3 ms·
Remember when the internet of military contractors got exfiltrated because the CI/CD pipeline of a firewall vendor got breached? Guess what their password was:
by cookiengineer 1y ago
Remember when the internet of military contractors got exfiltrated because the CI/CD pipeline of a firewall vendor got breached?
Guess what their password was: solarwinds123
So yes, I am in favor of passkeys everywhere because humans are bad at realizing their operational risks when they start creating an account and haven't even used it yet.
Without password managers, humans tend to reuse their passwords, which makes one breach a breach of all accounts. Humans are also bad at remembering passwords, so time based recreation of passwords will always lead to the month or week or iteration as a suffix.
And that's the actual problem that can be prevented with passkeys (or MFA that is not based on sending SMS or emails which are unencrypted as a transport channel).
But I agree with the author's implied sentiment: export/import should work between password managers and be required by law, because currently Microsoft's authenticator workflow is pretty useless if you can reset the passkeys via email ownership anyways.
- sam_lowry_ 1y ago> when they start creating an account and haven't even used it yet. This is a niche case that is already handled more or less properly by the BigTech.
- cookiengineer 1y agoWhy is this a niche use case? Are you suggesting that people will change their passwords after they created an account and realize that it needs a better level of security? Because I would argue that Collection #1-#6 proved the exact opposite: Humans reuse passwords, and invent sequences or suffixes when forced to change it.
- JohnFen 1y ago> Remember when the internet of military contractors got exfiltrated because the CI/CD pipeline of a firewall vendor got breached? Guess what their password was: solarwinds123 So I get to be punished because of incompetent military contractors?
- cookiengineer 1y agoYou seem to not even read my argument. Opsec is about reducing risk from one potential breach to not affect other parts of your life. Assuming you never made a mistake in your online life is a foolish assumption.
- JohnFen 1y agoI read it. My point isn't that this is bad. My point is that it's a solution that imposes a large enough burden on at least some people that it's not automatically an unambiguous win. For me, it represents a large enough burden that if it were forced on me, I'd just stop using the web sites doing so. Which, you have to admit, is the most secure option. All security measures represent a tradeoff, and sometimes that tradeoff is not worth it.
- apple4ever 1y ago> My point is that it's a solution that imposes a large enough burden on at least some people that it's not automatically an unambiguous win. That to me is the problem with Passkeys. They are not an unambiguous win.