3 ms·
Does he explain the flaw anywhere? He says it's "easy to find" but apaprently he can't find it. https://mastodon.laurenweinstein.org/@lauren/111211489395997661
by gowld 3y ago
Does he explain the flaw anywhere?
He says it's "easy to find" but apaprently he can't find it.
https://mastodon.laurenweinstein.org/@lauren/111211489395997661 https://mastodon.laurenweinstein.org/@lauren/111211489395997...
Why is "weak device password" a reason to avoid passkeys, when those users presumably have weak service passwords as well?
- panarky 3y agoIt seems like his argument is that putting access to valuable accounts on your phone is a bad practice, because if your phone is stolen at the club after the thief watched you enter your code, then the thief can get at your banking, brokerage, crypto, password manager, etc. But that argument doesn't address how passkeys somehow make that worse. Sure, if you don't want your valuable stuff stolen, don't put it on your phone. But that's a problem whether you use passkeys or passwords or passwordless links sent to your email or SMS.
- pseudalopex 3y agoThe argument for passkeys is they make it better. Not not worse.
- passkeyspoor 3y agoThe point is that the phone with a crappy 4 digit pin can be used to authenticate everything on every device the user owns that uses passkeys. It's a one stop shop of failure.
- Dlanv 3y agoPhones are already that way. They have text messages and email which is enough to log into almost any service.
- passkeyspoor 3y agoYes, that's also bad. They're both bad. Passkeys are worse.
- taeric 3y agoThe argument is that without your phone, you likely have no recourse to stop the attack. Since your passkey on the phone is what controls your access, now.