2 ms·
I'm not against using a passkey as a single factor, and having fallbacks. It's reasonable if you can reliably attach that key to a physical device, so the devic
by bayindirh 3y ago
I'm not against using a passkey as a single factor, and having fallbacks. It's reasonable if you can reliably attach that key to a physical device, so the device can't be impersonated.
I don't think that we should target MIL-xxx standards for daily use, but my security is comparably important to me as military's missile codes are important to them.
So, I don't want my passkey-based services to have a security theater in the name of convenience. There should be some friction to force a baseline security.
- p0seidon 3y agoAgree, but I think in a B2C context, you need convenience first; then security can follow.
- bayindirh 3y agoI think it depends. Banking, primary e-mails, etc. are extremely important systems today, and they should bias towards security. Other platforms where we talk can take a more balanced approach, and more casual sites can lean towards convenience, if you ask me.
- joncrocks 3y agoIndeed, the problem with lots of fallbacks is that they can invalidate user's requests for higher security. Security can sometimes end up being only as strong as the weakest link. Make the fallback too lax and you might as well not bother with 2FA/Passkeys at all.