I wouldn’t be surprised if five years down the line companies figure out a way to use pass keys as a way to de-anonymize and track people.
Why? Just give them another passkey.
Usage isolation is 🥁 key.
The article is about the weakness of TOTP, not passkeys themselves.
My hackles starting to go up when I started to see more and more websites push for passkeys.
This is a very badly written article that conflates TOTP with passwords and then uses that to try to draw a line between totp and passkeys. Passkeys are limited in use in the exact same way that password are. The entity making the website gets to decide the rules.
Attested passkeys will not happen for common big tech websites because they wouldn’t completely prevent the use of password managers.
All these companies are pushing for passkeys because they not only are vastly better for security, but because they remove liability for these companies.
The author falls down the steepest slope I’ve ever seen writing this article, and still fails to see the basic facts.
Hardware Security Keys deployed to replace passwords is abuse.
They’re supposed to be a second factor.
No there ment to replace passwords but since you can fsll back to passwords kind of pointless. The other thing with them if you have a windows PC and an iPhone just supposed to generate separate passkeys.
No they’re supposed to replace them while incorporating a second factor
Password managers with totp seems like the best solution.
I wouldn’t recommend hardware security keys to others. It’s just a ticking time bomb before they loose it and get fucked.
I keep a backup one in my safe deposit box.
That’s the way to do it. But the reason passwords suck for laymen is because they’re lazy and irresponsible.
Therefore, I won’t recommended them to others. Because then it’s just a matter of time before they get super pissed at you and then return to using one password for everything that’s written down on paper somewhere near their computer
So every time you change a password or add an entry, you go to your safety deposit box?
I use a locally hosted password manager with a yubikey as 2fa
I don’t understand. Every time you add a site, you get a new private key that you need to backup still, no?
smartphones do use files and folders. They just don’t typically come with a file browser like your desktop does.
This is my biggest gripe about Android. It’s basically unusable.
Sure, I use Amaze from fdroid. But I tried to extract a compressed tarball and it literally couldn’t do it. And there were 0 apps in fdroid to extract compressed archives. What a useless OS.
Of you think Android is bad, wait until you see iOS…
Android also will enforce file permissions, and every app is its own user, and there’s no way to chmod. Firefox downloads things and saves them with no other permission, so other apps just cannot fucking see the file.
That’s not been my experience. Usually it gets put in the Downloads folder, and I can see it in amaze and then open it with other apps.
File managers can sometimes ignore file permissions. I don’t want to share a file through the file manager every fucking time
I agree with all the points made in this post except I’m troubled by the conclusion that we should let big tech decide a better solution. That puts the power right back with part of the consortium that was focused as part of the whole passkey issue here. Not saying I know what would be a better alternative but I don’t agree that that is it.
Yes, someone really made TOTP for Game Boy. I cannot in good conscience actually recommend using this, but it will make you popular at parties. (At my parties in any case.)
You kinda did recommend it in the last sentence :(
Every passkey I’ve tried to use simply doesn’t work and then I have to faff around recovering my account.
