244
The security co-processor in many CPUs is insecure (www.heise.de)
submitted 1 month ago by to c/technology@lemmy.world
35 comments fedilink hide all child comments
you are viewing a single comment's thread
view the rest of the comments
[–] 11 points 1 month ago (2 children)

Well that’s OK; we recently discovered that things like passkeys usually aren’t using the TPM anymore anyway. Most stuff stored in there can be routed around via tokens stored on main storage.

  • permalink
  • fedilink
  • source
  • hideshow 2 child comments
    •
  • [–] 2 points 1 month ago*

    I’m honestly amazed by this. Passkeys were the touted solution to all our human password problems. How is it that something so critical went unnoticed until recently?

    You’d think this would be something that gets caught before release. What went wrong?

    IIRC, the Passkey spec did not specify the use of specialized hardware for key storage. So if this a case where people chose convenience over security without realizing they were making the tradeoff?

    That would still be phenomenal. Who leads these sort of things and why is such a blatant issue unnoticed until most of us are affected?

    It doesn’t matter how good a plan is if we can’t follow it. So what stops this issue from continuing to plague the next “great” solution to password management?

  • permalink
  • fedilink
  • source
  • parent