4 ms·
Disagree. Accessing my phone will only get you so far. If you manage to crack my password manager then you'll have many, but not all the keys to my kingdom. For
by oooyay 3y ago
Disagree. Accessing my phone will only get you so far. If you manage to crack my password manager then you'll have many, but not all the keys to my kingdom. For instance, there's a lot of randomly generated passwords in there, but you won't have access to my disk encryption keys for instance. Those are also different by machine.
Security will never be automated to be fool proof; there is a modicum of thought the user needs to put into their security profile.
- krupan 3y agoyour phone, but the complaint in the original article is about those who don't use great security practices, which is most of us. Passkeys limit the attack surface to just your phone. With passkeys, attackers can't get your password (that regular people reuse everywhere) from some weak website or from phishing and then use that to impersonate you. We must go to something like passkeys.
- croes 3y agoPasskeys makes your phone the only target, without your phone you can't access anything but with your phone you can access everything.
- oooyay 3y agoThat's fair; I just don't know that security will ever get to a point that's both easy for everyone and secure, but maybe I'm being a pessimist.
- krupan 3y agoIt will never get to that point completely, but we can definitely make strides towards it
- lbhdc 3y agoGP seemed to be talking about physical access. How would passkeys stop them if they are are in physical possession of the device and can unlock it? It doesn't seem passkeys protect you more here.
- krupan 3y agoI was trying to acknowledge that. Passkeys, passwords, same result if someone has physical access to your phone. The improvement is that passwords don't require physical access to your phone, there are other ways to steal those like with phishing or hacking a website that has a copy of a password that you reused. Passkeys solve that problem.