Viewing profile — PassageNick

This is a great question. I think the biggest barrier to adoption is lack of end user demand for the service. That is followed by people not understanding/believing the incredible …

It is not clear to me what they are implementing here. There is not mention of passkeys anywhere.

Not sure I follow.... Biometrics are very difficult to impossible to reproduce short of physical coercion.

Passwordless is actually MFA -- Something you have (your device) Something you are (your biometric) Those are definitely two factors that are required to be together for passwordle…

>> I hate having to rely on having my phone handy to log into anything. This isn't the case. Nothing about passkeys says you need your phone to login on a website with your laptop,…

The problem with legislation like this is that it eliminates the possibility of better solution. What happens if someone invents a better interface than USB 3.0? Or better, why wou…

No -- every origin has it's own Public/Private key that is stored on the TPM chip on your device. The TPM is designed specifically for securing these keys. Each passkey is a modest…

That's a great article, thanks. In fact, it's a fantastic article. I read it a couple of weeks ago, and learned a lot. Thanks. Apple's changes do degrade security, but I think it i…

....and can you explain the cookie theft thing a bit more?

If you can take a photograph of someone's fingerprint and reproduce it, how, exactly, does one use that?

They cannot block access. The passkeys are actually stored on your devices in a Trusted Platform Module. When moved to the cloud, they are E2E encrypted, and the transferring platf…

Passwordless is MFA -- something you are and something you have. I'm not a yubikey expert, but I don't believe that losing your Yubikey will open up your company to a breach. For a…

You own your own passkeys on your own device, ultimately. Google/Apple/MS have no ownership or knowledge of the actual keys.

Fair enough.

Re: Yubikey -- I confess I don't know. The folks in r/yubikey definitely will, though. The "Big Three" are on the FIDO board, along with 1Password. They can't really do the extingu…

The threat surface of a password based system is like Lake Superior. The threat surface of a passkey based solution is like a small puddle after a rain. How is there a "reduction" …

Yeah, it is non-trivial to implement, but not impossible. Some folks go that route. There are SaaS solutions that implement it for you and make it easy to include in your app.

(Full disclosure: I work at https://passage.id ) WebAuthn is the short name for the "FIDO Alliance Web Authentication Protocol". "Passkey" is the trade name (that Apple tries to ow…

That's a quality aphorism.

It seems strange to me that anyone would go anything but Cloud Native today.

It's amazing how the attitude about not wanting to put data in the vendors hands has changed over the last ten years. I remember having a hard time to convince our CEO to use BitBu…

(Note: I work for Passage.id, now part of 1Password...) Auth is pretty easy to implement, but difficult to get and keep right. Then there are the nooks and crannies that crop up an…