5 ms·

We really need better standards for MFA. Probably we should have a legal definition of MFA and SMS should be described as 2SA (Two-step authentication) on par w

We really need better standards for MFA. Probably we should have a legal definition of MFA and SMS should be described as 2SA (Two-step authentication) on par with email or whatever. While MFA should be restricted to actual Yubikeys and other hardware certificate based things. I'd also say people shouldn't be able to advertise MFA if they only support a single token per method.

toomuchtodo 3y ago
https://www.cisa.gov/sites/default/files/publications/fact-sheet-implementing-phishing-resistant-mfa-508c.pdf https://www.cisa.gov/sites/default/files/publications/fact-s... ("CISA.gov: Implementing Phishing-Resistant MFA") https://passkeys.dev/ https://passkeys.dev/ https://passkeys.directory/ https://passkeys.directory/
hot_gril 3y ago
It's not reasonable to expect people to have Yubikeys. iPhone Keychain is about as good as it'll get realistically, and that somewhat relies on hardware security.
- xyst 3y ago
  "iPhone Keychain" - no thanks, I'll stick with a non-vendor specific provider. I am trying to escape that awful ecosystem, not dig myself further in.
  - hot_gril 3y ago
    The option of Yubikeys is fine as long as the basic 1P thing is painlessly usable too.
  - overstay8930 3y ago
    you know its trival to export, right? There's nothing more secure than Keychain if you're in the Apple ecosystem. Nothing gets more scrutiny from the entire industry, at least.
    - recursive 3y ago
      The "ecosystem" comes as non-several package. Like for instance, my pet issue "if" I'm in the ecosystem, I'd have to give up my headphone jack. And all the rest of it. The "if" is probably most of the problem.
      - hot_gril 3y ago
        Indeed the jack removal was the first thing that ever made me think of switching. That was a scam.
      - acheron 3y ago
        > I’d have to give up my headphone jack Not to mention your 3.5” floppy drive!
        recursive 3y ago
        I don't really have much use for that. Usb drives totally replace them for my use cases. Do you understand the advantages that headphone jacks have? If not, you could start there.
        hot_gril 3y ago
        If jack is floppy drive then Bluetooth is wax cylinder
    - lxgr 3y ago
      If you know of a way to export a passkey from iCloud Keychain to a non-Apple device, please do share it! Otherwise I'd call that lock-in as well.
      - hot_gril 3y ago
        It's easy on a Mac since Safari has a CSV export feature. No such thing on an iPhone.
        3y ago
- lukeschlather 3y ago
  Actually I maybe misspoke and I might go further than that and say that services shouldn't be allowed to make any requirements about how hardware tokens work. This means if someone wants to use a software token that should be supported. And also I think this is why the passkey standard is bad, it sets rigid hardware requirements and the manufacturers will use this to drive planned obsolescence. If Apple and Microsoft have their way we will throw away $1000+ phones and laptops because someone found an exploit in the TPM that requires physical access.
  - hot_gril 3y ago
    Yes, that and WEI

toomuchtodo 3y ago

https://www.cisa.gov/sites/default/files/publications/fact-sheet-implementing-phishing-resistant-mfa-508c.pdf https://www.cisa.gov/sites/default/files/publications/fact-s... ("CISA.gov: Implementing Phishing-Resistant MFA") https://passkeys.dev/ https://passkeys.dev/ https://passkeys.directory/ https://passkeys.directory/

hot_gril 3y ago

It's not reasonable to expect people to have Yubikeys. iPhone Keychain is about as good as it'll get realistically, and that somewhat relies on hardware security.

xyst 3y ago
"iPhone Keychain" - no thanks, I'll stick with a non-vendor specific provider. I am trying to escape that awful ecosystem, not dig myself further in.
- hot_gril 3y ago
  The option of Yubikeys is fine as long as the basic 1P thing is painlessly usable too.
- overstay8930 3y ago
  you know its trival to export, right? There's nothing more secure than Keychain if you're in the Apple ecosystem. Nothing gets more scrutiny from the entire industry, at least.
  - recursive 3y ago
    The "ecosystem" comes as non-several package. Like for instance, my pet issue "if" I'm in the ecosystem, I'd have to give up my headphone jack. And all the rest of it. The "if" is probably most of the problem.
    - hot_gril 3y ago
      Indeed the jack removal was the first thing that ever made me think of switching. That was a scam.
    - acheron 3y ago
      > I’d have to give up my headphone jack Not to mention your 3.5” floppy drive!
      - recursive 3y ago
        I don't really have much use for that. Usb drives totally replace them for my use cases. Do you understand the advantages that headphone jacks have? If not, you could start there.
      - hot_gril 3y ago
        If jack is floppy drive then Bluetooth is wax cylinder
  - lxgr 3y ago
    If you know of a way to export a passkey from iCloud Keychain to a non-Apple device, please do share it! Otherwise I'd call that lock-in as well.
    - hot_gril 3y ago
      It's easy on a Mac since Safari has a CSV export feature. No such thing on an iPhone.
      - 3y ago
lukeschlather 3y ago
Actually I maybe misspoke and I might go further than that and say that services shouldn't be allowed to make any requirements about how hardware tokens work. This means if someone wants to use a software token that should be supported. And also I think this is why the passkey standard is bad, it sets rigid hardware requirements and the manufacturers will use this to drive planned obsolescence. If Apple and Microsoft have their way we will throw away $1000+ phones and laptops because someone found an exploit in the TPM that requires physical access.
- hot_gril 3y ago
  Yes, that and WEI