3 ms·
>Password and regular 2fa/totp are fine This might feel true, but it's factually not true. Both passwords and TOTP can be phished. In addition, passwords can
by jesseendahl 3y ago
>Password and regular 2fa/totp are fine
This might feel true, but it's factually not true.
Both passwords and TOTP can be phished. In addition, passwords can be weak, reused, and password hashes can (and are frequently) stolen and cracked in server breaches.
Passkeys are guaranteed to be strong, unique (can't be reused), strongly phishing-resistant, and there's nothing worth stealing from servers (just public keys).
Passwords and TOTP are not fine, they're both fundamentally broken when you look at them in the context of the modern internet attack landscape.
- dvngnt_ 3y agopros and cons to each approach
- jesseendahl 3y agoWhat are the pros to using phishable passwords and 2FA?
- dvngnt_ 3y agoeasier to use and harder to be locked out. years ago i was robbed in dc of my phone at night on the way to a concert. i use google voice and was able to login at cvs to contact a friend to meet me there. in 2023 i would have been locked out by not having a 2fa or phone
- ktosobcy 3y agoIf someone is ignorant and (Re)uses weak password then it's own fault. Yes, phishing can happen but it's more convoluted (and again - lack of attention). Being conscious about it brings the benefit of not relying on single point of failure...