this post was submitted on 11 Oct 2023
286 points (98.0% liked)
Technology
71718 readers
3475 users here now
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related news or articles.
- Be excellent to each other!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, this includes using AI responses and summaries. To ask if your bot can be added please contact a mod.
- Check for duplicates before posting, duplicates may be removed
- Accounts 7 days and younger will have their posts automatically removed.
Approved Bots
founded 2 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
It's definitely more secure, since stealing someone's phone is much more difficult to scale up compared to stealing passwords.
I don't think that access to your personal data/email/files being dependent on a battery-powered electronic device is a great idea, to be honest.
That's why they invented chargers, eh.
But more seriously, there are recovery procedures if you lose a phone with or without a backup and if you are willing to share the keys with a cloud provider, you can also store them there and use them on any of your devices.
Or you can get something like a yubikey if the battery aspect is really that problematic for you.
The fact is that I fail to see something obviously wrong with outrageously long/complicated passwords managed by e.g. Bitwarden or the likes.
Long passwords can still be phished. Passkeys cannot. It's a huge upgrade.
I don't think so, but whatever.
What do you mean? Do you not believe the anti-phishing features will work as described for a reason?
Bitwarden is also supporting passkeys, so it won't make a difference for their users whether they use passwords or passkeys.
And the fact that you don't see anything wrong is more a you problem. Boomer mentality, dude. Don't became one.
It would probably be better for you to explain what's wrong and not just call them a boomer as if that explains it.
If they want to be a Boomer and stick to 20th century solutions, why should I care?
If it works for them, fine. Nothing wrong with that.
It's obviously not working for most people. Most people reuse weak passwords and get their passwords hacked. Passkeys solve that for those users.
That's why the whole industry is shifting to passkeys.
"It's old so it's bad" is not a very convincing argument.
I think he was wondering how technically the new solution is better, especially compared to password database solutions where complex password and password reuse isn't an issue.
Webauthn has domain bindings and single use challenges which prevents MITM credential stealing, etc
I said the exact opposite. If the old thing works for you, go ahead and stay on it, but don't complain about the rest of the world improving and moving forward.
Why put quotes when you are misquoting...
And I answered him, he just doesn't want to know. I can't solve that.
You're mentioning how it's an old solution as if that was some sort of argument. If you're not using it as an argument then it seems kinda pointless to bring it up.
I'm not sure if you even realize you're doing it but you're doing it again, implying that it's better because it's newer. That's not a very solid argument.
I know you've mentioned some aspects but I'm still wondering, in your opinion, what would be the technical reason that the password database model with long and complicated passwords would be worse than the passkey setup. Or is it that they're as good but passkey might be a lot simpler to some folk?
Sorry, your arguing against some strawman here.
Keep using passwords if that's your preferred solution.
Not my beef if you can't see how MFA is stronger than something that can be copy-pasted in a MITM attack.
Would be a lot easier to see it if you tried to actually explain your position tbh
I did.
Passkeys = open standard, more secure by design, multi-factor.
Passwords = bad track record, easily compromised.
Can't dumb it down much more than that chief.
Password databases can have MFA too. Passkeys by default (on Google's implementation) seem to rely on just the device pin.
That's not really something they have over passwords lol.
I mean passkeys are so new thet don't have a track record. So hard to compare on those merits. What do you mean easily compromised, exactly? Compared to password database model.
You clearly lack imagination. Passkey = more secure password less secure is much more dumbed down.
But I didn't want you to dumb it down, I wanted you to expand on what you said and be more specific and technical. How are you still not getting what people's gripe with your comments is lol
People are down voting because they have issues and I don't have the patience to entertain them.
Fuck it, keep using passwords, don't get vaccines and don't drink fluoridated water.
I don't give a shit.
Seems like you do give a few shits but not enough to clarify your reasoning I guess.
Ive read all your comments, and it just sounds like you have no idea why its better. Its like someone told you its better and gave you a few buzzwords, and youre just parroting it.
I dunno man, if you cant explain the difference between the two maybe you shouldnt be insulting boomers, since you sound just like one
If you read all my comments on this Lemmy post (and not just this single comment thread were it was just me engaging in a flame war with a few idiotd) and you still don't understand why passkeys are better, then I can't help you.
Yeah, but I think thats more your failing than mine
Ok bro
It kinda sounds like you dont actually know whats wrong, and are just blindly following the trends.
Doesnt that make you the boomer?
Sure. I am become the Boomer lol.
oh man. so I am a boomer. good to know.
What do you see that's wrong with it that we don't if I may ask?
Mostly phishing. Passkeys can’t be phished. And really, passwords are awful in general for security purposes. You don’t have to use your phone or google or apple or whatever.
I actually have a physical usb key that I use as a passkey. Its just a more secure login implementation and will likely be the only option in the future.
Passkeys can be phished, it’s just much more difficult than with passwords, TOTP MFA, SMS MFA, other OTPs, or push notification-based MFA (e.g., Duo or the way Microsoft, Apple, and Google push a notification to their app and you confirm and/or enter the key).
Passkey is extremely phishing resistant in the same as Webauthn MFA and U2F MFA are, in that origin checks by the browser prevent attackers from initiating the auth process. But it can still be attacked in these ways:
From memory, passkeys, webauthn, and u2f should prevent over 99% of phishing attacks that are successful without them in place.
There’s also the risk of the passkey itself being compromised, though that level of risk is dependent on your device / how you’re storing your passkeys and isn’t a “phishing” risk.
The main point is all those attacks need to attack the local software or hardware implementation on one of the two ends (or a cert issuer), and even then it's replay protected so for example an XSS attack lasts only for one session, so it's more robust.
Correct, but that doesn’t change the fact that “Passkeys can’t be phished” is not true.
My understanding of Apple Keychain is that every credential is useable from every device, and can be backed up and restored to a new device. Most importantly Apple doesn’t have access, although we have to trust them on that
It's not quite unique to a specific device. You can store your private key in a password manager or something similar, and then access it from other devices
Depends on your personal choice. You can definitely limit them to a single, hardeneddevice if you want the highest level of security.
For most users and most situations, a synced solution will be preferable.
But it becomes much easier if you want to compromise a specific target individual
No, not really.
Even if you want to target a specific user, it doesn't become necessarily easier.
Unless you happen to target an individual that combines good password OpSec with shitty phone OpSec.
But I would expect those to be a minority.
Hi, yes, I am that minority
I have a 37 character password with both cases, numbers and special characters to login to my pw vault using long random strings
My phone has a swipe pattern lock since that is the safest lock option it allows in the first place. I wish I could lock it better, but the only other options available to me are a 4 character pin, and fingerprints/facial scan. I hope the problems with those are obvious
Couple that with the fact that I have a daily predictable commute in public transit where I have a habit to put my phone next to me during breakfast and you have a recipe for disaster.
You can still use a 37 character password to protect your passkeys in your pw vault, so it's not like anyone is forcing you to change.
It's still a single factor though. The number of times I have had to lecture IT admins that their 64 character passwords was compromised by a keylogger and that they need to move towards MFA is too damn high.
As for your phone, if that's sufficient for you, go for it.
There are better phones out there.
Even FIDO2 MFA doesn’t protect you from attacks that involve malware running on your machine. If there was a keylogger on their machine then that machine is likely compromised in other ways, and any credentials entered or stored on it should be considered compromised and should be reset.
I have MFA in addition to that pw, yes
That's news to me. Which other mobile authentication is there besides pin, pattern, facial and fingerprint?
Most phones allow passwords, or at least longer length pin.
My 6 character alphanumeric pin is more secure than your four digit numeric
Me, at the bank:
Robbers, as they enter the bank: everybody freeze
Me: ah shit
Robbers: everyone give me your phones
Me: aw hell naw
mission impossible style shootout