3 ms·
> Some applications support requiring a login with either a dedicated PIN, password or biometrics upon each activity launch (e.g. Telegram, Signal). The only wa
by izacus 3y ago
> Some applications support requiring a login with either a dedicated PIN, password or biometrics upon each activity launch (e.g. Telegram, Signal). The only way for an attacker to breach that is to either scrape the phone for credential stuffing or to force me to unlock the app.
And this is how applications storing passkeys behave (e.g. 1Password). Where's the security issue here?
- mschuster91 3y ago> And this is how applications storing passkeys behave (e.g. 1Password). Where's the security issue here? Most apps don't, an attacker can do a lot of damage as long as they manage to keep the phone from activating screen lock.
- izacus 3y agoWe're talking about passkeys here, what attacker and what damage?
- mschuster91 3y agoIt's literally in the first Google result for "passkey", the Google documentation itself [1]: > Important: When you create a passkey, you opt in to a passkey-first, password-less sign-in experience. Create passkeys only on personal devices that you control. Even if you sign out of your Google Account, once you create a passkey on a device, anyone who can unlock the device can sign back into your Google Account with the passkey. [1] https://support.google.com/accounts/answer/13548313?hl=en https://support.google.com/accounts/answer/13548313?hl=en
- bryanlarsen 3y agoMost email apps and SMS apps don't, and those are the standard password reset and 2FA mechanisms.