171–180 of 212 posts
One day Authy for desktop was deprecated and all of a sudden I was forced to always have my smartphone with me, which I was struggling to replace with a dumbphone. To this day, I have no way out of owning an smartphone for this very reason
Earlier quoted context omitted.
Ill maintain that family management of access control is one of the most broken things on the internet. Not only does 2fa make granting access on other devices a nightmare, but then each developer has its own version of parental controls. ALL of account permissions, relations to other accounts, and authentication should be an exposed api that rolls up into a single dashboard. I should be able to go into one single co…
That basically does exist, and it’s called SSO. SSO providers (eg Okta) have a unified dashboard where you can control who can access what, and at what level, and can revoke access any time. It’d be nice if there was a version of that for families that wasn’t insanely expensive. Anyways, 1Password completely solves this problem for me with me & my wife.
It also doesn’t begin to cover notifications. For some reason most services seem to think only one parent is in charge and both don’t need equal access and equal notice.
Earlier quoted context omitted.
> Passkeys mean that most people can just FaceID or their fingerprint everywhere and they are happy. They are happy to be locked in if it just works. Yeah, because people are stupid. Heading towards a future where you need to use government-approved devices which are tied to your real identity to access the internet is a recipe for disaster.
> Heading towards a future where you need to use government-approved devices which are tied to your real identity to access the internet is a recipe for disaster. That's unrelated to passkeys. When you use your credit card to pay online, it's tied to your real identity. Many countries offered to do a lot of official stuff online (like taxes) long before passkeys.
The reality is that many passkey implementations right now come with attestation and are closed off. That's simply not possible with passwords.
Passwords, as a concept, just can't be abused in that way. Because they're just strings of text. Passkeys, however, CAN be - and we're already seeing that happen.
It could reverse course, but then it would need to reverse course and stay reversed. Forever. Even though there's lots of money and control being left on the table.
That's a big problem.
Earlier quoted context omitted.
> Heading towards a future where you need to use government-approved devices which are tied to your real identity to access the internet is a recipe for disaster. That's unrelated to passkeys. When you use your credit card to pay online, it's tied to your real identity. Many countries offered to do a lot of official stuff online (like taxes) long before passkeys.
No, it's very much related, although not guaranteed. The reality is that many passkey implementations right now come with attestation and are closed off. That's simply not possible with passwords. Passwords, as a concept, just can't be abused in that way. Because they're just strings of text. Passkeys, however, CAN be - and we're already seeing that happen. It could reverse course, but then it would need to reverse c…
Well, not with only the password, but with the mandatory 2FA app that comes with it, it's definitely possible. Source: my company does that.
And you can most definitely request the real ID before you let someone create an account, password or passkey.
I don't see a difference.
Earlier quoted context omitted.
My values are such that it’s inappropriate for a few folks at companies and random consortiums to make that decision on behalf of all society. If KeepassXC wanted to enforce that world view for the safety of their users, it’s their right, but this is essentially a threat of blacklisting an entire password manager for adding a feature demanded by their users (who likely predominantly used by technically savvy users at…
> but this is essentially a threat of blacklisting an entire password manager I don't think they could blacklist the entire password manager. They can't prevent it from giving you a username/password... Refusing some passkeys is, to me, similar to refusing passwords that are too short. It may make sense to only accept passkeys backed by a secure element. Companies already force their employees to use a specific MFA a…
Earlier quoted context omitted.
Passwords + OTP (stored in keepass or somewhere) is the win for me. Everything else is a security theatre and an UX pain.
Passkeys is not security theatre, and also not a UX pain if you use a password manager. Turns out it’s nice to have a standardized API for submitting a credential to a website rather than relying on browser extensions to hopefully guess the input field is for a password. (Not to mention the multitude of sites that don’t properly handle text being autofilled)
1. It forces the use of keys with a reasonable amount of entropy, and the use of a password manager to access them. 2. They will not make it easy to use a key with the wrong site (also true of a good password manager). 3. Uses public/private keypair so key itself is never sent over the wire (even encrypted).
The real question is whether these properties are worth all the costs (enumerated in this article).
What do security professionals think about passkeys? In particular, those who were not involved in designing them. Lots of the arguments in this article feel very much like the sort of thing one would expect from someone into open source (not saying they are wrong, and I think they are well explained here) but I feel they will inevitably be the product of different concerns than those a security practitioner might ha…
Passkeys are absolutely fantastic. Pretty much every complaint you see in these threads is seen as a positive in an enterprise context.
> Attestation restricts passkey clients
GOOD. I need a way to prove passkeys live on hardware-backed crypto devices (see NIST SP 800-63B), attestation makes that possible.
> But auth lock-in
GOOD. All our corporate sign-in events should be through our single IDP using SSO. Of course we want lock-in.
> But I can't sign in to my children's devices
GOOD. An identity represents a entity, it should be impossible for you to pretend to be another entity, regardless of whether they're a child or dog or whatever. If you need "parental access" or similar to some accounts, contact your service provider and ask for that feature.
> It's hard to export my passkeys
GOOD. Encrypted or not, a core security tenet is "a private key should never leave the device it was generated on" (hence the existence of HSMs, TPMs, etc). It should absolutely be impossible to ship your private keys around. Further, the primary appeal of passkeys in our context is phishing resistance, and it should be technologically impossible for a user to get bamboozled into exporting and sending their passkey to an adversary.
> But I need my backups
Why? Just contact IT if you lose your credentials. If you're on the personal side and don't have an IT authority, you should just generate passkeys on multiple devices and add all of them to your accounts.
> But that's a pain
Security is almost always inversely proportional to convenience.
Earlier quoted context omitted.
The walls are going to come down. KeyPassX supports passkeys and allows you to export them as you wish. 1Password and Apple Passwords have both said they're going to support exporting and importing of passkeys. Yes, it's awful during the transition period while the tech matures, but there is a path towards a great future.
> KeyPassX supports passkeys and allows you to export them as you wish. The last time I tried to use passkeys, the desktop was easy. What about mobile? There wasn't a local third-party password manager that could work with passkeys on Android.
Earlier quoted context omitted.
you're spot on. everyone here "keepassX works for me" are just frogs being slow boiled. passkey are designed in a ways that the attestation party is visible. Tomorrow the coordinated effort will say "too much fraud from providers other than google and apple, sorry" (or something about protecting kids).
> passkey are designed in a ways that the attestation party is visible Are you talking about the relying party? I don't think it works the way you describe...
> An attempt by an open source password manager to provide export of private keys was ruled insecure and should not be supported. The name of the issue reveals the actual problem: "should never be exported in clear text". If the export was encrypted with a passphrase in a standard format, then there would be no issue. It's specifically doing it in plain text that causes consternation. Of course, in practice it doesn'…