6 ms·

>"I’d rather granny needs to visit the bank to get access to her account again, than someone phishes her and steals all her money." More like abuelita gets rob

>"I’d rather granny needs to visit the bank to get access to her account again, than someone phishes her and steals all her money." More like abuelita gets robbed at gunpoint and made to unlock and clear out her bank account, then has no recourse at home because her device was taken. I live in a third world country and even 2FA simply isn't viable for me due to how frequent phone robberies are. I've had to do the process once and it was a nightmare, whereas with passwords I can just log into Bitwarden wherever and I'm golden

chimeracoder 1y ago
> More like abuelita gets robbed at gunpoint and made to unlock and clear out her bank account, then has no recourse at home because her device was taken. You are describing the current status quo, without passkeys. This is already possible. Well, except maybe for the "without recourse" part, because there are some legal and policy avenues available for dealing with this situation.
- mvieira38 1y ago
  The without recourse is the part that matters... With passkeys or 2FA she's at risk of having to wait a day or more to go to the physical location (if there even is one, digital banks are huge in Latin America), with passwords she can just check her notebook the same night and start the recourse through official channels. I know she could just call the hotline, but if 24hr customer service guy can get you in your account same night then the bank is too insecure anyways
  - chimeracoder 1y ago
    > The without recourse is the part that matters... Yes, and I'm saying that part isn't accurate either for the story you're portraying with passkeys or for the status quo. That's not how account recovery flows work.
    - mvieira38 1y ago
      With passwords, no account was even lost in the scenario for a recovery flow to start. An account recovery flow is only necessary because of the superfluous extra security, which will almost inevitably introduce more attack vectors than before (such as a social engineering attack through customer service) if the banks want to service customers like grandmas.
      - chimeracoder 1y ago
        > With passwords, no account was even lost in the scenario for a recovery flow to start Given how common mandatory SMS 2FA is for banks, if thieves stole your unlocked phone, they have stolen your account too.
        3036e4 1y ago
        Isn't the SMS just 1 factor, and for 2FA they will also need the other F (e.g. password)? Relying on only SMS sounds like 1FA?
bccdee 1y ago
FYI, you can put a 2FA secret into Bitwarden and autofill the one-time passwords alongside the regular password. That would mitigate the impact of losing your phone.
- britzkopf 1y ago
  Great, this is a universal solution. Let's all make it an integral part of our digital security, and in 5 years or so hope that bitwarden doesn't leverage it!
  - ssk42 1y ago
    the good news is that you can self-host bitwarden pretty easily and so it doesn't have to be a hassle/risk
    - dare944 1y ago
      Grandma is self-hosting what???
      - jamespo 1y ago
        that's where you come in sonny
        dsr_ 1y ago
        This. Grandma, and Uncle Rob, and your cousins, and anyone else you have a long standing relationship with, can use your VaultWarden instance if you let them. But! You now get to maintain uptime (Rob travels and is frequently awake at 3am your time) and make sure that the backups are working... and remember that their access to their bank accounts is now in your hands, so be responsible. Have a second site and teach your niece how to sysadmin.
      - nightski 1y ago
        I am going to be honest, Grandma is already compromised.
arccy 1y ago
A key part of the recent push for passkeys has been cross device syncing with your Google / Apple / whatever password manager account, so you end up in the same situation: if you can log in to Bitwarden to access your passwords, you can log in to your password manager to access your passkeys.
- jvanderbot 1y ago
  Did people not realize they can save their 2fa token and just use that with a new authenticator? I haven't used a phone 2fa forever, but it was a much better system than this "email me a code" BS.
  - rPlayer6554 1y ago
    For a long time 2fa apps (other than Bitwarden and maybe some others) would lock you into the app and not let you export it. Websites don’t usually expose the text version of the code, just the QR.
    - bvrmn 1y ago
      QR has trivial format and code is easily extractable.
      - rPlayer6554 1y ago
        Spot the developer who never had to setup anything for his mom.
    - 20after4 1y ago
      There are desktop totp apps that will decode the QR code from a screenshot in the clipboard.
    - seplox 1y ago
      It's easy to screenshot or physically print a QR code during setup.
    - 1y ago
codethief 1y ago
> whereas with passwords I can just log into Bitwarden wherever and I'm golden Good luck. For some arcane reason, Bitwarden turned on email-based 2FA for my account last night and all of a sudden I'm locked out of my account for half a day. …mostly because I have greylisting enabled on my mail server, so emails don't arrive right away, but as it so happens I also had all my hardware stolen from me last weekend. Bootstrap is a real bitch.
LorenPechtel 1y ago
Exactly. The only financial stuff on my phone is Google Wallet and I don't even live in a high threat area. The devices that can accept payment from Google Wallet are always in observed locations, it would be very hard for a mugger to use it maliciously. All the easy money transfer options are an attack surface I see no need to expose.
throw10920 1y ago
I feel like this is a really strong justification for duress passwords. Register a duress password with your phone or bank account, and if you ever enter it, that system will take whatever actions you want - call the police with your location, display a fake balance of a few hundred dollars, switch to a fake email account, hide your crypto wallet app, whatever.

chimeracoder 1y ago

> More like abuelita gets robbed at gunpoint and made to unlock and clear out her bank account, then has no recourse at home because her device was taken. You are describing the current status quo, without passkeys. This is already possible. Well, except maybe for the "without recourse" part, because there are some legal and policy avenues available for dealing with this situation.

mvieira38 1y ago
The without recourse is the part that matters... With passkeys or 2FA she's at risk of having to wait a day or more to go to the physical location (if there even is one, digital banks are huge in Latin America), with passwords she can just check her notebook the same night and start the recourse through official channels. I know she could just call the hotline, but if 24hr customer service guy can get you in your account same night then the bank is too insecure anyways
- chimeracoder 1y ago
  > The without recourse is the part that matters... Yes, and I'm saying that part isn't accurate either for the story you're portraying with passkeys or for the status quo. That's not how account recovery flows work.
  - mvieira38 1y ago
    With passwords, no account was even lost in the scenario for a recovery flow to start. An account recovery flow is only necessary because of the superfluous extra security, which will almost inevitably introduce more attack vectors than before (such as a social engineering attack through customer service) if the banks want to service customers like grandmas.
    - chimeracoder 1y ago
      > With passwords, no account was even lost in the scenario for a recovery flow to start Given how common mandatory SMS 2FA is for banks, if thieves stole your unlocked phone, they have stolen your account too.
      - 3036e4 1y ago
        Isn't the SMS just 1 factor, and for 2FA they will also need the other F (e.g. password)? Relying on only SMS sounds like 1FA?

bccdee 1y ago

FYI, you can put a 2FA secret into Bitwarden and autofill the one-time passwords alongside the regular password. That would mitigate the impact of losing your phone.

britzkopf 1y ago
Great, this is a universal solution. Let's all make it an integral part of our digital security, and in 5 years or so hope that bitwarden doesn't leverage it!
- ssk42 1y ago
  the good news is that you can self-host bitwarden pretty easily and so it doesn't have to be a hassle/risk
  - dare944 1y ago
    Grandma is self-hosting what???
    - jamespo 1y ago
      that's where you come in sonny
      - dsr_ 1y ago
        This. Grandma, and Uncle Rob, and your cousins, and anyone else you have a long standing relationship with, can use your VaultWarden instance if you let them. But! You now get to maintain uptime (Rob travels and is frequently awake at 3am your time) and make sure that the backups are working... and remember that their access to their bank accounts is now in your hands, so be responsible. Have a second site and teach your niece how to sysadmin.
    - nightski 1y ago
      I am going to be honest, Grandma is already compromised.

arccy 1y ago

A key part of the recent push for passkeys has been cross device syncing with your Google / Apple / whatever password manager account, so you end up in the same situation: if you can log in to Bitwarden to access your passwords, you can log in to your password manager to access your passkeys.

jvanderbot 1y ago
Did people not realize they can save their 2fa token and just use that with a new authenticator? I haven't used a phone 2fa forever, but it was a much better system than this "email me a code" BS.
- rPlayer6554 1y ago
  For a long time 2fa apps (other than Bitwarden and maybe some others) would lock you into the app and not let you export it. Websites don’t usually expose the text version of the code, just the QR.
  - bvrmn 1y ago
    QR has trivial format and code is easily extractable.
    - rPlayer6554 1y ago
      Spot the developer who never had to setup anything for his mom.
  - 20after4 1y ago
    There are desktop totp apps that will decode the QR code from a screenshot in the clipboard.
  - seplox 1y ago
    It's easy to screenshot or physically print a QR code during setup.
  - 1y ago

codethief 1y ago

> whereas with passwords I can just log into Bitwarden wherever and I'm golden Good luck. For some arcane reason, Bitwarden turned on email-based 2FA for my account last night and all of a sudden I'm locked out of my account for half a day. …mostly because I have greylisting enabled on my mail server, so emails don't arrive right away, but as it so happens I also had all my hardware stolen from me last weekend. Bootstrap is a real bitch.

LorenPechtel 1y ago

Exactly. The only financial stuff on my phone is Google Wallet and I don't even live in a high threat area. The devices that can accept payment from Google Wallet are always in observed locations, it would be very hard for a mugger to use it maliciously. All the easy money transfer options are an attack surface I see no need to expose.

throw10920 1y ago

I feel like this is a really strong justification for duress passwords. Register a duress password with your phone or bank account, and if you ever enter it, that system will take whatever actions you want - call the police with your location, display a fake balance of a few hundred dollars, switch to a fake email account, hide your crypto wallet app, whatever.