3 ms·
The “something you know” is what handicaps passwords into being weak - they have to be easy to remember. And they have to be unique per service- because the web
by snailmailman 3y ago
The “something you know” is what handicaps passwords into being weak - they have to be easy to remember. And they have to be unique per service- because the website has to know the password too and websites get hacked. Because of this people basically have to use password managers. Because otherwise they set every password to “cat123” or “spring2024” etc.
And if people are generating good passwords and storing them anyway- we may as well store digital keys instead.
My password manager is still protected by a good password + 2FA. Passkeys will be protected by this as well. On my phone there is biometric that can replace the password as well.
How secure your passkeys are comes down to how protect them. But it’s definitely an improvement over passwords.
- jksflkjl3jk3 3y agoIt's an improvement over passwords as long as two things are true: 1. Open source implementations will be indistinguishable to a 3rd party from the big tech versions (so that services can't refuse to authenticate devices that haven't been locked down), and 2. The private key can be extracted from the device by the user and backed up.
- growse 3y agoWhy is #2 important? Passkeys break the 1:1 relationship between credentials and accounts, so just register multiple passkeys. If it can be extracted, it can be stolen. Better to stick your secret material in a HSM that takes the key with it when it dies.
- timr 3y ago> My password manager is still protected by a good password + 2FA. So yeah...your second factor is an actual second factor. I completely get the argument that passkeys are an improvement for most people. But if you're already using password + pw manager + 2FA, it seems to me that you're a good bit more secure than a passkey alone.