Apple’s passkey and keychain backup design is under sharp criticism for removing practical recovery options and tying encrypted credentials to hardware. There are no automatic, versioned backups for passkeys; syncing via iCloud does not protect against human error, bugs, or attacks; Time Machine backups cannot be restored on the same Mac without signing into iCloud; and decrypted key material is bound to the Secure Enclave so copying login.keychain-db to another Mac or restoring from a clone does not yield usable secrets. The Passwords app can export passkeys only to third-party password managers on the same Mac and cannot export passkeys for Apple services, while passkey and sign‑in handling has additional restrictions for shared items and Sign In with Apple.
Multiple testers and developers confirm the change introduced in macOS 26.4 / Tahoe and persisting into macOS 27 Golden Gate: Keychain files copied between machines or VMs refuse to unlock because the required keys live in the source device’s Secure Enclave. Migration Assistant transfers work only when the old Mac acts as a live server and can decrypt and re-encrypt entries during migration; manual cloning, Target Disk Mode, or hardware replacement can render login keychains irrecoverable even from backups. The practical consequence is catastrophic data loss for stored passwords, certificates, developer keys, and app credentials unless users deliberately verify their login keychain contents and accept dependence on Apple’s migration and iCloud mechanisms.
Summary generated by AI from the linked article. hn.today is not affiliated with Hacker News or Y Combinator.
OpenAI disclosed that its AI models interacted with several U.S. government websites, including the SEC and Census Bureau, during testing. The company found no evidence of security breaches or access to nonpublic information. (securityweek.com)
Bustikiller stopped using AI in a FOSS project to avoid drama, but continued using it at work, which he found made him lazier and less skilled. He realized that reliance on AI led to losing control over code quality and understanding, raising concerns about dependency and transparency in development. (blog.bustikiller.com)
EU member states are considering a proposal that would prioritize AI companies' profits over Europeans' data protection rights, allowing broad use of personal data for AI development. Critics argue this amounts to a digital expropriation of Europeans' privacy rights, facilitated by leaked documents and support from major EU nations. (noyb.eu)
Floci allows developers to run AWS, Azure, GCP, and OCI cloud services locally in milliseconds without credentials or cloud accounts. It enables AI agents to build, test, and verify cloud code quickly and safely on a local emulator that mimics real cloud environments. (floci.io)
CAPTCHAs often rely on cultural knowledge that varies by country, making them ineffective at proving someone is human globally. They tend to assume familiarity with American symbols, coins, and products, which can unfairly exclude non-Americans. (shkspr.mobi)
The tool checks the safety of PostgreSQL migration scripts by analyzing SQL statements in a browser environment without sending data externally. It helps identify potential risks in schema changes before executing them. (safenotsafe.dev)
Today's best Hacker News stories, summarized and screenshotted, one email a day.