10.12.26 | Passkeys are a trap, Total Annihilation modernized, LLM capability understanding gap widens

SPEAKER_1 (0:00)

Welcome to the Hacker News Highlights, where we explore the top 10 posts on Hacker News every day. Today, we dive into calling passkeys a trap, rebuilding total annihilation for modern computers, and widening the gap in shared LLM understanding. Let's get into it.

Title, Passkeys are a Trap, source, nonfunctional.substack.com.

The article argued that passkeys offer easy phishing-resistant login, but can reduce user control. It focused on remote attestation, which could let websites require keys tied to approved devices, operating systems, or password managers. The article warned that this could lock out Linux users and make users dependent on Apple, Google, or Microsoft. It recommended retaining alternatives such as passwords, TOTP, and physical security keys. In the comments, sentiment was divided between strong concern about vendor lock-in and strong support for passkeys security benefits. Users debated whether remote attestation posed a realistic future threat, or mainly served enterprise use cases. Supporters said passkeys blocked phishing and avoided exposing reusable secrets after server breaches, while critics said TOTP and password managers offered more portability and control. Overall, commenters favored passkeys when they remained portable and unattested, but distrusted any move toward mandatory hardware restrictions.

Title, Total Annihilation, Rebuilt for Modern Computers.

Source, Nanoloth. The project is an open source engine that re-implements the classic real-time strategy game, Total Annihilation for Modern Computers. It offers a browser demo with three missions, plus native Windows, Mac, and Linux versions that use game files from a copy the player owns. The engine adds modern graphics, online multiplayer, replay recording, mod support, and documented game formats under an MIT license. It remains in beta, so compatibility, saves, and performance can vary. In the comments, sentiment was divided between excitement for the Faithful remake and frustration with its presentation. Users debated whether an AI-assisted reverse engineering process qualified as a clean room implementation and whether it could withstand a copyright challenge. Supporters praised the open code, modern hardware support, and preservation of the original game, while critics questioned the legal basis and complained about the website's AI-generated marketing language. Overall, the project drew strong interest and faced doubts about its legality, polish, and need beside established successors such as Beyond All Reason and Zero K.

Title, The gap in shared understanding of LLM capability is widening. Source, X, formerly Twitter. The post described a widening gap between people who rarely use large language models and a small group using advanced systems for software, mathematics, and research. It estimated that billions of people saw only basic chatbots, while about 20 million professionals used frontier models for complex coding tasks. It also claimed that roughly 5,000 insiders had access to systems operating at a much larger scale, including agent swarms and automated research. The post said access, task difficulty, and the availability of clear ways to verify results explained the gap. In the comments, the sentiment was mostly skeptical of the post's dramatic claims, although users accepted that AI had become highly useful for selected coding tasks. Users debated whether advanced agents could complete large projects from prompts or still needed human design, review, and maintenance. Critics pointed to buggy tools, weak judgment, unreliable factual answers, and the growing burden of checking AI output. Supporters said strong models paired with testing, agent harnesses, and detailed specifications had already delivered major productivity gains. Overall, users concluded that AI's abilities were real but uneven, and its wider value remained unproven.

Title, NYC's Click to Cancel Rule is Now in Effect. Source, Mayor Zoran Mamdani. The Post announced a New York City rule requiring businesses to make subscription cancellations as easy as signups. Companies must clearly explain subscription terms and cancellation rights. They must also use the same method for cancellation as for signup, and cannot charge customers to return items that were provided for free. The Department of Consumer and Worker Protection will enforce the rule from October 1, 2026, with civil penalties starting at $525 and possible customer refunds. In the comments, sentiment was largely supportive, with users saying companies had deliberately made cancellations harder to protect recurring revenue. Users debated how regulators would interpret simple and equally easy, especially when signup required fewer steps than account-based cancellation. Supporters argued that a visible cancellation option in account settings would provide a clear standard, while critics wanted concrete examples to protect smaller businesses from uncertain enforcement. Overall, users viewed the rule as a needed consumer protection measure.

Title? Fingerprints are the new cookies. Source? Royfish.dv. The article explained how websites can identify devices without storing cookies. It showed how browser details, hardware behavior, graphics rendering, audio processing, fonts, language settings and network data can form a distinctive fingerprint. The post described Google's retreat from eliminating third-party cookies and warned that fingerprinting could expand tracking beyond advertising. It recommended Tor, Mulvad Browser or Brave for stronger protection, while noting that extensions often break websites or make users easier to identify. In the comments, the sentiment was mostly alarmed about privacy and the growth of surveillance-based advertising. Users debated whether fingerprinting was mainly an advertising tool or also a useful defense against fraud, spam and bots. Supporters of stronger protection said collected profiles could affect prices, jobs, credit, and access to services. While critics said fingerprints changed often and were less reliable than stable identifiers such as email addresses.