3 ms·
Counterpoint: it’s miles worse than FIDO/WebAuthn, which most hard keys and modern OSes support. Asking users to install a browser plugin is a disaster waiting
by infotogivenm 4y ago
Counterpoint: it’s miles worse than FIDO/WebAuthn, which most hard keys and modern OSes support. Asking users to install a browser plugin is a disaster waiting to happen for most users. Phishing of cryptocurrency hardware wallets happens all the time, but it is impossible to phish a Passkey. The reason a browser plugin is required is because these devices are made to transact on a blockchain, rather than open APIs intended for domain authentication.
Cryptocurrency wallets are horrible for normal security features that do not involve blockchains.
- idiotsecant 4y agoI think the fact that cryptocurrency wallets with millions of dollars still exist and are protected by these wallets is evidence that security is manageable. Proof is in the pudding.
- infotogivenm 4y agoYeah, file-based keys managing millions of dollars exist in the crypto space too. “Manageable” does not mean “good”. The real pudding is this: hardware wallet users fall prey to phishing scams all the time and lose their life savings. It’s a horrible design for an auth system. There are so many UX reasons why you would never want to conflate a login token with a key that can mathematically and instantaneously eviscerate your life savings. But to put it simply; there’s no way anyone’s grandma can use this system, wherein with something like browser Passkeys she has a chance.