5 ms·

Losing your device and not having any passwords is like losing your fingerprints. >Device loss scenarios >Users are largely unsure about the implications for

by nabla9 1y ago

Losing your device and not having any passwords is like losing your fingerprints. >Device loss scenarios >Users are largely unsure about the implications for their passkeys if they lose or break their device, as it seems their device holds the entire capability to authenticate. To trust passkeys as a replacement for the password, users need to be prepared and know what to do in the event of losing one – or all – of their devices. >Backing up and synchronising passkeys with a Credential Manager makes it easier to recover access to them compared to other existing second factor options. However, this relies on the user having prepared their Credential Manager account for recovery. Users need help in understanding and implementing the right steps so they can feel ready to go passwordless and use passkeys without extra worry and hassle.

burnte 1y ago
Just not having the right device with you is crippling. IMO Passkeys need more work. I'd really like to see accounts support multiple passkeys. I'd prefer biometrics that are device independent. I just don't like the idea of replacing something someone can steal (a password) with something else someone can steal (a phone).
- tzs 1y ago
  > I'd really like to see accounts support multiple passkeys Most accounts seem to. Personally, I think I've only found one or two out of around 25 that I've added passkeys to that would not let me add more.
- torstenvl 1y ago
  Would be nice, but biometrics have also been systematically made less secure. Apple, for example, no longer sells a phone with Touch ID.
  - burnte 1y ago
    Vendors not using biometrics well doesn't mean biometrics are insecure. Apple not selling touch ID CERTAINLY isn't evidence of the security of biometrics.
    - torstenvl 1y ago
      If nearly all biometrics systems currently on the market are insecure, then it is fair to say biometrics have been made insecure. Of devices currently sold, the only secure biometrics I'm aware of are on iPad mini/Air; Google Pixel; Honor Magic; and possibly Samsung Galaxy S21 and newer.
  - foobazgt 1y ago
    At first I read this as "Apple doesn't implement Touch ID, because they found it to be insecure", which really confused me. Was that the intent? On second reading, I'm thinking this might mean, "since Apple only implements Face ID, biometrics on Apple devices is less secure", which makes more sense (to me).
    - throwawayffffas 1y ago
      Aren't fingerprints obsolete as biometrics? Last I remembered fingerprints can be lifted if high resolution pictures. I.e. any picture where your thumb is visible.
    - torstenvl 1y ago
      Yeah, the latter. All kinds of reports of siblings (including fraternal twins and non-twins) being able to unlock each others phones. https://duckduckgo.com/?origin=funnel_home_google&t=h_&q=faceid+siblings&ia=web https://duckduckgo.com/?origin=funnel_home_google&t=h_&q=fac... Fingerprints are much more non-deterministic and therefore more secure.
0cf8612b2e1e 1y ago
Also requires the device allows backup of passkeys. The infamous post where keepass was threatened if they were to continue to allow users to backup their own keys.
- stavros 1y ago
  The person there requested that KeePassXC don't let users export their keys in plaintext, which seems reasonable. He asked that the software encrypt the keys with a user-selected password before exporting, so someone stealing the files wouldn't have the keys to literally all of the user's sites. That doesn't seem unreasonable to me.
  - throwawayffffas 1y ago
    Not really dude, if I can't export in plaintext I can't pick the encryption I have to use whatever keepassxc will do. I can't pipe it to gpg and encrypt it with my key. And on the other hand I can only load them to another keepass instance I can't switch credential managers. If you are worried your system is running malware that will steal your plaintext keys, well bad news they can steal the encrypted keys and keylog your password.
    - joshuamorton 1y ago
      > If you are worried your system is running malware that will steal your plaintext keys No, I'm not worried about this since I do not and will not copy my keys. I'm worried about my friends or family using the most secure options possible (passkeys) and still getting phished because they paste their plaintext secrets into a scam site.
      - throwawayffffas 1y ago
        Even without copyable keys, if your friends and family can be tricked into pasting their plain text keys into a scam site, they can be tricked into pasting their encrypted keys and their associated password to a scam site. The point of encryption at rest is to protect your data if your device is accessed by a third party. Not from user action.

by nabla9 1y ago

burnte 1y ago

Just not having the right device with you is crippling. IMO Passkeys need more work. I'd really like to see accounts support multiple passkeys. I'd prefer biometrics that are device independent. I just don't like the idea of replacing something someone can steal (a password) with something else someone can steal (a phone).

tzs 1y ago
> I'd really like to see accounts support multiple passkeys Most accounts seem to. Personally, I think I've only found one or two out of around 25 that I've added passkeys to that would not let me add more.
torstenvl 1y ago
Would be nice, but biometrics have also been systematically made less secure. Apple, for example, no longer sells a phone with Touch ID.
- burnte 1y ago
  Vendors not using biometrics well doesn't mean biometrics are insecure. Apple not selling touch ID CERTAINLY isn't evidence of the security of biometrics.
  - torstenvl 1y ago
    If nearly all biometrics systems currently on the market are insecure, then it is fair to say biometrics have been made insecure. Of devices currently sold, the only secure biometrics I'm aware of are on iPad mini/Air; Google Pixel; Honor Magic; and possibly Samsung Galaxy S21 and newer.
- foobazgt 1y ago
  At first I read this as "Apple doesn't implement Touch ID, because they found it to be insecure", which really confused me. Was that the intent? On second reading, I'm thinking this might mean, "since Apple only implements Face ID, biometrics on Apple devices is less secure", which makes more sense (to me).
  - throwawayffffas 1y ago
    Aren't fingerprints obsolete as biometrics? Last I remembered fingerprints can be lifted if high resolution pictures. I.e. any picture where your thumb is visible.
  - torstenvl 1y ago
    Yeah, the latter. All kinds of reports of siblings (including fraternal twins and non-twins) being able to unlock each others phones. https://duckduckgo.com/?origin=funnel_home_google&t=h_&q=faceid+siblings&ia=web https://duckduckgo.com/?origin=funnel_home_google&t=h_&q=fac... Fingerprints are much more non-deterministic and therefore more secure.

0cf8612b2e1e 1y ago

Also requires the device allows backup of passkeys. The infamous post where keepass was threatened if they were to continue to allow users to backup their own keys.

stavros 1y ago
The person there requested that KeePassXC don't let users export their keys in plaintext, which seems reasonable. He asked that the software encrypt the keys with a user-selected password before exporting, so someone stealing the files wouldn't have the keys to literally all of the user's sites. That doesn't seem unreasonable to me.
- throwawayffffas 1y ago
  Not really dude, if I can't export in plaintext I can't pick the encryption I have to use whatever keepassxc will do. I can't pipe it to gpg and encrypt it with my key. And on the other hand I can only load them to another keepass instance I can't switch credential managers. If you are worried your system is running malware that will steal your plaintext keys, well bad news they can steal the encrypted keys and keylog your password.
  - joshuamorton 1y ago
    > If you are worried your system is running malware that will steal your plaintext keys No, I'm not worried about this since I do not and will not copy my keys. I'm worried about my friends or family using the most secure options possible (passkeys) and still getting phished because they paste their plaintext secrets into a scam site.
    - throwawayffffas 1y ago
      Even without copyable keys, if your friends and family can be tricked into pasting their plain text keys into a scam site, they can be tricked into pasting their encrypted keys and their associated password to a scam site. The point of encryption at rest is to protect your data if your device is accessed by a third party. Not from user action.