293
Passkeys Explained: The End of Passwords (sentientrant.com)
submitted 10 months ago by to c/technology@lemmy.world
225 comments fedilink hide all child comments
 

Passkeys are built on the FIDO2 standard (CTAP2 + WebAuthn standards). They remove the shared secret, stop phishing at the source, and make credential-stuffing useless.

But adoption is still low, and interoperability between Apple, Google, and Microsoft isn’t seamless.

I broke down how passkeys work, their strengths, and what’s still missing

you are viewing a single comment's thread
view the rest of the comments
[–] 7 points 10 months ago* (last edited 10 months ago) (10 children)

I’m not really concerned about the security of it. Moreso the inconvenience…

Honestly, convenience is security (change-my-mind lol) insofar as it measurably impacts rate of user adoption/adherence and thus outcomes.

It’s the annoyance you describe that leads most users to skip 2FA setup until it’s forced on them, for example.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 10 child comments
    •
  • [–] 6 points 10 months ago (9 children)

    convenience is security (change-my-mind lol)

    Not at all. Typically they're opposites. But I understand what you're trying to say. More convenience leads to better security.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 9 child comments
    •
  • [–] 4 points 10 months ago (3 children)

    If it's more convenient to be insecure than secure, users will pick insecure every time. There's a reason there are so many bad password in the top passwords in breach dumps.

    I have to tell myself every time I go through some of my login flows that inconvenience to me means more so to an attacker, but most people don't have an adversarial mindset and just want it to work.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 2 points 10 months ago (2 children)

    User inconvenience is not at all the same thing as security.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 2 points 10 months ago* (last edited 10 months ago) (1 child)

    No, but the two tend to be correlated.

    Example, MFA authentication is a security feature, but inconvenient as shit with low or no lifetime. Same complaints about short lived sessions on app sites. Especially when every login requires MFA....

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 1 point 10 months ago* (last edited 10 months ago) (2 children)

    Yeah you get it. It’s a “slow = fast” type of spiel, just a bone to pick with colleagues who embrace anti-user practices needlessly.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •