4 ms·

The key to the passwordless future is in the widespread use of devices that use biometrics for local authentication of the user and have a Secure Enclave or sim

The key to the passwordless future is in the widespread use of devices that use biometrics for local authentication of the user and have a Secure Enclave or similar hardware that can provide better guarantees, along with built-in support for WebAuthn. These devices will also become the ones responsible for setting up the same login on other devices. These would work in a way similar to, for example, how Apple or Okta handle two factor authentication by sending a push notification to existing devices registered to the account. Since most people wouldn’t have a Yubikey (or multiple Yubikeys for backups) and since most people own one smartphone, the fallback for account recovery — when their smartphone breaks or is lost — would be the weakest link.

nly 5y ago
Biometrics on mobile are almost always a fast path to bypass a PIN/password screen, so I'm not convinced. Yubikeys are a pita as well. I have an NFC one I use for authentication on my laptop, and a second in case I lose it. Registering both tokens on some websites is just not possible, and remembering to register both, at sites where it is, is easily forgotten. The problem with biometrics is they're persistent where you don't want them to be (you can't change them) and not where you do (after you wipe your phone, or buy a new one) I recently wiped and reinstalled my phone, and reinstalled about 10 bank/finance/credit card apps. Not one of them requires much more than some lame security questions, card details and SMS verification to get up and running. Fingerprint login is just a convenience. Passwords will still be a thing in 50 years.
southerntofu 5y ago
Biometrics are the worst passwords: easy to get without your consent, and hard to change. Biometric identification is only an "improvement" for political police across the globe: it makes people ok to give their fingerprints away, and opens new (back)doors into people's devices. Fingerprint readers are Stalin's dreams come true.

nly 5y ago

Biometrics on mobile are almost always a fast path to bypass a PIN/password screen, so I'm not convinced. Yubikeys are a pita as well. I have an NFC one I use for authentication on my laptop, and a second in case I lose it. Registering both tokens on some websites is just not possible, and remembering to register both, at sites where it is, is easily forgotten. The problem with biometrics is they're persistent where you don't want them to be (you can't change them) and not where you do (after you wipe your phone, or buy a new one) I recently wiped and reinstalled my phone, and reinstalled about 10 bank/finance/credit card apps. Not one of them requires much more than some lame security questions, card details and SMS verification to get up and running. Fingerprint login is just a convenience. Passwords will still be a thing in 50 years.

southerntofu 5y ago

Biometrics are the worst passwords: easy to get without your consent, and hard to change. Biometric identification is only an "improvement" for political police across the globe: it makes people ok to give their fingerprints away, and opens new (back)doors into people's devices. Fingerprint readers are Stalin's dreams come true.