4 ms·

The main benefit you get is that you don't have to type in 2FA codes anymore since 2FA was built to solve credential stuffing / password reuse which isn't a pro

The main benefit you get is that you don't have to type in 2FA codes anymore since 2FA was built to solve credential stuffing / password reuse which isn't a problem on Passkeys. It is nice to just have a one click login for things.

aaomidi 1y ago
Yes but also depends on how the end system is configured. You can require Google IDP to still have 2FA with passkeys.
Someone1234 1y ago
First-generation 2FA solved basic credential compromise issues using code-based methods (e.g. TOTP/HOTP). Modern 2FA (e.g. push notifications) adds authentication integrity, phishing resistance, and user validation through real-time, context-aware approvals. Passkeys replace passwords and also render basic TOTP/HOTP-based 2FA unnecessary. However, they do not replace modern, push-based 2FA, which may still be needed in higher-assurance or enterprise scenarios. Regardless personally I am waiting for full FIDO Alliance interoperability/sync, so I'm not locked into a single password manager. I've already had to migrate password managers after my choice was taken over by Private Equity.
- esseph 1y ago
  Pushed based is also insecure, why would you want that if you have a passkey unlocked by a pin+touch? That's context aware, requires something you have and something you know.
- Almondsetat 1y ago
  Push notifications don't protect against realtime phishing attacks
- crote 1y ago
  The main benefit of FIDO2 is origin verification: it is literally impossible to authenticate on a phishing website, as on a phishing website the browser won't send valid origin data to your token. Push notification based 2FA can never obtain that level of security.
  - Afty 1y ago
    What happens if the origin changes? Suppose I have a passkey for Twitter.com, and now the site is named X.com? Is there some way to migrate the passkey?
- Harvesterify 1y ago
  Push notifications are vulnerable to MFA fatigue/"bombing" attacks, that are used in the real world, cf. this breach on Uber: https://www.darkreading.com/cyberattacks-data-breaches/uber-breach-external-contractor-mfa-bombing-attack https://www.darkreading.com/cyberattacks-data-breaches/uber-...
- AlphaCerium 1y ago
  > I've already had to migrate password managers after my choice was taken over by Private Equity. do you remember which one? hope it wasn't bitwarden :/
adiabatty 1y ago
I have one-click login with 2FA codes stored in 1Password. And 1Password will still let me export my crazy-long password and TOTP code to a plain text file if I want to switch to a different password manager (of course, I’ll have to do some planning beforehand to make sure that the export destination doesn’t get picked up by my backup software).

aaomidi 1y ago

Yes but also depends on how the end system is configured. You can require Google IDP to still have 2FA with passkeys.

Someone1234 1y ago

First-generation 2FA solved basic credential compromise issues using code-based methods (e.g. TOTP/HOTP). Modern 2FA (e.g. push notifications) adds authentication integrity, phishing resistance, and user validation through real-time, context-aware approvals. Passkeys replace passwords and also render basic TOTP/HOTP-based 2FA unnecessary. However, they do not replace modern, push-based 2FA, which may still be needed in higher-assurance or enterprise scenarios. Regardless personally I am waiting for full FIDO Alliance interoperability/sync, so I'm not locked into a single password manager. I've already had to migrate password managers after my choice was taken over by Private Equity.

esseph 1y ago
Pushed based is also insecure, why would you want that if you have a passkey unlocked by a pin+touch? That's context aware, requires something you have and something you know.
Almondsetat 1y ago
Push notifications don't protect against realtime phishing attacks
crote 1y ago
The main benefit of FIDO2 is origin verification: it is literally impossible to authenticate on a phishing website, as on a phishing website the browser won't send valid origin data to your token. Push notification based 2FA can never obtain that level of security.
- Afty 1y ago
  What happens if the origin changes? Suppose I have a passkey for Twitter.com, and now the site is named X.com? Is there some way to migrate the passkey?
Harvesterify 1y ago
Push notifications are vulnerable to MFA fatigue/"bombing" attacks, that are used in the real world, cf. this breach on Uber: https://www.darkreading.com/cyberattacks-data-breaches/uber-breach-external-contractor-mfa-bombing-attack https://www.darkreading.com/cyberattacks-data-breaches/uber-...
AlphaCerium 1y ago
> I've already had to migrate password managers after my choice was taken over by Private Equity. do you remember which one? hope it wasn't bitwarden :/

adiabatty 1y ago

I have one-click login with 2FA codes stored in 1Password. And 1Password will still let me export my crazy-long password and TOTP code to a plain text file if I want to switch to a different password manager (of course, I’ll have to do some planning beforehand to make sure that the export destination doesn’t get picked up by my backup software).