[dead]
Passkeys will come at a cost
571–580 of 600 posts
Re: Passkeys will come at a cost
#572[dead]
Re: Passkeys will come at a cost
#573[dead]
Re: Passkeys will come at a cost
#574[dead]
Re: Passkeys will come at a cost
#575[dead]
Re: Passkeys will come at a cost
#576[dead]
Re: Passkeys will come at a cost
#577[dead]
Re: Passkeys will come at a cost
#578Earlier quoted context omitted.
Exactly, I'm seriously considering taking my business off google's ecosystem because of the unwanted "we've sent a notification to your phone" confirmation requirement. I could understand if they did that if I suddenly tried to login from the other side of the world, or let's say I always use Linux and suddenly my browser identifies as windows etc. But if you're running a privacy focused browsers (ungoogled chromium)…
> But if you're running a privacy focused browsers I'm sorry but I was with you until here. if you're going to run a privacy enhanced browser and then complain that it has a privacy enhancing features which result in providers being more cautious because you have privacy enhancing features, then I'm not sure how to help you. I run anti-google adware on my main browsing identity but when sites give me shit I just turn…
You have a point, but my complaint is that a service like Google shouldn't work based on a binary choice. You either use a persistent session cookie and you're logged in at all times (even if someone else launches your browser), or your session is 100% untrusted requiring both a password and your phone to confirm its you.
There should be a middle ground. If I'm logging back in 2 minutes later from the same IP, using the same browser on the same is, just ask for the password. Or even better let me choose if I want to use that "phone auth" option in the first place.
Re: Passkeys will come at a cost
#579Earlier quoted context omitted.
Exactly, I'm seriously considering taking my business off google's ecosystem because of the unwanted "we've sent a notification to your phone" confirmation requirement. I could understand if they did that if I suddenly tried to login from the other side of the world, or let's say I always use Linux and suddenly my browser identifies as windows etc. But if you're running a privacy focused browsers (ungoogled chromium)…
>Then the whole "answer some questions" dance starts. Google literally does provide you with backup codes that they tell you to keep offline available, which is pretty common practice for any 2FA scheme.
I have an account with backup 2fa accounts that I can't get into as Google insist on approving it on a dead phone because my geolocation is different to when I last logged in
Re: Passkeys will come at a cost
#580Earlier quoted context omitted.
> KeePass, which apparently supports them, who knew... Bitwarden, too. I no longer have to worry about not having my phone on me, or even having to take it out of my pocket.
>I no longer have to worry about not having my phone on me, or even having to take it out of my pocket. I mean, I appreciate the convenience but can't help feel like this is cheating... The whole point of 2fa was to verify you had the 2fa device and this basically defeats that.
A 2fa device, perhaps? Access to Bitwarden requires 2fa, and confers on the device I logged into the ability to 2fa for other purposes. I don't leave Bitwarden unlocked for more than a few seconds, so the two factors are "having a device on which I've logged into Bitwarden already" and either "being able to satisfy a biometric sensor" or "knowing my passphrase".
I do also have the ability to bootstrap Bitwarden access on a new device without an existing device -- the two factors then being "knowing my passphrase" and "having my security key".