A rebuttal to an anti-passkey, pro-TOTP post that has made the rounds on Lemmy as well.
After reading both of the posts, I’m kind of back where I started with passkeys: neutral. I’m pretty happy with my current setup of a self-hosted password manager, diceware master passphrase and strong, unique passwords for every account, along with an open source app for TOTP. I only ever see passkeys pushed on me for work-related accounts anyway, but I’m not using them there either. I do have a question though if someone can answer: are passkey protected logins also vulnerable to stolen session cookies?
So it’s fair that you are neutral about them for your own use, clearly you know what you’re doing. It doesn’t make sense to be neutral about them, generally. On usability alone they are not good. There are so many people who don’t have a clue how they work, or their consequences, and just click okay when continually harassed into using them. Some will even go ahead and save one on a shared computers, or someone else’s, ‘because the website says so’.
Honestly, I don’t understand them well enough to recommend them either. I do IT, and I set my users up with a (managed) password manager and MS Authenticator. If I encounter a situation where a user has ended up with a passkey for a given service, I just leave it be. On the other hand, if someone is locked out because of a passkey, I reset it and get them set back up with the Authenticator app.
The author of this post works in Apple, Passwords team. They do not deny that there’s attestation; they argue that it’s only used to prevent bad actors.
Cool, we’ll trust corporations then!
and they would never violate your trust and later force this onto you because the love their users.
the more apologetics for this shit i see, the less i trust it.
Not much of a rebuttal imho. We still have the problem that passkeys are ok in theory, but in practice they’re being pushed as a way to increase lock-in and don’t offer compelling advantages over well-managed passwords.
But most people don’t have well managed passwords. And me having good password hygiene doesn’t stop my data being hacked when someone working at a subcontracting firm to a company I use leaks all my data.
It also is annoying to have to log in over many steps with 2fa, often forced to email or SMS.
Collectively improving security benefits us all.
True story … take it as you like,
my 8 months old reddit account was filter flagged as a bot after commenting the following
“death to the Epstein class and fuck Israel the genocide state”
The only way to get it back according to reddit was if i used IOS authentication passkey.
Not the normal password manager i use on Firefox but no it must be passkey on ios.
Now i am convinced that 8200 unit of the Zionist regime have my facial biometrics.
A passkey is just traditional PKI in a trench coat, your biometrics are A) not even required as you can just use a PIN and B) are not sent from iOS when unlocking the passkey.
I love how you provided no rebuttal to my two points. The EFF even goes into detail on how it works. The beauty of an open standard is that you can verify these assumptions of yours.
I don’t need to, if you read my comment again you would understand my point.
But let me try to breakdown what i mean; you need to wake up from your lala land, if you truly think and believe corporations that are actively participating in genocide and killing children will really care about “policies and terms of usage”.
Your statement reads like someone who used to believe the “don’t be evil“ google policy citing it as evidence in his head.
If that is how you stand, then good for you, but i don’t, actually i view such corporations as a dangerous entities to humanity.
Hope its clear for you now.