3 ms·
> If companies don't properly salt passwords, then uniqueness and length became an issue again. Yes, that is my point. You are relying on the website to prope
by stetrain 4y ago
> If companies don't properly salt passwords, then uniqueness and length became an issue again.
Yes, that is my point. You are relying on the website to properly transmit, store, and (not) log your password.
If you do not use unique passwords, then a lapse in those practices at any site sharing the same password could compromise that password across every site you use it on.
If you type that password into an untrusted device, it could also be compromised for every site you use that password on.
With private key authentication the website never gets your private key so they can’t compromise it even if they have bad practices.
- knaik94 4y ago2FA was created to guard against every single problem you mentioned. There is no concern that Aegis, which allows personal backups, management, and encrypted cloud backups of the secret keys. PKA where I don't control the private keys doesn't seem more safe. Especially since passkeys are being marketed as a replacement to TOTP.
- stetrain 4y agoRight, so if the actual security is coming from the 2FA key and the password part is untrusted, then again why bother with the password? Also, does passkey necessarily mean you don’t control the private keys? A specific implementation like Google Password Manager may not give you access to those keys, but others like 1Password or KeePass should.