111–120 of 169 posts
Earlier quoted context omitted.
> so passkeys are a much better and easier method. I'm old. What's the difference between a pass word and a pass key ? > tap this button to magically log in” method. And how exactly is "this button" authenticated ?
Passkeys are basically enforced password managers with random passwords. There's some more complexity below the surface, but for the user, that's it.
> 2. People don't have their phone on them all the time (and some don't even have a smartphone). I live in rural Western Australia with almost zero phone coverage, and this is a huge problem. I'm terrified of all these services wanting my phone number, or bugging me to turn on phone 2FA, because the moment that happens, I lose access to that service . ChatGPT that everyone is spamming on every discussion? I can't eve…
Earlier quoted context omitted.
Why not chrome?
Not the parent but the problem is that Chrome (sub. Firefox and Safari, these are problems with pretty much all browsers) isn't a password manager, its a password autofiller. The result is that what should be crucial things like "how do we ensure permanency of the passwords file" are treated as very second rank - profile corruption usually is met with "remove the entire profile", which also ditches the password datab…
With a password manager you're putting all the eggs in the same basked. Why I'm I the only one who see this? More analyticalally: the probability_of_an_account_getting_hacked times damage is constant. More unrelated accounts you have, hack more probable, less damage on a single hack. With one password manager account, everything you have is at stake. There is no way around it. You can't manage this risk.
People who don't use a password manager observably reuse passwords and use weak passwords. In huge quantity. People who use passwords managers do not reuse passwords or use weak passwords at anything resembling this scale.
Thefts of password vaults appear to be rare and it is much much easier to train people to use one good password for their vault, meaning that even with something like the LastPass breach, many people can be will protected.
Yes, if you are a unicorn and can happily generate and recall 100+ strong and unique passwords for your various services then a password manager reduces your security posture. But almost nobody does this.
Password managers also provide some small resistance to phishing, since they can help you notice a page that doesn't match the origin used to register a password.
> 2. People don't have their phone on them all the time (and some don't even have a smartphone). I live in rural Western Australia with almost zero phone coverage, and this is a huge problem. I'm terrified of all these services wanting my phone number, or bugging me to turn on phone 2FA, because the moment that happens, I lose access to that service . ChatGPT that everyone is spamming on every discussion? I can't eve…
I'm in a similar boat. Not so much service, but I move around internationally and change sims a lot. I dont even have a sim most of the time, I'm on wifi 99% of the time. Don't want to pay outrageous fees for Google FI or the like, as literally all I need it for is to get into online banking (who have decided sms 2fa is now compulsory, without offering any other options like an authenticator app). I'm currently locke…
Last I checked, they were asking for $20 / month for unlimited calling and texting. Do you consider that outrageous?
As an alternative, Google Voice will host your phone number for free. It works with every WiFi connection and even while traveling internationally. Have you considered that?
> 2. People don't have their phone on them all the time (and some don't even have a smartphone). I live in rural Western Australia with almost zero phone coverage, and this is a huge problem. I'm terrified of all these services wanting my phone number, or bugging me to turn on phone 2FA, because the moment that happens, I lose access to that service . ChatGPT that everyone is spamming on every discussion? I can't eve…
I kept the number from the last country I lived in solely for 2FA of accounts from that country and after almost a year I've managed to change over most things but not all. A week ago I decided to change that physical sim to an esim as I only need to enable it occasionally. I did the process for this, and at the end I got a link to last country's app store. The only way to install the esim is to use this app and it is only in last country's app store. I haven't logged into that for a while so it needed email confirmation. I haven't logged into the associated gmail address for a while so that needed 2FA confirmation by SMS. So I'm now locked out of an email address, apple id, and phone number.
For a layperson, the passwords are easy to understand and provide enough ways to shoot themselves in the foot. Unless you are an expert, password hygiene can rarely be accomplished. For a layperson, passkeys are difficult to understand, but provide out-of-the-box hygiene and security. Passwords are not fine. What we need is better explanation/education of passkeys.
> Unless you are an expert, password hygiene can rarely be accomplished. Why? Aren’t built-in password managers such as iCloud Keychain (which also auto-generates secure passwords) enough?
Earlier quoted context omitted.
For some weird reason, when im travelling with wifi calling, receiving sms messages is a crap shoot. I basically dont get them if theyre sent by a gov agency, bank, etc. I do still get them from android phones. Its weird, i have no idea why.
>I do still get them from android phones. Its weird, i have no idea why. If you have an android phone yourself, maybe it's not actually SMS and it's actually RCS[1]? [1] https://en.wikipedia.org/wiki/Rich_Communication_Services
And, in my experience, Android pushes you heavily to enable RCS; every time you open its messages app, there's a chance that it will randomly ask you to enable it, with a large button to enable and a small link to dismiss the dialog without enabling. I never tried, but I expect that once enabled, it'll never ask again, so it might have been enabled by accident sometime in the past.
For me it works basically the same way.
But then you get all people who don’t care or are so technically inept that at first occasion will lock themselves out of password manager.
As myself and as a user I could use passwords, no problem.
As a service provider that is entirely different ball game. If I could skip sending out emails or smses it will be cheaper to have web authn, then not having to store passwords only public keys is such a great thing.
In the end if webauthn takes over as end user I will never have to see login screen ever again. I would beet to register once and then maybe rotate key once in a while.
Earlier quoted context omitted.
> they just sweep the problem under a corporate rug and ignore that people will still use them inappropriately. Can you expand on these 2 points? I'm still trying to wrap my head around passkeys and these are some of the arguments I see around but never quite explained.
From a certain perspective, passkeys are a lot like using "Sign in with Google/Apple/Microsoft account" Because if this passkey stuff takes off with normal people, 98% of passkeys will be stored in cloud accounts with those providers. The weakest link in the security chain is the procedure for when the user forgets their password / loses their phone / gets a rootkit / gets phished / has their e-mail compromised. You…
They will also (and primarily) be stored in the individual devices, and don't need cloud access to the providers in order to be used.
In this sense, it solves one of the main issues with third-party sign-in, i.e. that if the provider decides to lock your account, you get locked out of any linked services.
> You can transfer that problem from your site to a cloud provider
With passkeys? How so? Are passkeys not just cryptographic key pairs? If your service associates a certain account to a certain public key, there's nothing an external cloud provider can do to solve the issue you describe.
It's possible I've missed something, like I said before I'm still wrapping my head around the whole thing.