3 ms·
> people don’t actually understand how passwords work either (password hashing etc.) Those are implementation details that they need not to care about. Passwor
by TeMPOraL 2y ago
> people don’t actually understand how passwords work either (password hashing etc.)
Those are implementation details that they need not to care about. Password hashing is about mitigating the consequences of you the account provider screwing up. I know, technology and finance are special, in that the more a service provider fucks up, the more it is your fault somehow (see: "identity theft") - but most people didn't get that memo.
- jesseendahl 2y agoIndeed — I am arguing that 99% of normal everyday folks using passkeys also do not need to understand passkeys.
- TeMPOraL 2y agoDifference is, passwords break like normal things people are used to. Passkeys break like some alien technology from fifth dimension, there is no reference to everyday experience for the one thing people need to understand, which is how to not mishandle auth on their end, and how to recover when they invariably do mishandle it.