3 ms·
My issue is that they're touted to the consumer as secure, and they're not really doing much more than a complex password. How do you generate a new key if you
by 3RTB297 2mo ago
My issue is that they're touted to the consumer as secure, and they're not really doing much more than a complex password.
How do you generate a new key if you need one? Same process as a password reset. Does it prevent session stealers? Not at all.
Its "benefit" is grandma can't read it to an attacker. OK, well can grandma click a link and have a session stealer bork her life instead? Yeah, and attackers know that and just shift methods. Session stealing isn't a sophisticated attack, and so all that's being done is shaving a cost on PW resets in the interest of shareholder value, at the cost of security theater and locking up your keys in a single domain that holds control over our access to everything.
- zdp7 2mo agoThere is security value. A passkey will not work anywhere except the actual website. Fake look a like sites can't get the credentials. Evidently they can trick you into authorizing their device.
- thyristan 2mo agoSure? MitM isn't a new kind of attack, and I'd be surprised if the ball-of-wax-and-javascript that is WebAuthn isn't vulnerable to that...
- zdp7 2mo agoThis is one of the key security features of passkeys. I did a little searching and the work around is to do a standard fake website that prompts for your standard credentials. That should be a fairly simple fix. Require access from a new device to be authorized from another source with an explanation that they will never request this info.
- harshreality 2mo agoThat's also how any good password manager works. You'd have to manually copy-paste the password to get around the same-site fill restriction (whether it's autofill or manual fill).
- zdp7 2mo agoPasskeys have an advantage in that the server doesn't have your password and every passkey should be unique.