67
Passkeys are a trap. Do not use them (nonfunctional.substack.com)
submitted 5 days ago by [M, B] to c/hackernews@lemmy.bestiver.se
26 comments fedilink hide all child comments
 

Comments

you are viewing a single comment's thread
view the rest of the comments
[–] 28 points 5 days ago (6 children)

I wouldn't be surprised if five years down the line companies figure out a way to use pass keys as a way to de-anonymize and track people.

  • permalink
  • fedilink
  • source
  • hideshow 6 child comments
    •
  • [–] 3 points 4 days ago (5 children)

    Why? Just give them another passkey.
    Usage isolation is 🥁 key.
    The article is about the weakness of TOTP, not passkeys themselves.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 5 child comments
    •
  • [–] 3 points 4 days ago (4 children)

    TOTP is a great solution.

    It is?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 1 point 4 days ago (3 children)

    Keep reading. The Hack explains how corporations can arbitrate which type of passkeys they might allow when their TOTP authenticator refuses your passkey settings.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 9 points 4 days ago (2 children)

    So what makes passkeys so different? Well, they look very similar to TOTP on the surface. Both have an open standard (RFC 6238 for TOTP, WebAuthn for passkeys), so surely passkeys must have all these same nice properties as TOTP, right? At first glance it would seem so.

    Don’t forget that unlike passwords and SMS codes and TOTP, passkeys are designed to function in the background without you ever seeing the details.

    Wait for Big Tech to propose something just as convenient and secure but more clearly defined and with fewer strings attached. In the meantime if you want security, your Game Boy can provide you with TOTP.

    It really seems like the article is drawing a strong distinction between TOTP and passkeys and saying TOTP is better though

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] -1 points 4 days ago (1 child)

    Implementations.
    What FIDOA decides to passkey and you with your website are totally different security agendas. The Hack goes into detail how corporations can refuse several of your passkey settings.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 4 points 4 days ago

    They are not different implementations, they are completely different things. TOTP can't have remote attestation or settings, it's just a code. Passkeys are something else, that has some similarities (also generating a time-based code).

  • permalink
  • fedilink
  • source
  • parent