293
Passkeys Explained: The End of Passwords (sentientrant.com)
submitted 10 months ago by to c/technology@lemmy.world
225 comments fedilink hide all child comments
 

Passkeys are built on the FIDO2 standard (CTAP2 + WebAuthn standards). They remove the shared secret, stop phishing at the source, and make credential-stuffing useless.

But adoption is still low, and interoperability between Apple, Google, and Microsoft isn’t seamless.

I broke down how passkeys work, their strengths, and what’s still missing

you are viewing a single comment's thread
view the rest of the comments
[–] 29 points 10 months ago (12 children)

I'm not really concerned about the security of it. Moreso the inconvenience of having to open my email client, specifically on the same device, and then sit there and click the refresh button over and over, waiting for it to come through, and then having to go back and delete it after so there's not even more clutter in my inbox...

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 12 child comments
    •
  • [–] 7 points 10 months ago* (last edited 10 months ago) (10 children)

    I’m not really concerned about the security of it. Moreso the inconvenience…

    Honestly, convenience is security (change-my-mind lol) insofar as it measurably impacts rate of user adoption/adherence and thus outcomes.

    It’s the annoyance you describe that leads most users to skip 2FA setup until it’s forced on them, for example.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 10 child comments
    •
  • [–] 6 points 10 months ago (9 children)

    convenience is security (change-my-mind lol)

    Not at all. Typically they're opposites. But I understand what you're trying to say. More convenience leads to better security.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 9 child comments
    •
  • [–] 4 points 10 months ago (3 children)

    If it's more convenient to be insecure than secure, users will pick insecure every time. There's a reason there are so many bad password in the top passwords in breach dumps.

    I have to tell myself every time I go through some of my login flows that inconvenience to me means more so to an attacker, but most people don't have an adversarial mindset and just want it to work.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 2 points 10 months ago (2 children)

    User inconvenience is not at all the same thing as security.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 2 points 10 months ago* (last edited 10 months ago) (1 child)

    No, but the two tend to be correlated.

    Example, MFA authentication is a security feature, but inconvenient as shit with low or no lifetime. Same complaints about short lived sessions on app sites. Especially when every login requires MFA....

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 1 point 10 months ago* (last edited 10 months ago) (2 children)

    Yeah you get it. It’s a “slow = fast” type of spiel, just a bone to pick with colleagues who embrace anti-user practices needlessly.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •