5 ms·

TOTP is slowly on its way out compared to passkeys and FIDO2. It's still useful as another 2FA choice.

aryonoco 2y ago
Passkey was a great idea. A brilliant solution which could have solved authentication on the web once and for all. If only Apple, Google and Microsoft had not completely ruined it by tying it to their platforms and using it as another moat https://fy.blackhats.net.au/blog/2024-04-26-passkeys-a-shattered-dream/ https://fy.blackhats.net.au/blog/2024-04-26-passkeys-a-shatt...
- daghamm 2y ago
  "If you really want passkeys, put them in a password manager you control. But don't use a platform controlled passkey store, " I think this is a good advice in general: if you value your freedom avoid platform controlled services even if they are slightly more convenient. Btw, the platform authenticator apps are a privacy nightmare. Some are constantly reporting your activities to multiple services. You can verify this easily using an on-device proxy VPN such as NetGuard.
  - hi-v-rocknroll 2y ago
    Yup. Don't do Google Authenticator or similar. There are a couple of FOSS ones.
- rustcleaner 2y ago
  Agreed. Passkeys without QR codes to enclave devices or copy/paste strings to/from an enclave application made them DOA for true barium meal enjoyers.
dx034 2y ago
I don't like passkeys. I'm not sure if I'm using it wrong, but it feels like entering a TOTP is so much faster and easier than using passkeys. It was always easy to enter a 6 digit code and have some back-up codes printed somewhere. Passkeys might be superior in some ways, but feel much harder to use. But then again, I'm also not an average user.
- hi-v-rocknroll 2y ago
  I don't like the idea of passkeys if they cannot be backed-up or are non-portable locked away in a walled garden and possibly on stored on some corporate cloud in some unknown manner. When they can be backed-up, are portable, and have an explicit security policy, then I'll consider them. For example, Bitwarden is able to act as a passkey provider on iOS and can store the passkey secret key gunk into a password record. I tried it out on a couple of minor services that have username & password login alternatives.
- vdelitz 2y ago
  Do you still think it's easier to type in a 6 digit code that is on your mobile while you're browsing with your desktop (compared to Touch ID / Face ID with passkeys)?
  - dx034 2y ago
    Absolutely, takes me less than 10 seconds. And the process is transparent. Passkeys don't really seem to be faster.
  - kevincox 2y ago
    No, I also have my passwords synced to me desktop. my phone is usually in a different room when I am on my desktop.
deleted 2y ago
[deleted]

Passkey was a great idea. A brilliant solution which could have solved authentication on the web once and for all. If only Apple, Google and Microsoft had not completely ruined it by tying it to their platforms and using it as another moat https://fy.blackhats.net.au/blog/2024-04-26-passkeys-a-shattered-dream/ https://fy.blackhats.net.au/blog/2024-04-26-passkeys-a-shatt...

daghamm 2y ago
"If you really want passkeys, put them in a password manager you control. But don't use a platform controlled passkey store, " I think this is a good advice in general: if you value your freedom avoid platform controlled services even if they are slightly more convenient. Btw, the platform authenticator apps are a privacy nightmare. Some are constantly reporting your activities to multiple services. You can verify this easily using an on-device proxy VPN such as NetGuard.
- hi-v-rocknroll 2y ago
  Yup. Don't do Google Authenticator or similar. There are a couple of FOSS ones.
rustcleaner 2y ago
Agreed. Passkeys without QR codes to enclave devices or copy/paste strings to/from an enclave application made them DOA for true barium meal enjoyers.

dx034 2y ago

I don't like passkeys. I'm not sure if I'm using it wrong, but it feels like entering a TOTP is so much faster and easier than using passkeys. It was always easy to enter a 6 digit code and have some back-up codes printed somewhere. Passkeys might be superior in some ways, but feel much harder to use. But then again, I'm also not an average user.

hi-v-rocknroll 2y ago
I don't like the idea of passkeys if they cannot be backed-up or are non-portable locked away in a walled garden and possibly on stored on some corporate cloud in some unknown manner. When they can be backed-up, are portable, and have an explicit security policy, then I'll consider them. For example, Bitwarden is able to act as a passkey provider on iOS and can store the passkey secret key gunk into a password record. I tried it out on a couple of minor services that have username & password login alternatives.
vdelitz 2y ago
Do you still think it's easier to type in a 6 digit code that is on your mobile while you're browsing with your desktop (compared to Touch ID / Face ID with passkeys)?
- dx034 2y ago
  Absolutely, takes me less than 10 seconds. And the process is transparent. Passkeys don't really seem to be faster.
- kevincox 2y ago
  No, I also have my passwords synced to me desktop. my phone is usually in a different room when I am on my desktop.

deleted 2y ago

[deleted]