Nathan Hammond 張拿敦

Nathan Hammond 張拿敦

@nathanhammond.com

Hong Konger

401 followers49 following3K posts

I mean, honestly, I’m of the opinion that a mistake as a certificate authority should immediately incur certificate authority death penalty. There are some mistakes you just don’t get to make twice.

Phillip Carter@phillipcarter.dev

I am sorry but this is the funniest outcome. They ragequit the CA business because people were mean to them on social media loooooool emudhra.com/en/press-rel...

Discourse: passkeys are a user experience nightmare. I never use them because I don’t trust that I’ll be able to access my accounts when I need. They’re strictly worse for me as a password manager user for almost two decades. They also suffer from downgrade attacks to solve the UX problems.

View full thread

If you want to compromise me you have to successfully phish me while I know that is the only attack pattern that I am vulnerable to. Passkeys eliminate that one, but that doesn’t trump access risk for me. Or a downgrade attack and a SIM swap. Which passkeys don’t protect against.

I haven’t even started in on attestation and these things are already dead to me. But to beat a dead horse: I don’t want my authentication tied to trust roots outside of my control.

So @igalia.com and friends are slowly but surely turning Servo into a web-compatible browser. This would be a singular feat of engineering whose side effects throughout the process at Mozilla and Igalia have made computing better for everybody. servo.org/blog/2026/10... wpt.fyi/results/?lab...

servo.orgAugust in Servo: CSS Grid, text selection, and more! - Servo aims to empower developers with a lightweight, high-performance alternative for embedding web technologies in applications.Plus accessibility and navigation improvements.

Discourse: passkeys are a user experience nightmare. I never use them because I don’t trust that I’ll be able to access my accounts when I need. They’re strictly worse for me as a password manager user for almost two decades. They also suffer from downgrade attacks to solve the UX problems.

View full thread

I refuse to register passkeys because I don’t know if I’ll someday be forced into using the bootstrap path. “Congratulations! Today you have to bootstrap your account access because you have a passkey on a lost device.” 24 hour access delay the one time I was most likely to really need it.

Meanwhile, the password manager that has domains properly enumerated, TOTP, and randomly generated passwords I don’t even know properly defends against all the attack categories without risking account lockout.

Discourse: passkeys are a user experience nightmare. I never use them because I don’t trust that I’ll be able to access my accounts when I need. They’re strictly worse for me as a password manager user for almost two decades. They also suffer from downgrade attacks to solve the UX problems.

View full thread

“But you should have multiple passkeys for your accounts!” You’re going to tell an average user that they have multiple passwords to get into their account? And that it depends on which device they are on? And trust that they know how to manage them?

Convince my parents to use passkeys. They are password manager users. They understand why they want to use a password manager and are relatively technical. If you can’t explain to them in 30 seconds during a login flow why they should use a passkey the solution is dead on arrival.

Discourse: passkeys are a user experience nightmare. I never use them because I don’t trust that I’ll be able to access my accounts when I need. They’re strictly worse for me as a password manager user for almost two decades. They also suffer from downgrade attacks to solve the UX problems.

View full thread

For the average user passkeys are "we're going to put your credentials into a password manager that you know nothing about and won’t tell you in advance how that will interact with your future logins." Given that, passkeys are precisely as secure as the downgrade path, or the bootstrap path.

If you wanted this to actually be reliable you need to create a passkey manager flow. “You have not registered your passkey manager to this device/browser.” And now you just forced everybody to have a password manager and configure their browsers and operating system correctly.

Discourse: passkeys are a user experience nightmare. I never use them because I don’t trust that I’ll be able to access my accounts when I need. They’re strictly worse for me as a password manager user for almost two decades. They also suffer from downgrade attacks to solve the UX problems.

"We have this new technology that doesn't leak credentials when the server is hacked. And users don't have to remember their passwords." "What if the user has multiple devices?" "Well, they use their phone to do the authentication process ..." "You mean the device I'm most-likely to lose?"

"When you lose it you just use the password you created to login." "So there is a downgrade attack against this perfect solution? Did we learn nothing about that with TLS protocol selection?" "Well we can't expect users to properly maintain their passkeys." "Or their passwords, I guess?"

Anyway, just sitting down to my CA ballot and…

Chatham Harrison dba TRUMP DELENDUS EST@chathamharrison.bsky.social

The median American voter position on almost every key issue is that it should be taken care of so they don't have to worry about it anymore, & whatever policy does that is the policy they support. Their crude gauge for this, no matter its relevance, is the money in their pocket.

One thing that’s happening already because of LLMs: work by experts that would previously be funded by publishing educational materials is simply no longer being produced. “I can’t chart a path to financial viability producing an artifact of my knowledge that exists nowhere else.”

“If I publish a new Cantonese textbook with entirely new presentation formats and pedagogical strategy it’ll be copyright laundered through an LLM instantly and I will be unable to recoup my investment.” If you want that book now you have to give my friend a grant.

"Migrants" in this description doing a lot of heavy lifting.

Mae Nick Phra Khanong@nickjbrumfield.bsky.social

The Chinese characters in Sinners explicitly speak Taishanese (a southeast Chinese language not mutually intelligible with Cantonese spoken by a very disproportionate number of Chinese migrants to the US) which I thought was an incredibly niche but very accurate note

Language-wise Taishanese still being Yue makes learning it less of a lift for a Cantonese speaker and vice versa. For some huge percentage of the syllables it's a 1:1 mapping to the syllable in the other. The average Taishanese speaker is also Cantonese fluent, though not so the other direction.

With the current leading cause of aircraft loss being murder/suicide it might be time to reconsider cabin access methods in the event of murderous pilot. After the Germanwings incident the mitigation was eventually deemed too ??? to accomplish.

I just read Julia Donaldson’s new Gruffalo Granny to my kids for the first time. It’s a melancholy book for a parent who has read dozens of Donaldson stories to his kids. A public retirement note as the granny of stories, dedicated to her recently departed husband.

Eats a three day ban, comes back, sees notifications tab fallow, and decides to drop this thread.

SE Gyges@segyges.bsky.social

I'm back, I missed you all. Since this is an important subject I know too much about, here's a 🧵 explaining that AI Safety Is Mostly A Sex Cult. I don't think these people should make policy. (1/?) (alternative title: Time For Some Cult Theory)

This, and the full ban on alternative smoking products, is good policy. Especially since we actually have a public health system to protect. With greater immigration from areas with higher smoking rates we need to stay ahead of this.

hongkongfp.comPolicy Address 2026: HK to standardise cigarette pack designsHong Kong will standardise designs on all cigarette packs starting from the end of next year in a bid to discourage residents from smoking, the city's leader John Lee has announced.

Hong Kong classifies tourism as one of our "Four Key Industries" while it's percentage share of value added in GDP (in 2024) was 2.8% and percentage share of employment in total employment was 4.3%. I feel like we over-emphasize tourism in our policy decisions. www.censtatd.gov.hk/en/scode80.h...

hongkongfp.comPolicy Address 2026: HK to relax licensing rules for island guesthousesHong Kong will relax its licensing system for small guesthouses on the territory's outlying islands, leader John Lee has announced in his annual Policy Address speech.

Funny to be using English to search for a flash card manufacturer and getting “printed in the USA!” presented as a benefit. Personally I would love to have a factory in Guangdong doing the printing: I can get the shipment the day after it comes off the printer and the border is free.

Ah yes, the Suica is getting Boaty McBoatfaced.

The Japan Times@japantimes.co.jp

Japan is choosing a new Suica mascot, and the internet has already picked its favorite: "B," a deeply unsettling purple rabbit. But can online enthusiasm translate into a real-world election win? 👉 ebx.sh/AFIiah

"When the first Europeans landed on Easter Island in 1722, the moai were still there, but the trees were gone." Above quoted question text does not appear in the passage because they introduce "Easter Island" in the question, after using "Rapa Nui" in the passage.

More seriously, somebody should make an automated flash card printer/finisher with very few variables, extremely accurate, with extremely low operating cost. I’m getting low quality materials from my kids’ school, part because the degree of customization is too high.