61–70 of 316 posts
TL;DR Google, Microsoft, GitHub, Apple, Apple’s macOS and iOS, Google Chrome and Android, as well as 1Password, Yubikey Yay. https://indieweb.org/NASCAR_problem
This sounds counter productive. Third party authentication providers are a single point of failure, and usually they themselves require a password to authenticate you anyway. If your gmail password is hacked, then effectively all your accounts on websites that use Google auth are also hacked. Passkeys appear to also be handled by central services? At least that appears to be the case with Apple, according to the link…
> Passkeys appear to also be handled by central services? I don't think it is true that passkeys require a third party, but can someone else confirm?
I don’t understand why someone would want to store all their credentials with one of the large tech companies. It seems like this makes it really easy for law enforcement to grab access to all accounts easily.
When you use passkeys with either Apple's iCloud Keychain or Google Password Manager, the key material is end-to-end encrypted. Law enforcement cannot get your passkeys through these two big tech companies.
Earlier quoted context omitted.
I'm pretty sure passkeys are just a rebranded version of virtual WebauthN tokens. So while passkey secrets can be synced (unlike U2F physical tokens) they can also be implemented as being backed by a physical token (think Yubikey) that never goes om the cloud.
There is theory and there is practice. What grandparent comment says is the likely outcome in practice
There is absolutely nothing stopping you from doing so as long as your Yubikey supports WebAuthN (the latest do). You are prompted to use another phone or physical security key if a resident key isn't found on your device, and even if it is, you are given the option of doing so instead of using the one found.
This is not a hypothetical feature or theory or something, it's part of the spec and is implemented. It's as practical as it gets.
Earlier quoted context omitted.
I trust big tech companies more than I trust startups or smaller tech companies. I have faith that neither Apple nor Google would do that. This is a personal belief based on chatting with Apple and Google employees. You don't have to agree.
Regardless of how much you trust them, the fact that they can force a decryption of these keys (and selectively, per-user, no less) means that you are not in custody of your own authentication identity. Add to that, they can be legally compelled to take such a measure (and I'm sure they will in due time). Compared to using, say, KeepassXC with a unique, secure password per vault. Now you can sync on iCloud or google…
It's a know bug, but the fact that it still exists really shows how much the devs care about making it a really rock solid alternative. I've never had this issue with Google passwords, 1password or any other provider.
Earlier quoted context omitted.
You guys conveniently ignores the fact that Apple and Google are still the gatekeepers in that scenario.
Yes you need to trust your operating system developer to some extent. If your threat model includes not trusting the company that writes the source code to your OS…don’t use computers I guess?
Does that service also have to trust the OS developers? Correct me if I'm wrong, but I'm under the impression that services can decide whose passkey implementations to trust.
Seems like that should be up to the user, not the service.
Earlier quoted context omitted.
> I have already had several malicious login attempts Doesn't that mean they know your username and password? How does that happen so easily.
The line you quoted doesn't mean they know the password. But this one does: > Fortunately I'm attuned enough to decline them. There is only something to decline if they know your password.
Regarding MFA-fatigue, this is mitigated by asking the user to enter the same number into Authenticator that is displayed on the login screen. So that takes away the chance of accidentally approving an MFA prompt.
Earlier quoted context omitted.
They said login attempt, not successful login. So no.
But to get to the auth request, do you not need to pass the password stage first? I get these pretty frequently on my work machines as I reuse my passwords and they have already leaked. At least that was my assumption.
I don’t understand why someone would want to store all their credentials with one of the large tech companies. It seems like this makes it really easy for law enforcement to grab access to all accounts easily.
I think it depends on your threat model. For my personal accounts, I'm more concerned about the risk from badly-managed auth than law enforcement. So from that standpoint, using an established big tech company makes sense. Other people may place different weights on various threats.