51–60 of 70 posts
I've only heard bad things about privacyguides.org. https://www.reddit.com/r/PrivacyGuides/comments/thnjjf/priva...
https://www.reddit.com/r/PrivacyGuides/comments/thnjjf/comme...
I really don't want to use Passkeys until they can be stored in my password manager of choice on Linux, Android and Windows.
What? Who wrote this?
Earlier quoted context omitted.
Well, it's true that a password manager is a single point of failure. If you have two password managers then they can serve as backups for each other. Unfortunately that means you have to register each account twice.
Just use a password manager that allows you to have a local copy of everything (e.g. KeePass) and just back it up as any other file
The article praises passkeys for not even needing email for login, but omits to mention recovery flow. How do you recover your account if you lost your access to the passkey provider, and you didn't provide an email address? So, I think "not even needing email" is unlikely for foreseeable future, unless we find other ways to authenticate people reliably.
Earlier quoted context omitted.
What if the provider of the major implementation decides to shut you out of your account?
That depends on whether you need to have an active account to use your existing devices. For example, an Apple user would need to migrate before things fall out of sync but they have a full copy on every device. The fallback path here is what you’d do with any other MFA loss. It’s not a federated login system so you’d be looking at some kind of account recovery process for each of the sites where you used your passke…
Earlier quoted context omitted.
Closer to having your existed devices work similar to a yubikey: it’s a signed challenge-response, per-site, instead of a single shared key.
That and the hypothetical ability to use different private keys per device, which could be canceled in case of loss or theft, seems legitimately useful. Not interested unless and until there's a standalone, standardized, open-source, cold-backup'ed way to use passkeys though.
Earlier quoted context omitted.
Passwords are still leakable, guessable, and can be phished. Passkeys are “second-factor-only”: your device responds to a challenge and acts in a similar capacity to a yubikey. The private keys contain much more entropy than a password, never leave the device, and the challenges and responses are both signed with site-specific keys so they can’t be phished. So from a security perspective, a lot is gained. From a user…
Until you lose the device. Or you're given security codes and those are again, leakable and guessable. No normal user is going to accept their phone being stolen and losing access to their bank account. It's bitcoin as unregulated fiat levels of wishful thinking
Using something like KeepassXC puts you in charge of your own backups.
I’m sure we can all find people for whom one or the other would be preferable.