3 ms·

Passkeys, which are getting closer and closer to prime time. If you think about it, key-based auth is already highly recommended and utilized in many scenarios

Passkeys, which are getting closer and closer to prime time. If you think about it, key-based auth is already highly recommended and utilized in many scenarios (like SSH, signing data, certificates, token authentication for use between servers, etc.)… this just makes that accessible to users. The vast majority of people don’t even use a password manager, and use variations of the same password everywhere. That’s really unsafe. Passkeys are always unique. Another thing is phishing. The big issue with phishing is how easy it is to make a website or popup look identical to a different service. And if it’s believable enough and the domain is hidden, you’ll put in your real password. Passkeys fix that because they only work on the site in question. No danger of leaking it to someone else! So this will make some huge improvements in security. Basically taking care of the very basic things most people don’t do. Password managers solve many of the same problems, but are potentially less convenient in some scenarios. (Obtuse password requirements, password field not working with paste, etc. it’s just a 3rd party workaround.) But like you said, the social aspect is still a huge problem.

josephcsible 4y ago
> if [...] the domain is hidden When is that?
taeric 4y ago
Passkeys aren't immune to phishing. And they are susceptible to being lost. I say that as someone with two. Worse, they aren't accepted everywhere. And often places only let you have one registered. :( So, yes, I agree that they are a solution. I don't know that I feel much safer using one, though. And, at large, I can see how they are not much different to passwords. Just ones that you can't speak others easily.
- sdfhbdf 4y ago
  Are you sure you’re referring to passkeys like passkeys.dev? The new Web standard? It builds upon WebAuthn and physical keys but is slightly different and on track to be supported by major platforms. Sounds like you’re referring to something like YubiKey, it’s hard to lose device associated passkeys. How would you phish it? The challenge response mechanism contains the requesting origin so it’s berry difficult to phish it out given up to date browser.
  - taeric 4y ago
    You are correct I meant yubikeys. I'll have to look a bit more at this new thing. I confess right now it isn't impressing me. Is sounding too magical in a "it just works" way. With no real explanation of how. It hurts that it sounds tied to a device. I stopped using some authenticator apps after I lost access to a ton of stuff when my phone broke. As for phishing, this seems like a mitm would still work better than you'd expect. Folks get really good at ignoring warnings and such. Especially under duress.

josephcsible 4y ago

> if [...] the domain is hidden When is that?

taeric 4y ago

Passkeys aren't immune to phishing. And they are susceptible to being lost. I say that as someone with two. Worse, they aren't accepted everywhere. And often places only let you have one registered. :( So, yes, I agree that they are a solution. I don't know that I feel much safer using one, though. And, at large, I can see how they are not much different to passwords. Just ones that you can't speak others easily.

sdfhbdf 4y ago
Are you sure you’re referring to passkeys like passkeys.dev? The new Web standard? It builds upon WebAuthn and physical keys but is slightly different and on track to be supported by major platforms. Sounds like you’re referring to something like YubiKey, it’s hard to lose device associated passkeys. How would you phish it? The challenge response mechanism contains the requesting origin so it’s berry difficult to phish it out given up to date browser.
- taeric 4y ago
  You are correct I meant yubikeys. I'll have to look a bit more at this new thing. I confess right now it isn't impressing me. Is sounding too magical in a "it just works" way. With no real explanation of how. It hurts that it sounds tied to a device. I stopped using some authenticator apps after I lost access to a ton of stuff when my phone broke. As for phishing, this seems like a mitm would still work better than you'd expect. Folks get really good at ignoring warnings and such. Especially under duress.