4 ms·
Is the consensus that we're moving towards actually passwordless futures? I've only seen WebAuthn and Touch ID replace a one-time code either sent via text or
by jez 5y ago
Is the consensus that we're moving towards actually passwordless futures?
I've only seen WebAuthn and Touch ID replace a one-time code either sent via text or looked up in Google Authenticator. I have one Yubikey for each laptop I own, and also use Touch ID / Face ID on iOS with whatever site will allow, but it's always a second factor, not a password replacement.
The weird thing is that I also use a password manager on mobile (KeePassium), and I have it configured to unlock with Face ID to autofill my usernames and passwords. So on some sites I actually do have "passwordless" log in, but in a round about way.
Not sure whether I should be eager to drop passwords entirely, whether this WebAuthn + password manager flow is the end game, or whether I should go change the config to require my master password manager password for every log in.
- dbbk 5y agoApple is moving towards this direction with iCloud Passkey. It's not ready yet but seems promising. https://sixcolors.com/post/2021/06/wwdc-2021-apple-takes-the-first-steps-to-a-password-less-future/ https://sixcolors.com/post/2021/06/wwdc-2021-apple-takes-the...
- toomuchtodo 5y agoWebAuthN + Biometrics on device (Touch/Face ID) + SSO (Sign in with Google/Apple) gets us most of the way there. Passwords are necessary if there is no guaranteed identity provider of last resort to fall back to, as the email|username/password|secret credential pair is then the identity.
- lazide 5y agoIdeally instead of a password it would be a decent sized shared secret generated for the site (1kb?)
- kingcharles 5y agoBe careful of using biometrics if you are in the USA and don't want the government to force you to open up. I don't use biometrics for that reason as this is not a hypothetical for me, I've had these issues come up in a court proceeding. https://news.bloomberglaw.com/us-law-week/compelled-biometric-access-legal-under-4th-5th-amendments https://news.bloomberglaw.com/us-law-week/compelled-biometri...
- wly_cdgr 5y agoNo, it's just marketing