341–350 of 421 posts
This is wonderful news! If anyone is interested in experimenting we built an API that makes it very simple to add WebAuthn (passkeys) to your existing web app. It’s available at https://passwordless.dev Note: We also maintain the open source fido2-net-lib, the API just lowers the friction for devs.
Earlier quoted context omitted.
> as a means to avoid locking 2FA to hardware Tying 2FA to hardware is for most of the common use cases a bad idea. Instead always use TOTP and keep the seed in a secure storage with multiple backups. If on top of that you like to keep it on your phone to generate the code that way, fine. But at that point you can destroy the phone and it doesn't matter, you'll still have access. > While I don't like passwords and un…
> Tying 2FA to hardware is for most of the common use cases a bad idea. For me, I don't consider that to be true. I have a Yubikey on my keyring, and a backup Yubikey in my safe. Losing my keys is an extremely rare thing (I've never actually lost my keys, closest I've come in the last 30 years is temporarily misplacing them or locking them inside). I'm happy enough to deal with losing my digital access (via 2FA) tea[…
What is the life of a yubikey? Do they degrade over time horizons?
The reason I ask is that if you have a backup that you never hope to use it's likely to be accessed only very rarely - which makes me kind of wonder what if your primary yubikey fails in 15 years due to natural wear/tear/degradation due to the passage of time and your backup has succumbed to the same problem due to being just as old?
Earlier quoted context omitted.
> Tying 2FA to hardware is for most of the common use cases a bad idea. For me, I don't consider that to be true. I have a Yubikey on my keyring, and a backup Yubikey in my safe. Losing my keys is an extremely rare thing (I've never actually lost my keys, closest I've come in the last 30 years is temporarily misplacing them or locking them inside). I'm happy enough to deal with losing my digital access (via 2FA) tea[…
> I'm happy enough to deal with losing my digital access (via 2FA) temporarily under the same sort of circumstances where I've lost my keys. To me the critical difference would be that my house keys are single purpose and only serve at a single location. I lost/broke keys a few times in my life, and the only issue was to wait outside the house for a few hours. I didn't need to authorize 3d secure transactions when pa…
The world really hasn't appropriately quantified our reliance on little black fondleslabs.
Earlier quoted context omitted.
You should have a third in a safety deposit box at a bank or other offsite location. The issue is if you have a fire and both your keys are melted, you're f'ed.
But the entire issue is that needing to enroll all your keys every time you gain access to a new service is directly at odds with keeping one copy/key in a second, safe location. If there were one more layer of abstraction where all N of my keys prove that I'm "me" (or proves that I'm some entity) and the "me"-ness is the principal that gains access, that would be nice, but that's directly at odds with not wanting to…
For some reason, this use case was not considered for Webauthn.
Maybe only tangentially related, but does anyone user Apple Keychain as their primary password manager? Is that even a viable option if you're completely within the Apple ecosystem?
Maybe only tangentially related, but does anyone user Apple Keychain as their primary password manager? Is that even a viable option if you're completely within the Apple ecosystem?
Maybe only tangentially related, but does anyone user Apple Keychain as their primary password manager? Is that even a viable option if you're completely within the Apple ecosystem?
Yes I started using Keychain exclusively after the LastPass app got progressively shittier. No issues so far, and really no differences. Even tells you when something gets compromised.
Earlier quoted context omitted.
>Currently you need remember to register at least 2 security keys, in case one is lost/misplaced. This is always my issue with 2FA or passwordless auth. You're forced to have 2 devices and are kind of screwed if you don't hvae two on you. I was on a trip and broke my iPhone. It had my plane tickets on it to get home. I was able to get a replacement from Apple, they just gave it to me and sent me on my way. When I tur…
>"I'm also not a fan of my phone becoming my identity." I see that many people are slowly moving this direction and just can't fathom why do they fall for this corporate trap.
Earlier quoted context omitted.
Yes I started using Keychain exclusively after the LastPass app got progressively shittier. No issues so far, and really no differences. Even tells you when something gets compromised.
Any tips on transferring data from e.g. LastPass to Keychain? Also, are you now tied in to Safari on all devices or is it interoperable with other browsers at all?
Earlier quoted context omitted.
Yes I started using Keychain exclusively after the LastPass app got progressively shittier. No issues so far, and really no differences. Even tells you when something gets compromised.
Any tips on transferring data from e.g. LastPass to Keychain? Also, are you now tied in to Safari on all devices or is it interoperable with other browsers at all?
iCloud passwords works with Chrome and Edge on Windows but generally yeah you need to be all-in on Safari :V