4 ms·

And people complain about Apple being paternalistic. If you’re already saving passwords in an app, you’re being more secure than most users. A forced move to p

And people complain about Apple being paternalistic. If you’re already saving passwords in an app, you’re being more secure than most users. A forced move to passkeys seems nuts when not all systems support them yet. I’m also still concerned that passkeys seems more likely to fail the average user when they break or lose a device, compared to a decent password.

burnt-resistor 1y ago
Both are technofeudal corporations and hostile to users' rights. Microsoft is just rapidly getting even worse lately.
Groxx 1y ago
Also next to impossible to write down to give to someone else. This (or by phone) is how I've transferred: all family accounts, all small community accounts, some business accounts, many friend-shared accounts, and it's also how some people ensure accounts can be accessed if they die. It's not a small problem.
jrockway 1y ago
Yeah, I think people will lose their passkeys a lot. I think companies are happy to provide another service ("passkey syncing") that you will pay for for life. Back In The Day you could be a freeloader by remembering your passwords like a nerd. No longer. The loophole is closed! That said, passwords are actually so bad that anything would be an improvement over them. While a stealable passkey vault sync'd to your malware-infested Windows laptop is not ideal for security, it's sure better than typing your bank password into your favorite forum because you don't understand that website administrators can see your password when you type it on their site. (Not to mention phishing.)
- jeroenhd 1y ago
  Apple, Google, and Microsoft already do passkey sync for free. They don't do exports, though. However, there are various third party solutions for synching passkeys that aren't tied to your computer manufacturer. I don't think passkeys are going to replace passwords any time soon, and I don't think freeloaders are even part of the equation here. You can share a passkey through Bitwarden just as easily as you can share a password. Freeloaders already need to jump through hoops to share passwords and even then they're getting off easy; if streaming companies actually cared about catching freeloaders, they could stop the practice all together. What they're doing now is just signalling them that you're not supposed to and adding very minor annoyances to the mix.
  - jrockway 1y ago
    Only in their own ecosystem, though, right? I use Windows and an iPhone; nothing syncs. I use 1password instead.
    - blokey 1y ago
      Would iCloud for Windows help sync things for you? https://support.apple.com/en-gb/guide/icloud-windows/icw2babf5e03/icloud https://support.apple.com/en-gb/guide/icloud-windows/icw2bab... After you set up iCloud for Windows, you can use iCloud Passwords to access your passwords in Google Chrome or Microsoft Edge using a browser extension. You can also manage your passwords in the iCloud Passwords app.
smolder 1y ago
They used to complain about that 10 years ago, but apple was just ahead of it's time. Microsoft saw the light and is racing down that path. Soon enough, no computer without user-defeating secret logic and remote ownership will be allowed to interact with important networked applications. Linux users will either need a tainted linux variant or not have access to banking, streaming (already a problem), games, and so on.
- hansvm 1y ago
  And still, the entire bank account is still vulnerable to a $15 silent borrowing of your phone number for a day, bypassing all normal protections. The system is only harder to access for the rightful owner.
  - krior 1y ago
    How would that attack work?
    - VoidWhisperer 1y ago
      SIM Swap attacks are what they are referring to, I think.
      - m3galinux 1y ago
        Or SS7 attack to intercept SMS messages, no SIM swap required.
        xyst 1y ago
        Doesn’t this require physical access to a compromised mobile network?
        chainingsolid 1y ago
        Requires that someone has physical access, that they can then sell digital access to.
RataNova 1y ago
Until recovery and multi-device support are seamless across ecosystems, forcing this kind of shift just adds friction

burnt-resistor 1y ago

Both are technofeudal corporations and hostile to users' rights. Microsoft is just rapidly getting even worse lately.

Groxx 1y ago

Also next to impossible to write down to give to someone else. This (or by phone) is how I've transferred: all family accounts, all small community accounts, some business accounts, many friend-shared accounts, and it's also how some people ensure accounts can be accessed if they die. It's not a small problem.

jrockway 1y ago

Yeah, I think people will lose their passkeys a lot. I think companies are happy to provide another service ("passkey syncing") that you will pay for for life. Back In The Day you could be a freeloader by remembering your passwords like a nerd. No longer. The loophole is closed! That said, passwords are actually so bad that anything would be an improvement over them. While a stealable passkey vault sync'd to your malware-infested Windows laptop is not ideal for security, it's sure better than typing your bank password into your favorite forum because you don't understand that website administrators can see your password when you type it on their site. (Not to mention phishing.)

jeroenhd 1y ago
Apple, Google, and Microsoft already do passkey sync for free. They don't do exports, though. However, there are various third party solutions for synching passkeys that aren't tied to your computer manufacturer. I don't think passkeys are going to replace passwords any time soon, and I don't think freeloaders are even part of the equation here. You can share a passkey through Bitwarden just as easily as you can share a password. Freeloaders already need to jump through hoops to share passwords and even then they're getting off easy; if streaming companies actually cared about catching freeloaders, they could stop the practice all together. What they're doing now is just signalling them that you're not supposed to and adding very minor annoyances to the mix.
- jrockway 1y ago
  Only in their own ecosystem, though, right? I use Windows and an iPhone; nothing syncs. I use 1password instead.
  - blokey 1y ago
    Would iCloud for Windows help sync things for you? https://support.apple.com/en-gb/guide/icloud-windows/icw2babf5e03/icloud https://support.apple.com/en-gb/guide/icloud-windows/icw2bab... After you set up iCloud for Windows, you can use iCloud Passwords to access your passwords in Google Chrome or Microsoft Edge using a browser extension. You can also manage your passwords in the iCloud Passwords app.

smolder 1y ago

They used to complain about that 10 years ago, but apple was just ahead of it's time. Microsoft saw the light and is racing down that path. Soon enough, no computer without user-defeating secret logic and remote ownership will be allowed to interact with important networked applications. Linux users will either need a tainted linux variant or not have access to banking, streaming (already a problem), games, and so on.

hansvm 1y ago
And still, the entire bank account is still vulnerable to a $15 silent borrowing of your phone number for a day, bypassing all normal protections. The system is only harder to access for the rightful owner.
- krior 1y ago
  How would that attack work?
  - VoidWhisperer 1y ago
    SIM Swap attacks are what they are referring to, I think.
    - m3galinux 1y ago
      Or SS7 attack to intercept SMS messages, no SIM swap required.
      - xyst 1y ago
        Doesn’t this require physical access to a compromised mobile network?
        chainingsolid 1y ago
        Requires that someone has physical access, that they can then sell digital access to.

RataNova 1y ago

Until recovery and multi-device support are seamless across ecosystems, forcing this kind of shift just adds friction