4 ms·
> passkeys are significantly more secure Blanket statements like this demonstrate a misunderstanding that "security" is just one thing in a single lineal scale
by jjav 3y ago
> passkeys are significantly more secure
Blanket statements like this demonstrate a misunderstanding that "security" is just one thing in a single lineal scale.
In reality you have to ask, secure against what? And to answer that meaningfully you need to a thorough threat model for the specific use case of person P and account A.
The same person P will have a different threat model for every account they have.
The D in STRIDE is for denial of service. Passkeys are much worse on this axis than any other solution. You need to evaluate for the specific combination (P,A) how much this matters vs. other criteria.
- joshuamorton 3y agoI don't think this is correct. It's more difficult to steal something from me than to, e.g. repeatedly force password reset emails. From a ux perspective, it may be easier to accidentally kneecap yourself with a passkey, but security wise, they're still probably better since it's harder for someone else to kneecap you.
- jesseendahl 3y agoI'm not sure why you didn't include the rest of the sentence, which made it clear that I was making a very specific comparison to password + phishable forms of 2FA. I was very clearly not making a blanket statement. Here's the full context again: passkeys are significantly more secure than the most widely-used/most popular forms of 2FA, because the most popular forms of 2FA are TOTP and SMS, and both are subject to phishing attacks. >The D in STRIDE is for denial of service. Passkeys are much worse on this axis than any other solution. You need to evaluate for the specific combination (P,A) how much this matters vs. other criteria. How are passkeys (really, WebAuthn credentials in general) any worse in terms of denial-of-service attacks than passwords? I think you're trying to make a point about specific passkey/password managers, rather than the actual credentials themselves. Is that accurate?