3 ms·
Despite being an improvement, passkeys were never MFA. They substitute a single factor - your password - with one stored and managed in a safer way.
by arghwhat 4y ago
Despite being an improvement, passkeys were never MFA. They substitute a single factor - your password - with one stored and managed in a safer way.
- jonathanstrange 4y agoMy memory is definitely safer than my phone in terms of passphrase storage. So is a physical notebook.
- rekoil 4y agoYours may be, but that isn't true for the majority (dare I say >95%) of users. The problem is that people tend to simplify when forced to remember things, or re-use. A Passkey, even handled in the manner described in this post, is better for most people.
- dpatterbee 4y agoThat seems like hubris, the human is always the weakest link in the security chain.
- asimpletune 4y agoActually, I'm not even sure your memory is safer. You would have to remember hundreds if not thousands of passwords, including remembering which domain they belong to, as well as to be able to generate unique ones for every new domain you encounter for the rest of your life.
- contravariant 4y agoCould luck performing a public key handshake from memory though.
- thedougd 4y agoIf you were using webauthn as a second factor, I believe the passkey changes implemented by Apple and others means your device bound webauthn keys are now synchronized to their cloud services. That hurts and my enterprise had to halt their rollout of webauthn for MFA while we figure it out.
- crote 3y agoThe problem is that U2F/FIDO2/Webauthn was 100% used as a second-factor. Passkeys are pretty much just a variant of Webauthn, so you are now replacing token+password with solely a token.