3 ms·

If you're not happy connecting your phone to the network, then how likely is it that you would you be willing to enter your login details on a machine you don't

If you're not happy connecting your phone to the network, then how likely is it that you would you be willing to enter your login details on a machine you don't control?

stonogo 8d ago
Poor people exist.
- roryirvine 8d ago
  The poorest country I'm familiar with is Zambia, where about 90% of the population have a mobile subscription. The number of people sharing GP's concerns for reasons of poverty rather than because of their personal security posture will be vanishingly small.
  - arcfour 8d ago
    I'll have to remember this one the next time I hear the phone/poverty argument made in bad faith.
  - rcxdude 8d ago
    They still exist, though. And in my experience people in vulnerable positions have somewhere between zero and one phones at any given time, without necessarily any good continuity between them.
  - kps 8d ago
    > The poorest country I'm familiar with is Zambia, where about 90% of the population have a mobile subscription. Only 85%¹ of the population are over the age of 4. Smart kids they've got. ¹ https://populationpyramids.org/zambia https://populationpyramids.org/zambia
  - stonogo 7d ago
    I don't think "fuck 10% of the population" is as strong an argument as you seem to think it is.
tavavex 8d ago
What if you just can't have internet on your phone? Like if the computer is connected via Ethernet and there's no wifi network you can connect to? What if you're abroad and have no roaming? And the ultimate question about a person that the modern world can barely conceptualize - what if you have a dumbphone? Or what if your smartphone is lost or stolen or dead and you need to access some account? That last one has happened to me, and I sure am glad I know the key passwords that I need for survival. These may seem like nitpicks, but there's probably a thousand rare scenarios like these that exist. You inevitably have to consider them when you're moving from punching in letters and numbers that you remember in the normal, low-tech way to a complex networked two-device workflow.
- limagnolia 8d ago
  If my phone is lost or damaged, I would buy a new, cheap Android phone and sync my passkeys to it. But I am curious why one would need to login to a website in order to survive? If one did have say a severe medical condition that somehow required a website in order to manage, I guess I would concede that maybe passkeys aren't the best way to secure such a life-sustaining website.
  - horsawlarway 8d ago
    > But I am curious why one would need to login to a website in order to survive? They use bank like Ally or Discover with no physical branches. They use a mortgage provider like Rocket mortgage with no physical branches. They use a medication delivery service with no physical customer facing pharmacies. They have an employer that only facilitates reimbursement for expenses via online tools. etc... I guess "survive" has a sliding scale, but if I lost access to critical accounts... my life is going to FUCKING SUCK in a non-trivial and very impactful way almost immediately, on many fronts. And if your answer to that problem is "well, just call them"... then we're right back to the point the article is making: "An account’s security is still dictated by the weakest recovery method" Passkeys aren't a meaningful improvement in security - assuming you do actually have decent password hygiene like a password manager.
  - epihelix 8d ago
enriquto 8d ago
> willing to enter your login details on a machine you don't control? Are you talking about your phone here?
- roryirvine 8d ago
  Sure, your personal security posture might very well preclude that. But, again, if you don't trust your phone then how likely is it that you will be prepared to trust a public computer?

If you're not happy connecting your phone to the network, then how likely is it that you would you be willing to enter your login details on a machine you don't control?

stonogo 8d ago

Poor people exist.

roryirvine 8d ago
The poorest country I'm familiar with is Zambia, where about 90% of the population have a mobile subscription. The number of people sharing GP's concerns for reasons of poverty rather than because of their personal security posture will be vanishingly small.
- arcfour 8d ago
  I'll have to remember this one the next time I hear the phone/poverty argument made in bad faith.
- rcxdude 8d ago
  They still exist, though. And in my experience people in vulnerable positions have somewhere between zero and one phones at any given time, without necessarily any good continuity between them.
- kps 8d ago
  > The poorest country I'm familiar with is Zambia, where about 90% of the population have a mobile subscription. Only 85%¹ of the population are over the age of 4. Smart kids they've got. ¹ https://populationpyramids.org/zambia https://populationpyramids.org/zambia
- stonogo 7d ago
  I don't think "fuck 10% of the population" is as strong an argument as you seem to think it is.

tavavex 8d ago

What if you just can't have internet on your phone? Like if the computer is connected via Ethernet and there's no wifi network you can connect to? What if you're abroad and have no roaming? And the ultimate question about a person that the modern world can barely conceptualize - what if you have a dumbphone? Or what if your smartphone is lost or stolen or dead and you need to access some account? That last one has happened to me, and I sure am glad I know the key passwords that I need for survival. These may seem like nitpicks, but there's probably a thousand rare scenarios like these that exist. You inevitably have to consider them when you're moving from punching in letters and numbers that you remember in the normal, low-tech way to a complex networked two-device workflow.

limagnolia 8d ago
If my phone is lost or damaged, I would buy a new, cheap Android phone and sync my passkeys to it. But I am curious why one would need to login to a website in order to survive? If one did have say a severe medical condition that somehow required a website in order to manage, I guess I would concede that maybe passkeys aren't the best way to secure such a life-sustaining website.
- horsawlarway 8d ago
  > But I am curious why one would need to login to a website in order to survive? They use bank like Ally or Discover with no physical branches. They use a mortgage provider like Rocket mortgage with no physical branches. They use a medication delivery service with no physical customer facing pharmacies. They have an employer that only facilitates reimbursement for expenses via online tools. etc... I guess "survive" has a sliding scale, but if I lost access to critical accounts... my life is going to FUCKING SUCK in a non-trivial and very impactful way almost immediately, on many fronts. And if your answer to that problem is "well, just call them"... then we're right back to the point the article is making: "An account’s security is still dictated by the weakest recovery method" Passkeys aren't a meaningful improvement in security - assuming you do actually have decent password hygiene like a password manager.
- epihelix 8d ago

enriquto 8d ago

> willing to enter your login details on a machine you don't control? Are you talking about your phone here?

roryirvine 8d ago
Sure, your personal security posture might very well preclude that. But, again, if you don't trust your phone then how likely is it that you will be prepared to trust a public computer?