what other precautions should they take?

i’m not convinced the elections are indicative of a lot. see this article for the numbers and analysis but to make a long story short, the proletariat excluding the labor aristocracy/PMC is already fed up with bourgeois electoralism. what this means is that the PSL and DSA are not radical enough, at least not at the national level. that doesn’t mean you definitely shouldn’t be a party member/cadre in one of these organizations, just that some local branches will be better than others.

the same organization that published the other article also makes a convincing argument that the vanguard party arises, in the very early stages, from the study group; that we must form groups that are intimately familiar with marxist theory before those groups can be developed into cadres. that’s not to say that communists shouldn’t act in other movements, just that the party itself must have iron discipline and a deep understanding of marxism-leninism before it can possibly act.

well idk about you but i have the steam guard app on my phone, and it’s a pain in the ass too so it’s not that. plus, unlike TOTP, passkeys are dead simple and integrated into the OS. so i can honestly say i have no idea what you’re getting at and why it applies to passkeys as well as it applies to TOTP.

what makes passkeys any different from all the other times they have embrace, extend, extinguished? what, fundamentally, stops them from using attestation in the exact way the user described? specifically, what stops the following scenario from playing out?

1. passkey support becomes commonplace across the web
2. many websites stop using passwords due to their inherent security issues
3. most users (for brevity, say 90% or more) just use their OS to store passkeys because it’s easier
4. apple provides attestation for passkeys stored in the Secure Enclave
5. google provides attestation for whatever their business goals are
6. google refuses passkeys that aren’t attested due to their “security issues”
7. apple does the same, which has the added benefit of killing devices without a Secure Enclave
8. maybe PCI-DSS requires attested passkeys because of “security issues”
9. maybe financial institutions require attestation (similar to the ctsProfileMatch issue with GrapheneOS)
10. 90% or more of users don’t notice or care about steps 4-9
11. most of the 10% or less need to use at least one account that requires such an attested passkey
12. idk what happens with firefox but i’m sure many firefox users (including me) have encountered a website that could work with firefox but chooses not to (based on User-Agent or similar)

obviously that isn’t the only scenario one could envision but i don’t really see what makes this one unreasonable to expect