4 ms·
> Any actively used e-mail address that is older than a few years will be listed on haveibeenpwned. Which is why everyone needs to switch to passkeys. It's cra
by udev4096 1y ago
> Any actively used e-mail address that is older than a few years will be listed on haveibeenpwned.
Which is why everyone needs to switch to passkeys. It's crazy that we still use passwords for authentication
- ls612 1y agoDon't passkeys still have tons of vendor lock-in attached? A password I can put into any password manager I want and transfer it to a different password manager and neither the password manager company nor the company for which I made the account is any the wiser.
- taeorg74 1y agoSome PW managers can store a passkey, but when tied to a device, if the device is compromised then all of your accounts are unless you're also using a yubikey or third device 2fa
- udev4096 1y agoI was talking about a self-hosted OIDC provider to avoid a vendor lock in. You can transfer passkeys from vaultwarden to any other password managers
- ls612 1y agoI could be wrong or misinformed, but I thought part of the passkey spec included some kind of remote attestation mechanism to facilitate vendor lock-in (ie Google could say its account passkey is only valid if stored in Chrome's password manager, to make up a silly example).