> Phishing attacks are effective, anti-phishing training doesn't work (even for technically savvy users) This is overstating the case. I've never been successf

> Phishing attacks are effective, anti-phishing training doesn't work (even for technically savvy users) This is overstating the case. I've never been successfully phished. Many people have never been successfully phished. Yes, phishing exists, but it's not an excuse for big tech companies to take away all user freedom. "Those who would give up essential Liberty, to purchase a little temporary Safety, deserve neither Liberty nor Safety." I think passkeys are fine in concept — replacing passwords with site-specific cryptographic keypairs — but the demands of the big tech companies go too far above and beyond the basic concept. For example, here are statements from the person in charge of passkeys at Apple: > If you can drop a single device in a lake and lose your credential, it’s not a passkey. Passkeys are backed up and synced across your devices to deliver a great and safe user experience, while also eliminating phishing. If it’s device-bound, it’s not a passkey. :) https://hachyderm.io/@rmondello/111188643228872151 https://hachyderm.io/@rmondello/111188643228872151 > A reminder to attendees of Authenticate and people everywhere that “device-bound passkey” is an oxymoron. Passkeys are a phishing-resistant password replacement, usable by people of all levels of technical sophistication, built in to smartphones. If a credential is not resilient to device loss, and it doesn’t sync across devices, calling it a passkey will confuse your users who will expect a durable, resilient credential. https://hachyderm.io/@rmondello/111252067006418583 https://hachyderm.io/@rmondello/111252067006418583 To me, these statements are both paternalistic and frightening. You have to understand what they mean by "synced" and "phishing-resistant". The big tech companies are taking these superfluous requirements to extreme. In essence, the attitude is that users can't be trusted with anything, and so users can't be given any control. This attitude is anathema to me. All of my passwords are SSH keys are regularly backed up to multiple storage locations, including offsite. However, I take care of backups myself, manually. I don't use any cloud syncing service. I don't trust them, for a number of reasons, I don't want to use them at all. If I have to use a cloud sync service with my credentials, that's a nonstarter. Moreover, as far as I can tell, when the big tech companies say "phishing-resistant", what they actually mean is that it should be impossible for the user to manually export and examine the private keys, because that would theoretically allow phishing. To my knowledge, FIDO still hasn't agreed on export/import methods, and it's very telling to me that they were willing to ship passkeys without this feature, which I would consider essential. My suspicion is that the "solution" they eventually come up with is some sort of "trusted" list of service providers, who can export/import between themselves without giving users direct access to the keys. There are much bigger problems in the world than phishing. We can harm ourselves in so many ways: driving a car, riding a bike, crossing the street, smoking cigarettes, drinking alcohol, eating bad food, using a chainsaw, opening the front door for strangers, or any combination of the aforementioned. Thank god that cars aren't locked down yet, though I expect that "security professionals" will demand that it be done someday for our own good. Freedom is dangerous. Yes, freedom means that users can be phished. And it means that passwords can be lost. But the absence of freedom is even more dangerous, and I'll fight to the death to preserve my freedom.