages now receive all page metadata, not just the page title. This is a breaking change from 0.3.0. Added .scm as an additional extension for sxml-reader. make-file-extension-matcher now supports multiple extensions. Fixed emission of <script> and <style> elements. Fixed handling of no available reader in flat pages builder. Fixed unreachable error handling clause when a reader is not found for a post. Fixed default blog theme template missing an <html> tag. Fixed overloaded -h option in haunt serve. Deprecated post in Skribe reader in favor of document. Download Haunt 0.4.0 is already available in Guix: guix pull guix install haunt See the Haunt project page for information on how to build from source. Thank you to Camilo Rodrigues, Noé Lopez, jgart, Jakob L. Kreuze, and Daniel Meißner for their contributions to this release! Happy haunting!

4 days ago • 1 votes
📚 BoredReading

You seem to be enjoying this.

Join free to unlock everything.

Create free account

Already have an account? Sign in