61–70 of 212 posts
One day Authy for desktop was deprecated and all of a sudden I was forced to always have my smartphone with me, which I was struggling to replace with a dumbphone. To this day, I have no way out of owning an smartphone for this very reason
Earlier quoted context omitted.
Your fintech is probably not among the 99% accounts GP says don't warrant 'anything fancy'. IME as a customer/user, financial institutions are some of the worst culprits for doing appalling things in the name of security (theatre) anyway.
Yes, because financial institutions are responsible for losses incurred via account takeover.
Earlier quoted context omitted.
Passwords are a weak authentication mechanism and incur liability. MFA is good, Passkeys are better. One time passwords via email are tolerable, still better than passwords. (customer identity and access management is a component of my work at a fintech)
Your fintech is probably not among the 99% accounts GP says don't warrant 'anything fancy'. IME as a customer/user, financial institutions are some of the worst culprits for doing appalling things in the name of security (theatre) anyway.
Earlier quoted context omitted.
> Otherwise people would be tricked into giving away passkeys much like they are with passwords today. Is this really a common attack vector vs. a company leaking their whole customer database and a bunch of password being revealed that way?
Yes, it's called phishing.
Earlier quoted context omitted.
The other side of this is the Relying Party, a.k.a. the website operator that is relying on the user's password manager to be decently secure and resistant to phishing. Otherwise, why ditch passwords plus 2FA?
The website already has guarantees against phishing because those are enforced by the managers. What's prevented is the snooping case of taking an export and cloning it without the exporting manager being involved. This is essentially indistinguishable from many legitimate use cases like archival or access to deceased relatives' credentials, which users might want regardless of the website's preferences.
There is no such guarantee if credential-stealing malware can export your private key material in plaintext!
> there is effectively no way to export private keys between authentication password managers No exporting really is a feature. Otherwise people would be tricked into giving away passkeys much like they are with passwords today. You can always register multiple passkeys with providers though. Already have a passkey with google but want another one via a different password/account manager? Just go into settings on goo…
Just made the same comment, weird that its an unpopular opinion. Chalk it up to a UX issue around user expectations.
Earlier quoted context omitted.
Passwords are a weak authentication mechanism and incur liability. MFA is good, Passkeys are better. One time passwords via email are tolerable, still better than passwords. (customer identity and access management is a component of my work at a fintech)
Security-wise, passkeys are worse than username/password plus WebAuthn as the second factor.
Unfortunately the tech community is full of people who pride themselves on being aware of and advocating for the latest standard put out by whatever company. That's how we end up with lots of complicated nonsense like most of what is sent in HTTP headers, or the contents of a TLS certificate. On the topic of authentication, it's solved. SSH nailed it, any further complexity is strictly worse . Signing up is uploading…
@alphazard, what are your thoughts on using self-signed X.509 certs, since 95% of the infrastructure is already there?
The complexity of X.509 belongs in the domain name system. If a bunch of large corporations want to come up with complicated formats so they can decide who gets to call themselves what on the internet, let them do that, but don't let them complicate basic security for the rest of us.
The experience to beat is swapping SSH keys. 95% of developers have setup access to a new machine using SSH. That should be the default experience for authenticating on the internet, and anything more complicated should be strictly opt-in.
One day Authy for desktop was deprecated and all of a sudden I was forced to always have my smartphone with me, which I was struggling to replace with a dumbphone. To this day, I have no way out of owning an smartphone for this very reason
I assume you were using Authy desktop for TOTP? You don't need a smartphone for storing TOTP seeds or generating TOTP codes.
One day Authy for desktop was deprecated and all of a sudden I was forced to always have my smartphone with me, which I was struggling to replace with a dumbphone. To this day, I have no way out of owning an smartphone for this very reason
Are there many sites that only support Authy's push authentication and nothing else?