Hacker Newsnew | past | comments | ask | show | jobs | submit | an_d_rew's commentslogin

OP Thank you for taking the time to write and post this! It was an interesting take on a very difficult problem.

FWIW, I have been reading policy documents for a long time and I thought you sounded rather human and natural… Just very professional! :)


1Password integrates with all pass keys on my iPhone, my Mac, and my Linux box.

By a far and away WORTH the subscription, for me!


doesn't that mean your passkeys are now about as secure as a regular password?


Passkeys are highly phishing resistant in a way that passwords are not and are not subject to credential reuse (though password managers somewhat solve the first problem and almost entirely solve the latter problem.)

In effect, though, 1Password is both something you have (the device with 1P logged in, login requires a Security Key that you don't memorize) and something you know (the master password) or are (typically biometrics can be used to unlock for a period after entering the master password.)


How do Password managers solve phishing issues? Even just somewhat?


Your password manager will autofill your credentials on the real site but not on a phishing site.


Ah true. Didn't think of that. Good point


No. The service you are logging in to does not hold the keys so they can't be leaked, passkeys do not get reused between services, it's effectively impossible to fall for phishing attacks with passkeys, and it's effectively impossible to fall for scammers trying to get your keys since there isn't any mechanism to directly dump the private keys out.

Pretty much all the problems related to passwords are solved by passkeys, having them synced between your devices does not impact that.


A passkey is a public-private keypair strongly tied to a specific site. Sites never have access to the private key, and the key will never be presented for use on the wrong site. Those two advantages remain even if the passkey is stored in software or synced over the cloud.


That's my impression as well, and the nature of computing today /encourages/ putting passkeys into some container that means that they can be accessed from other pieces of hardware at different locations.


Don't know about you, but my passwords were already secure enough anyway.


From a practical perspective, passkeys are mostly identical to passwords where (1) secret generation is guaranteed to be strong, random, and unique; (2) they're tied to a specific site, so they can't be phished; and (3) filling is standardized and therefore ergonomic. If your passwords have those properties, passkeys aren't really an improvement for you. The main benefit to savvy consumers is that websites can trust that your passkeys are actually high quality and treat them as a primary authentication mechanism, instead of only a weak factor in an MFA system. And of course the huge huge benefit to most (unsavvy) consumers is that, you know, they're actually secure/unique and phishing-resistant.


Normal passwords can be phished, no matter how strong it is. The weak link is always a careless human. Passkeys are definitely a huge improvement for everyone, apart from the vendor-lock in which can be avoided


You can get around it, of course, but password managers are aware of the correct domain for a password and will only auto fill it into a form on the right domain. This is phishing-resistant. I'm not saying it's perfect, and I'm a big passkeys advocate. But "randomly generated password auto-filled by 1password" already meets many of the same benefits as passkeys, kinda, so long as auto-fill works on that particular website. Passkeys, in addition to stronger versions of those properties, also provide (1) ergonomics/standardization ("fill" works everywhere) and (2) sites can trust them to be strong.


Imagine using the worst password manager out there. 1Password was breached several times and even led to some people losing significant amount of money


Please do share some links to these events, because this is the first I hear of it.


Very nice, thank you!


True... but whether the ability to so is a superpowers strength or a debilitating weakness depends on both your values and point of view!


Huh.

That may explain why google search has, in the past couple of months, become so unusable for me that I switched (happily) to kagi.


Which uses Google results?


I have worked at multiple companies that vilified open source anything, while building their entire businesses on Linux, Java, Debian, and thousands of other "OSI Approved" software.

It's because, in my experience, the majority of businesses want to take but do not want to feel any obligation to give back or support.


Most businesses are started to earn money. Using free stuff while not giving anything away seems perfectly in line with those goals.


> Most businesses are started to earn money.

I thought tech startups were started to con people into thinking they might earn money.


Which was the entire purpose of Open Source, from conception, and the only way it is distinct from other licenses. Open Source is like Free Software, except you can use it without giving anything away.


> Open Source is like Free Software, except you can use it without giving anything away.

No, Open Source and Free Software are two names for essentially the same thing. The Free Software Foundation has a preference for licenses which go beyond its own Free Software Definition [0] and which are also "Copyleft" [1], but does not define Free Software in a way which requires that it also be Copyleft.

[0] https://www.gnu.org/philosophy/free-sw.en.html [1] https://www.gnu.org/licenses/copyleft.en.html


> No, Open Source and Free Software are two names for essentially the same thing.

This is not substantially true, which is why I assume you've added "essentially" in here. Open Source is Free Software, because anybody can take it and make it anything they want as long as they comply with the minimal license terms. Open Source can be proprietary, too, if somebody takes it, complies with the minimal license terms, and makes it proprietary.


> This is not substantially true, which is why I assume you've added "essentially" in here.

No, it is. The OSI Open Source definition and the FSF Free Software definition are framed differently but require substantially the same things, and for virtually every license on which both have expressed an opinion, they have cone to the same conclusion as to whether it meets each organization’s requirements.

Free Software does not require a license that prevents proprietary re-licensing, that is an additional separate concern beyond the Free Software definition (Copyleft); the FSF generally prefers copyleft licenses, but recognizes non-copyleft licenses as Free Software licenses.

You seem to under the mistaken impression that copyleft is a requirement to meet the Free Software definition, but that has never been the case.


To be clear, Open Source and Free Software aren't licenses. They are philosophies. FOSS licenses come in two major varieties - copyleft (like GPL) and permissive (like MIT). It's possible for either type of license to conform to both open source and free software philosophies. In fact, the vast majority of FOSS licenses - both copyleft and permissive - are endorsed by both camps (OSI and FSF). Also, both camps reject licenses for similar reasons - like for having proprietary terms (as in case of BSL).

The property of being able to keep changes to oneself is the property of permissive licenses, not opensource. Open source software under copyleft licenses cannot be modified and distributed while withholding changes. The inverse is applicable to FS under permissive license too.

The real difference between free software and open source is in how they treat the software. FS camp considers software as something that should give the users total freedom over the computing devices they own. The software shouldn't constrain or exploit the end user in any manner. This of course needs the source to be open.

OSS camp established open source because they realized the advantages of 'open' source, but didn't like the emphasis on freedom. That's more in line with corporate philosophy - take advantage of unaffiliated talent to increase code volume and quality, without making any commitment to user freedom. This is why many companies completely avoid the term free software. It's also easy to find 'open source' code that's very exploitative towards users, despite being open and using FSF-endorsed licenses.


I understand your point and in someway do agree that it is marketing and it is a way of differentiating themselves.

But inly to justify a higher price tag? Yes it is true they are premium products, but I don't think it's true that they're that much more expensive than similar items occupying the same marketing niche from other manufacturers.

And they are far more than an order of magnitude cheaper than even a low end set of hearing aids.

But all of that is despite the point.

Samsung, Sony, Bose,… The list goes on. I have bought high-end headphones from them all, some with some without noise cancellation. In ear, over the ear, wired and Bluetooth... the list goes on.

NOBODY has a headphone that accommodates my hearing loss except Apple.

And they started doing it years ago as a feature buried in the accessibility settings.

But they kept improving it to the point where it is now FDA approved.

"A plus point in a differentiation matrix…?"

This is the kind of action that buys customer loyalty for life. I hope you never get to experience the depth of hearing loss that many of us have and how utterly transformative this kind of technology not just can be, but IS.


Bose made a product ~10 years back called Hearphones which were far more capable than what Apple is doing here.

IIRC Jabra earbuds have had "hearing aid" features for years. They, unfortunately, don't help with single side deafness the way the Hearphones do.

Apple isn't doing anything groundbreaking here but they are doing it at a very competitive price. The airpod features also do not help with single side deafness. :(


Have they confirmed these won't support single sided deafness?

I've been waiting to buy them until I confirm support, but their support reps didn't even know.


The people I've talked to that have been using them say there's no setting for it and they don't hear anything like audio picked up on one side routed to the other earbud.


Samsung has had amplified passthrough for years.


Actually you have been able to import your audiogram for at least the last two versions of iOS (16+), no third-party app required.

But it was simply called "an accommodation". Can't call it a hearing aid until you were approved by the FDA!


Yes the problem with severe hearing loss is that hearing aids simply cannot compensate for what is no longer there.

Hearing aids are actually a a lot more complicated than just boosting frequencies. At the very simplest, these days they are wide/multi band compressors that try to balance discomfort with natural hearing, generally focusing on speech intelligibility since that is by far the most important target.

If you have severe hearing loss I would strongly recommend putting yourself in the care of a professional. Costco is a great source of probably the lowest cost versus highest quality hearing aids these days... but the reason I say "professional" is because there are so many kinds of hearing loss and they all affect your perception markedly differently.

It's a lot more than just "missing some sensitivity at some frequencies".


I know what you mean. I am in India. Hearing aids are exorbitantly priced here and there is no Costco. I will definitely go for more professional ones once I can afford them, and not just buying them, but losing them too.


Oof! How unintentionally North-American-centric of me - apologies!

But regardless of where you or anyone else is, hearing aids are eye-wateringly expensive :-( and often for rather understandable reasons.


My experience is that they serve different purposes.

I have a very nice and expensive set of ReSound hearing aids and they're fabulous at what they do, which is focus on speech and kind of on music if I set them for that.

They're also unobtrusive and easily last 18-20 hours on a charge. I forget I'm wearing them, and nobody notices that I have them.

My AirPods I use primarily for running and listening to music because they just sound unbelievably better, and they're probably fine for a concert although I haven't done that with them. But I think for long-term use every day all day it wouldn't be that comfortable or unobtrusive.

Would love to hear the experience of somebody who's trying it, though!


I don't have hearing loss, but I wear 2 pairs of AirPods Pro 2 over the course of a 10 hour day. The reason I have 2 pairs is because 1 pair only gets 5-6 hours of battery life, and I need to swap them while they recharge in the case.

Comfort? To me, very comfortable. I just leave them in there with Active Noise Canceling on all the time.

I may be showing my age, but if you remember "Get Smart", AirPods Pro 2 are like a Cone of Silence -- except they actually work.


Looking at the web, they’re also over $4500. I think the people who will most appreciate the AirPods are the ones that can now afford to put something in their ear to help their hearing.


In my experience, the rubbery Apple ear tips in the AirPods have better sound isolation and audio quality, but foam aftermarket tips better keep the AirPods from falling out.


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: