91–100 of 212 posts
Earlier quoted context omitted.
I assume you were using Authy desktop for TOTP? You don't need a smartphone for storing TOTP seeds or generating TOTP codes.
Indeed, but I have like 40 different cloud providers, social networks and SaaS' which would be a pain to migrate
Signing into my accounts on my children’s devices has turned from a straightforward process to an incredibly frustrating experience. I find myself juggling all kinds of different apps and flows. This strikes home for me, I'm the main gatekeeper of passwords and service accounts in my home. 2FA and passkeys are so annoying to juggle. My kids use prepaid numbers, once I changed one and forgot to tell Apple, when I real…
Passwords + OTP (stored in keepass or somewhere) is the win for me. Everything else is a security theatre and an UX pain.
> One slightly more concerning issue today is that there is effectively no way to export private keys between authentication password managers Not being able to use the passkey manager at all is a bigger concern. For example Keepassxc works with some sites but not with others. It's super annoying and way worse than situation with passwords.
Signing into my accounts on my children’s devices has turned from a straightforward process to an incredibly frustrating experience. I find myself juggling all kinds of different apps and flows. This strikes home for me, I'm the main gatekeeper of passwords and service accounts in my home. 2FA and passkeys are so annoying to juggle. My kids use prepaid numbers, once I changed one and forgot to tell Apple, when I real…
It makes sense to keep printed backups of certain keys and passwords in a physically secure location, accessible to the people you trust in case of an emergency.
For example https://shamir.securitytools.io/
> An attempt by an open source password manager to provide export of private keys was ruled insecure and should not be supported. The name of the issue reveals the actual problem: "should never be exported in clear text". If the export was encrypted with a passphrase in a standard format, then there would be no issue. It's specifically doing it in plain text that causes consternation. Of course, in practice it doesn'…
Where is the line exactly though? If the password manager put up a big red notice when trying to export in plain text is that enough? If not, why not? I am sympathetic to the intent but the words of Patrick Henry come to mind too often in conversations like these. I love passkeys and appreciate secure defaults but I feel strongly that user freedom is a more fundamental requirement than preventing phishing attacks.
What do security professionals think about passkeys? In particular, those who were not involved in designing them. Lots of the arguments in this article feel very much like the sort of thing one would expect from someone into open source (not saying they are wrong, and I think they are well explained here) but I feel they will inevitably be the product of different concerns than those a security practitioner might ha…
The downside is of course that hardware keys are typically not cheap and you should also buy a backup key. Another unnecessary downside is that certain companies like Microsoft require the use of resident keys, which take up storage space on the hardware key. The better alternative is non-resident keys, of which you can have an infinite number on your key.
Earlier quoted context omitted.
I assume you were using Authy desktop for TOTP? You don't need a smartphone for storing TOTP seeds or generating TOTP codes.
Indeed, but I have like 40 different cloud providers, social networks and SaaS' which would be a pain to migrate
Same when I got my Yubikeys: I gradually moved the OTP seeds to them, wasn't that painful.
Earlier quoted context omitted.
> Signing in is cryptographically signing a commitment to the current ephemeral tunnel. I can see how SSH could be used for authentication on the web. And I have no doubt that it would be sound out-of-the-box. But I am not sure what you mean by your last sentence. Do you mean that authentication targets are gated and only reachable by establishing a tunnel via some kind of forwarding? Aside from the wonderful possibi…
> authentication targets are gated and only reachable by establishing a tunnel via some kind of forwarding? No, it's just how you authenticate with signing keys. Given that a secure channel has been set up with ephemeral keys, you can sign a commitment to the channel (like the hash of the shared secret key) to prove who you are to the other party. > let users authenticate via SSH and then return a short-lived token t…
And WebAuthn is using FIDO2, it's not that different, it's just that WebAuthn adds some stuff like a relying party.
Unfortunately the tech community is full of people who pride themselves on being aware of and advocating for the latest standard put out by whatever company. That's how we end up with lots of complicated nonsense like most of what is sent in HTTP headers, or the contents of a TLS certificate. On the topic of authentication, it's solved. SSH nailed it, any further complexity is strictly worse . Signing up is uploading…
"Solved" doesn't mean anything unless you have implementation/adoption.
WebAuthn helps prevent just that.