51–60 of 169 posts
For a layperson, passkeys are difficult to understand, but provide out-of-the-box hygiene and security.
Passwords are not fine. What we need is better explanation/education of passkeys.
What I find more annoying is the aggressive insistence of bigcorps to do everything possible with 2FA except actually just use the damn 2FA code I already have set up in my password manager. SMS, emails, pushing codes to random devices I'm logged in on, whatever.
I recently got a pair of yubikeys… they have been around about ten years already and support industry standards. Guess how many services I use support them? A smaller fraction than I’d like.
> My bank only supports SMS 2FA so while I'm travelling I'm effectively cut off from certain functionality EU citizen here. Do you... not have roaming?
International SMS delivery is unreliable. Unreliable is not strong enough word. It more often doesn't work that it does. Or it works with enough of a delay to cause a timeout on the site where you want to login. Plus, you know, SMS hijacking and all that.
Even if people have their phones all the time there's always a possibility that components on the device might suddenly fail.
The charging port in my iPhone stopped working on one May morning and thus device died. I temporarily lost access to most of the apps incl. 2FA code generators for about a month. Luckily one of service centers was able to find component and replace it cheaply.
https://www.stavros.io/posts/clearing-up-some-passkeys-misco...
To answer the article's points:
> While the tech is great, the problem is that nothing supports these new-fangled methods of authentication.
Should we never switch to anything else, then, because nothing will support it until everything does?
> Multi-devicing for authentication is a poor user experience. Even having to go click a link in your mailbox sucks.
WebAuthn doesn't require multi-devicing.
> People don't have their phone on them all the time (and some don't even have a smartphone).
WebAuthn doesn't require a phone.
> New users don't understand these methods of authentication.
New users don't understand how to safely use passwords either. If we're going with max usability, we might as well get rid of passwords and just use usernames for authentication. Otherwise, we should compare like to like, and the usability of passwords is not worth how insecure they are.
> They're generally much more complicated to implement than a basic email/password combo.
Yes, it's much easier to implement something insecure than something secure. This sentence is disingenuously omitting all the impossibility around actually making passwords secure, ie using a different password for each site, 2FA, password length restrictions, etc.
When it comes down to it, Passkeys are orders of magnitudes more secure for a small usability cost over completely insecure passwords. To say anything else is hostile to security.
Earlier quoted context omitted.
> I don't mind carrying house keys. House keys are a minimal inconvenience because the lock on your front door also affords minimal security. Just ask the Lock Picking Lawyer how long it would take a determined intruder to get into your home, whether by picking, force, or finding a weakness such as open window. If your home had high security, I can guarantee that you'd feel the inconvenience.
You can have a very secure facility that only uses a "house key"-style entry flow for the user. The key will look really weird (see Medeco and Evva for examples) and the building will have some design compromises - few entry points, no openable windows, etc. A password, in theory, could work the same way. Except that the normal password UX involves people remembering the password, which entails a huge security compro…
Yep, I'd call that a significant inconvenience (for a home that someone like me lives in).
Device secrer only methods like passkeys and anything biometric+tpm without non-pin knowledge factor if auth are cancer. Skip thid bandwagon if you can help it.
> 2. People don't have their phone on them all the time (and some don't even have a smartphone). I live in rural Western Australia with almost zero phone coverage, and this is a huge problem. I'm terrified of all these services wanting my phone number, or bugging me to turn on phone 2FA, because the moment that happens, I lose access to that service . ChatGPT that everyone is spamming on every discussion? I can't eve…
> it seems like a dangerous crutch than a useful technology Not to sidetrack, but could you expound further? I struggle to reach the blanket conclusion of “not useful”. I don’t really see how it’s a crutch, more than any other assistance tool like Google, StackOverflow, code-completion or actual docs. Hallucination is a separate problem, which is solved by using fine-tuned models.
They won't solve the main cause of hallucination: prompt has zero connection to generated text other than probability.
ChatGPT do not generate answers, it comes up with something that looks like an answer. There is a good chance it is the answer, but you can't guarantee it.
I believe this particular problem won't be solved, unless researchers teach machines how to reason. But then we would have greater concerns than hallucinations.
> 2. People don't have their phone on them all the time (and some don't even have a smartphone). I live in rural Western Australia with almost zero phone coverage, and this is a huge problem. I'm terrified of all these services wanting my phone number, or bugging me to turn on phone 2FA, because the moment that happens, I lose access to that service . ChatGPT that everyone is spamming on every discussion? I can't eve…