jesseendahl

8 ms·

61.
by jesseendahl 2y ago
>so if someone steals your authenticator they have access to your account indefinitely. If a user's device is compromised, an attacker can also install a keylogger and steal all their passwords, or better yet steal all their cookies
62.
by jesseendahl 2y ago
>Passkeys would make it impossible This is so incredibly wrong that it makes me think you've never actually experienced signing in with a passkey. Passkeys would eliminate all the text message codes, email codes, and passwords. The
63.
by jesseendahl 2y ago
Recovery flows being based on knowledge based auth that requires multiple pieces of knowledge does not in any way reduce the extremely meaningful security improvements that passkeys bring for both users and Relying Parties on a daily basis.
64.
by jesseendahl 2y ago
I don't know how other providers deal with recovery, but if you use iCloud Keychain for storing/syncing your passkeys, Apple has a very impressive amount of recovery options, including an option for recovery even if you lose 100%
65.
by jesseendahl 2y ago
I just love that @wkat4242 (the parent comment you're replying to) lists attestation as the reason they moved away from Apple/macOS and you're (rightly) pointing out that both Apple and Google stopped supporting hardware atte
66.
by jesseendahl 2y ago
This is quite the claim. Do you have any evidence that this is at all common? On the surface it sounds like a conspiracy theory tinged with racism.
67.
by jesseendahl 2y ago
outweighs* Only offering the correction because I was confused at what you meant by “out ways” until I figured it out.
68.
by jesseendahl 2y ago
@lapcat I noticed this part of your post: >The only way to see the contents of iCloud Keychain is on an Apple device with iCloud Keychain enabled. You can't even see anything on the icloud.com website. FYI this is because of all con
69.
Password managers aren't replacements for passkeys(blog.millerti.me)
4 points by jesseendahl 2y ago|1 comments
70.
by jesseendahl 2y ago
> Isn’t the whole point of a passkey that it’s meant to use a chain of trust to prove that you’re you via biometrics or a physical factor? No actually! The biometric auth is more of a “liveness check” than anything else. The point of pas
71.
by jesseendahl 2y ago
Account recovery flows are generally entirely unaffected by the move from password to passkey. It’s just your login credential. If you lose either a password or a passkey, you do the same thing: set a new one via email recovery.
72.
by jesseendahl 2y ago
Account recovery flows are generally entirely unaffected by the move from password to passkey. It’s just your login credential. If you lose either a password or a passkey, you do the same thing: reset and set a new one via email recovery.
73.
by jesseendahl 2y ago
Account recovery flows are generally entirely unaffected by the move from password to passkey. It’s just your login credential. If you lose either a password or a passkey, you do the same thing: reset and set a new one via email recovery.
74.
by jesseendahl 2y ago
Account recovery flows are generally entirely unaffected by the move from password to passkey. It’s just your login credential. If you lose either a password or a passkey, you do the same thing: reset and set a new one via email recovery.
75.
by jesseendahl 2y ago
Your iPhone doesn't even really store your biometric information, it stores mathematical models that can be used to check whether the fingerprint (Touch ID) or face (Face ID) matches the person who enrolled on the device (you). And tha
76.
by jesseendahl 2y ago
You are living very dangerously and running 2 whole major versions back. The only Apple Operating Systems (macOS, iOS, etc.) that have both the latest Platform Security features and get 100% of security patches is the very latest version.
77.
by jesseendahl 2y ago
You mean rarely dry enough to burn, right?
78.
by jesseendahl 2y ago
>At least here in the deep south people don't pack intersections before a light change like they did in southern california, that made driving way more tedious than it needed to be. In many many many intersections in LA, there is no
79.
by jesseendahl 2y ago
Your two arguments are actually arguments against using any password/passkey manager at all. So it seems like you are actually arguing that people should not be using password managers, which is pretty bad advice given how we've s
80.
by jesseendahl 2y ago
WebAuthn is just a standard. The standard says nothing about whether it should be used as a primary factor or secondary factor.
81.
by jesseendahl 2y ago
The only truly safe option is passkeys because (a) passwords can be phished and (b) if someone is generating a password they can remember, they’re probably also reusing that password across multiple apps/websites.
82.
by jesseendahl 2y ago
Most of the “Zero Trust” vendor solutions on the market are a joke compared to Google’s internal implementation (BeyondCorp). If you read through the journal papers Google published you’ll see just how much work it is to do zero trust prope
83.
by jesseendahl 2y ago
> So why does my browser or password manager send saved normal passwords to a different domain than the one they were saved for? This is not a limitation of passwords but of the software that encourages saving passwords. It didn't n
84.
by jesseendahl 2y ago
> Hopefully there is some sort of fallback if something extreme like a house fire manages to destroy all of your personal devices at once. This is already addressed and has been since Apple first launched support for passkeys. See the “R
85.
by jesseendahl 2y ago
> But the login for the Gmail address is a passkey that's on the Apple account... A passkey is just a replacement for a password. Google (and other apps/websites) have account recovery processes for users who get locked out of
86.
by jesseendahl 2y ago
I think you might be making some assumptions about how this stuff works without looking into it. - A lot (most?) people’s Apple Account name is actually their main email address (e.g. Gmail), so they would still control their email address
87.
by jesseendahl 3y ago
Tesla should just implement support for passkeys. Since WebAuthn credentials are bound to the domain they are created for, they are strongly phishing resistant. If you could login to the Tesla app with a passkey instead of password + TOTP,
88.
by jesseendahl 3y ago
I’ve been following Apple for a long time and the stock almost always rises ahead of announcements and falls after. Pretty sure that pattern has existed for ~20 years.
89.
by jesseendahl 3y ago
Most popular forms of two-factor are still phishable. WebAuthn/passkeys are a better solution.
90.
by jesseendahl 3y ago
IMO Google is probably the best bet, given the strength of their security engineering folks.

More ›