111–120 of 212 posts
Exporting passkeys is the single required feature for me to start using them more. The "anti phishing" push has really gotten a little too crazy. It seems mostly related to our legal inability to push security responsibility onto consumers.
So yeah, you can have whichever you want, nothing prevents it!
> Obviously, one could pay for an authenticator like 1Password, which at least is ecosystem independent. However, not everybody is in a situation where they can afford to pay for basic services like password managers This argument was made in the context of moving out of the Apple ecosystem (are there other ecosystems one would want to leave where the only option is paying for something like 1password?). I don’t real…
You lose your job.
Earlier quoted context omitted.
> KeyPassX supports passkeys and allows you to export them as you wish. The last time I tried to use passkeys, the desktop was easy. What about mobile? There wasn't a local third-party password manager that could work with passkeys on Android.
> There wasn't a local third-party password manager that could work with passkeys on Android. sounds like you found yourself a market opportunity…
This. All of this. Passkeys are a great idea, but the walled gardens are a huge problem. Also, services placing additional requirements (e.g., attestations) that potentially violate your privacy and anonymity. Just now, at least in Europe, there is a huge push to force users to authenticate themselves with their actual identity, even for ordinary Internet services. This is happening simultaneously in many countries (…
But passkeys are just a way of democratising private keys instead of passwords.
Sure, there will be examples of walled gardens leveraging passkeys. But we have plenty of examples of walled gardens that don't need passkeys at all. It's a different problem.
Earlier quoted context omitted.
It's not just that. There's a huge lack of trust with the tech industry. I don't think anyone trusts tech companies to act in the user's best interests with this kind of restriction instead of using it to drive more platform or service lock-in.
I get the lack of trust with TooBigTech, but I personally use passkeys with security keys (Yubikeys). WebAuthn is just a bunch of protocols that can run independently from TooBigTech.
Earlier quoted context omitted.
The walls are going to come down. KeyPassX supports passkeys and allows you to export them as you wish. 1Password and Apple Passwords have both said they're going to support exporting and importing of passkeys. Yes, it's awful during the transition period while the tech matures, but there is a path towards a great future.
> KeyPassX supports passkeys and allows you to export them as you wish. The last time I tried to use passkeys, the desktop was easy. What about mobile? There wasn't a local third-party password manager that could work with passkeys on Android.
Earlier quoted context omitted.
A service that lets you sign up by uploading a SSH public key could just as well let you upload multiple public keys in your profile to be able to connect from other devices.
Amazing, just like passkeys!
With passkeys, the private key must be present and usable (at least with current implementations) at the time of enrolment.
This raises a major problem: with SSH keys you can keep an backup key in a secure location (bank vault, etc) and still be able to register it. With passkeys your backup key must be present and connected when registering it, so you can’t keep it in a secure location as you always need it when registering. This exposes both keys to risks such as hardware failure (let’s say faulty USB port that spikes anything plugged in with 12V… you connect your main key, it doesn’t work, now you connect your backup key and same thing happens… by the time you realize both your primary and backup keys are toast).
Earlier quoted context omitted.
Your fintech is probably not among the 99% accounts GP says don't warrant 'anything fancy'. IME as a customer/user, financial institutions are some of the worst culprits for doing appalling things in the name of security (theatre) anyway.
Yes, because financial institutions are responsible for losses incurred via account takeover.
Unfortunately the tech community is full of people who pride themselves on being aware of and advocating for the latest standard put out by whatever company. That's how we end up with lots of complicated nonsense like most of what is sent in HTTP headers, or the contents of a TLS certificate. On the topic of authentication, it's solved. SSH nailed it, any further complexity is strictly worse . Signing up is uploading…
ssh is terribly insecure with no way of checking server certificate fingerprint automatically. Web solved it decades ago with CA.
Earlier quoted context omitted.
ssh is terribly insecure with no way of checking server certificate fingerprint automatically. Web solved it decades ago with CA.
OpenSSH supports DNSSEC-published host key fingerprints.
Tying authenticity to a global, remote set of authorities is a tradeoff we make for anonymous introductions to random web servers whenever we need them. SSH doesn't have that problem, so the tradeoff gets you... nothing?