Monopolies were shitting, are shitting and will be shitting on community standards. There will be no end to this until a radical change in the societal mindset.
Passkeys will come at a cost
81–90 of 600 posts
Re: Passkeys will come at a cost
#82That's a rather uncharitable take on the situation. I'll propose an alternative: If you want to take advantage of the new auth standard that will eliminate weak passwords and password reuse (thereby preventing 99% of casual account break-ins), you'll have to spend $30 to upgrade off the legacy yubikey you've been coasting on since 2013.
Why should I be forced to upgrade? Non-resident keys also eliminate weak passwords and password reuse. Using resident keys only add marginal improvement (ie. you can plug in a key and the service knows which account it belongs to), and that doesn't seem like a good justification to deprecate all the existing authenticators in use today.
Maybe not for us, but for the vast majority of users, they'd pick not having to remember a username OR password for sure.
Re: Passkeys will come at a cost
#83> rk=required why does that even exist, that shouldn't be an option this stuff is why I have been so worried/skeptical about Passkeys and the people related to it. They have the responsibility to design their protocols to not be a tool well suited for big coperations like Microsoft to seriously mess up security, compatibility and enact all kinds of "bad faith" market practices to kill competition. But instead again a…
> how attestation is handled (and can be trivially abused to kill companies) What's this issue?
Hardware tokens (Yubikeys, etc) are signed by their vendor. They support attestation which allows q site to disallow vendors not in a white list. Some banks (Vanguard was/is one) actually enforce this preventing all but a handful of hardware keys from working with their 2FA.
Re: Passkeys will come at a cost
#84Is it even a good idea to use physical security keys as passkeys in the first place? Passkeys are meant to be a password _replacement_, and for that you probably want the 2-factor properties afforded by phones or desktops which usually require "something you know" or "something you are" to unlock in addition to the "something you have" afforded by physically possessing them. IMO physical security keys are better left…
If you think about it, the core problem can be described as "authentication of the biological being with an electronic system".
When passwords are used, the authentication interface is a keyboard and you don't have any actual guarantees that the person typing the password is the person who claims to be. The passwords could have been extracted in so many ways because it depends on easily transferable knowledge.
Moving the authentication interface to device2device is actually much better, you no longer assume that the easily transferable knowledge was not transferred. Instead, you assume that the biological being is capable of keeping track of the authentication device and people are naturally good at it.
You can increase the number of authentication channels to tighten it up a bit, you can restrict the authentication of the biological being with the device(FaceID) which will be used for authentication with remote systems but at the core I think it feels right to assume device(phone, key etc.) means the person.
It's also quite a human thing to do. At home, we share not only the Netflix password but one of the credit cards. For practical reason, one credit card stays with the spare keys and when there's something to buy for the house anyone can grab that card and use it. We trust each other that the card would be used properly, everyone knows the pin code but that's rarely needed since contactless payment is the norm anyway. It's much more natural than keeping track of the expenses and then pay each other the outstanding amounts. However, It's probably illegal and if the bank finds out about it, they will cancel the card.
IMHO, the IT systems desperately need to approach human behaviour by working in analogous ways with the real world. Since I'm involved with IT systems I don't struggle most of the time but people who are not that tech savvy are having hard time figuring out daily stuff like What is the iPhone's password for, What is the iCloud password for, what is the Gmail password for, why I need to enter a code in WhatsApp etc.
Actually, I think I struggle too - I never came along to understand Mastadon. I'm prbably defenceless against phishing attacks on Mastadon, I will type whatever the screen tells me to type.
Re: Passkeys will come at a cost
#85Earlier quoted context omitted.
I think the key (pun not intended) differences are that phones are something you'll always have on your person, Apple/Google will allow it to sync across devices, and phones require a pin/biometrics to authenticate with them.
Have you not heard of "SIM swapping?" [0] The FBI (US) receives thousands of complaints, which I'm guessing means it's orders of magnitude more common. [0] https://blog.mozilla.org/en/privacy-security/mozilla-explain...
Using phones as physical security keys != using SMS for 2FA.
Re: Passkeys will come at a cost
#86Earlier quoted context omitted.
I would go as far and say it's a too charitable take. Shared residual keys _should not exist_ (outside of short term temporary usage, e.g. not 2FA/FIDO). They are a liability, they are a security risk, they promote bad security practices. Best example TOTP (which from a security POV is quite flawed). You don't want to ever share the shared secret across devices (or back it up) but due to it being possible and flawed…
> You don't want to ever share the shared secret across devices (or back it up) Hard disagree there. I do not feel comfortable unless I can backup a key. Phones get lost/broken/stolen all the time. Is it less theoretically secure? Sure, whatever, but I am not James Bond.
The point is you would have a different key on different devices, each of which can access your account. This gives you a backup, in fact a better one, because if one is comprimised and locked out you can still use the others. The main challenge is automating this process so you can properly mirror your keyring across multiple devices, which I don't think there's a standard solution to. So it would be a manual process for each account, which kinda sucks.
Re: Passkeys will come at a cost
#87Earlier quoted context omitted.
I think the key (pun not intended) differences are that phones are something you'll always have on your person, Apple/Google will allow it to sync across devices, and phones require a pin/biometrics to authenticate with them.
Have you not heard of "SIM swapping?" [0] The FBI (US) receives thousands of complaints, which I'm guessing means it's orders of magnitude more common. [0] https://blog.mozilla.org/en/privacy-security/mozilla-explain...
SIM swapping lets you take over a phone number. It does not let you clone the keys stored in your physical phone’s secure storage / enclave / key storage.
So SIM swapping makes SMS verification vulnerable (that just depends on controlling the phone number), but doesn’t fundamentally affect iPhone/Android passkeys.
Re: Passkeys will come at a cost
#88Earlier quoted context omitted.
I think the key (pun not intended) differences are that phones are something you'll always have on your person, Apple/Google will allow it to sync across devices, and phones require a pin/biometrics to authenticate with them.
Have you not heard of "SIM swapping?" [0] The FBI (US) receives thousands of complaints, which I'm guessing means it's orders of magnitude more common. [0] https://blog.mozilla.org/en/privacy-security/mozilla-explain...
sim swapping doesn't move the authenticator app to the attackers phone, only your phone number.
this is why SMS-based 2nd factor has been considered insecure for years.
Re: Passkeys will come at a cost
#89Passkeys make no sense. Its selling you something you already own, since a fingerprint or a retina scan makes a fine good two factor as well.
What's your game plan for replacing your retina or fingerprints if compromised?
Biodata is the least secure because it can't be easily changed and the technology already exists to compromise them.
Re: Passkeys will come at a cost
#90Earlier quoted context omitted.
are there many places that use passkey yet? i've not encountered one, or rather not seen a place to make use of it
This website has a list of sites allegedly supporting passkeys: https://passkeys.directory I say "allegedly", because a few of them (Paypal, eBay, a couple others) have never once offered to let me use a passkey. Sites I know, off the top of my head (because I used them in the past 24 hours): * Porkbun * Google * GitHub (if you enable the preview feature) I know I've used more, but I don't have an easy way of searchi…
eBay and Paypal do, though I don't know how to get it to prompt you to configure a passkey...