I just "lost access" to passkeys.io while trying out passkeys. My phones Bluetooth was switched off, and by the time my phone created and saved a passkey, it timed out on the computer. So now I can't login with that passkey and it only fails. Seems like I'm locked out now...
Passwords Are Fine
141–150 of 169 posts
Re: Passwords Are Fine
#142Re: Passwords Are Fine
#143"I guess the point I'm trying to make here is that the problem with passwords is password hygiene, not with the method itself" Clearly this guy has never got his password sniffed before, or even heard about it. It's always painful to see someone who doesn't understand something talking about it, and worse, badmouthing it. And, "Notice that all of these problems are solved by fairly simple password hygiene" Clearly th…
It doesn't sound like you actually use 2FA, it sounds like you use 1FA plus a formality-password, where the "second factor" is the only one that matters. so it's 1FA.
Re: Passwords Are Fine
#144I like 2FA with an app, not so much SMS.
I really hate all these other trends I keep seeing. Log ins only using Magic Links in emails, which is an ENORMOUS pain in the ass, and now I often have to log in to another service as well.
Or this weird thing sites are doing lately, where the log in page just asks for a username, then loads a second page with the password box. Like WTF is that even accomplishing besides sometimes confusing my password manager. Why do we need this weird intermediate step at all?
Re: Passwords Are Fine
#145Earlier quoted context omitted.
I have a dumbphone. Until recently I could not care less about losing it. But I realised that since it's not PIN protected (I could but don't want to do it), losing is a security issue. People can find my phone, match my phone number to my email address using leaked data, try these credentials on different services and wait until they get a reset password SMS. So by forcing me to add my phone number some services act…
>I have a dumbphone. Until recently I could not care less about losing it. But I realised that since it's not PIN protected (I could but don't want to do it), losing is a security issue. This really isn't a dumb phone specific issue. Even for smartphones if someone stole it they could pop out the sim and if it isn't password protected (most aren't IME), they'll have full access to your phone number.
> pop out the sim and if it isn't password protected (most aren't IME), they'll have full access to your phone number.
Can they do this without connecting to a cell tower? Otherwise, the carrier would notice the pairing of your SIM to the new IMEI, and further security steps would be possible.
Re: Passwords Are Fine
#146Earlier quoted context omitted.
> 98% of passkeys will be stored in cloud accounts with those providers. They will also (and primarily) be stored in the individual devices, and don't need cloud access to the providers in order to be used. In this sense, it solves one of the main issues with third-party sign-in, i.e. that if the provider decides to lock your account, you get locked out of any linked services. > You can transfer that problem from you…
> If your service associates a certain account to a certain public key, there's nothing an external cloud provider can do to solve the issue you describe. Without passkeys, if one of my users lost their "second factor" (e.g. lost phone) I had to provide a flow for them to get into their account despite that, while remaining secure. With passkeys, users can restore their "second factor" from a cloud backup, so long as…
[deleted]
Re: Passwords Are Fine
#147Earlier quoted context omitted.
There's absolutely no reason why you'd need a phone for most services. TOTP generators exist for every device and every platform. Some password managers even automatically copy a TOTP code after autofilling a password field. Of course, you'd lose most security benefits of TOTP, but if all you want is to ignore security concerns and log in without a phone, there are tons of ways to accomplish this. Just set up authy o…
Realistically speaking, the vast majority of the security benefit of TOTP in the wild is "the user doesn't get to choose a weak password", followed by "the persistent secret isn't getting sent over the wire"; being an additional "factor" is faaaar in the distance.
I think the advantage is that users suck at picking passwords, refuse to learn how to use a password manager, so TOTP is there to make sure that even if people set Welcome2023 as their password, some credential stuffer can't log in to their remote desktop because they need an extra six digits to log in.
You'll get the best security if you don't have the TOTP secret on a device that also contains your passwords, just in case you get hacked, but even with TOTP on-device it provides a little bonus security.
Re: Passwords Are Fine
#148> 2. People don't have their phone on them all the time (and some don't even have a smartphone). I live in rural Western Australia with almost zero phone coverage, and this is a huge problem. I'm terrified of all these services wanting my phone number, or bugging me to turn on phone 2FA, because the moment that happens, I lose access to that service . ChatGPT that everyone is spamming on every discussion? I can't eve…
Living on a boat last year, I had a similar problem: we had internet access, but no phone service. Getting into my bank account, or any financial account, became a righteous nuisance; I had to drive inland until I found cell service, use my phone as a hotspot, attempt to log in, then wait for the SMS. Realize after getting home that there was another bill to pay? Oops, guess you're driving back into town again!
Re: Passwords Are Fine
#149Earlier quoted context omitted.
>I have a dumbphone. Until recently I could not care less about losing it. But I realised that since it's not PIN protected (I could but don't want to do it), losing is a security issue. This really isn't a dumb phone specific issue. Even for smartphones if someone stole it they could pop out the sim and if it isn't password protected (most aren't IME), they'll have full access to your phone number.
> pop out the sim and if it isn't password protected (most aren't IME), they'll have full access to your phone number. Can they do this without connecting to a cell tower? Otherwise, the carrier would notice the pairing of your SIM to the new IMEI, and further security steps would be possible.
While what you described is theoretically possible, I've never seen any mobile provider implement it. The reason is fairly simple: if you cared about the security of your sim, you'd set a sim pin. If you don't, you don't set a pin. Requiring reauthentication every time your IMEI is going to cause a massive increase in support calls for very little security gain.
Re: Passwords Are Fine
#150I like 2FA with an app, not so much SMS. I really hate all these other trends I keep seeing. Log ins only using Magic Links in emails, which is an ENORMOUS pain in the ass, and now I often have to log in to another service as well. Or this weird thing sites are doing lately, where the log in page just asks for a username, then loads a second page with the password box. Like WTF is that even accomplishing besides some…
this is very often so the service can choose if you have a regular password or need to be redirected to an external SSO service (though i guess it's not the only case)
(not that i like it.)