▲ 67 ▼ Passkeys are a trap. Do not use them (nonfunctional.substack.com) submitted 5 days ago by rssbot@lemmy.bestiver.se [M, B] to c/hackernews@lemmy.bestiver.se 26 comments fedilink hide all child comments Comments
[–] lIlIlIlIlIlIl@lemmy.world 3 points 5 days ago (4 children) TOTP is a great solution. It is? permalink fedilink source parent hideshow 4 child comments replies: [–] waltersf@bookwyr.me 1 point 5 days ago (3 children) Keep reading. The Hack explains how corporations can arbitrate which type of passkeys they might allow when their TOTP authenticator refuses your passkey settings. permalink fedilink source parent hideshow 3 child comments replies: [–] chicken@lemmy.dbzer0.com 9 points 5 days ago (2 children) So what makes passkeys so different? Well, they look very similar to TOTP on the surface. Both have an open standard (RFC 6238 for TOTP, WebAuthn for passkeys), so surely passkeys must have all these same nice properties as TOTP, right? At first glance it would seem so. Don’t forget that unlike passwords and SMS codes and TOTP, passkeys are designed to function in the background without you ever seeing the details. Wait for Big Tech to propose something just as convenient and secure but more clearly defined and with fewer strings attached. In the meantime if you want security, your Game Boy can provide you with TOTP. It really seems like the article is drawing a strong distinction between TOTP and passkeys and saying TOTP is better though permalink fedilink source parent hideshow 2 child comments replies: [–] waltersf@bookwyr.me -1 points 5 days ago (1 child) Implementations. What FIDOA decides to passkey and you with your website are totally different security agendas. The Hack goes into detail how corporations can refuse several of your passkey settings. permalink fedilink source parent hideshow 1 child comment replies: [–] black0ut@pawb.social 4 points 4 days ago They are not different implementations, they are completely different things. TOTP can't have remote attestation or settings, it's just a code. Passkeys are something else, that has some similarities (also generating a time-based code). permalink fedilink source parent
[–] waltersf@bookwyr.me 1 point 5 days ago (3 children) Keep reading. The Hack explains how corporations can arbitrate which type of passkeys they might allow when their TOTP authenticator refuses your passkey settings. permalink fedilink source parent hideshow 3 child comments replies: [–] chicken@lemmy.dbzer0.com 9 points 5 days ago (2 children) So what makes passkeys so different? Well, they look very similar to TOTP on the surface. Both have an open standard (RFC 6238 for TOTP, WebAuthn for passkeys), so surely passkeys must have all these same nice properties as TOTP, right? At first glance it would seem so. Don’t forget that unlike passwords and SMS codes and TOTP, passkeys are designed to function in the background without you ever seeing the details. Wait for Big Tech to propose something just as convenient and secure but more clearly defined and with fewer strings attached. In the meantime if you want security, your Game Boy can provide you with TOTP. It really seems like the article is drawing a strong distinction between TOTP and passkeys and saying TOTP is better though permalink fedilink source parent hideshow 2 child comments replies: [–] waltersf@bookwyr.me -1 points 5 days ago (1 child) Implementations. What FIDOA decides to passkey and you with your website are totally different security agendas. The Hack goes into detail how corporations can refuse several of your passkey settings. permalink fedilink source parent hideshow 1 child comment replies: [–] black0ut@pawb.social 4 points 4 days ago They are not different implementations, they are completely different things. TOTP can't have remote attestation or settings, it's just a code. Passkeys are something else, that has some similarities (also generating a time-based code). permalink fedilink source parent
[–] chicken@lemmy.dbzer0.com 9 points 5 days ago (2 children) So what makes passkeys so different? Well, they look very similar to TOTP on the surface. Both have an open standard (RFC 6238 for TOTP, WebAuthn for passkeys), so surely passkeys must have all these same nice properties as TOTP, right? At first glance it would seem so. Don’t forget that unlike passwords and SMS codes and TOTP, passkeys are designed to function in the background without you ever seeing the details. Wait for Big Tech to propose something just as convenient and secure but more clearly defined and with fewer strings attached. In the meantime if you want security, your Game Boy can provide you with TOTP. It really seems like the article is drawing a strong distinction between TOTP and passkeys and saying TOTP is better though permalink fedilink source parent hideshow 2 child comments replies: [–] waltersf@bookwyr.me -1 points 5 days ago (1 child) Implementations. What FIDOA decides to passkey and you with your website are totally different security agendas. The Hack goes into detail how corporations can refuse several of your passkey settings. permalink fedilink source parent hideshow 1 child comment replies: [–] black0ut@pawb.social 4 points 4 days ago They are not different implementations, they are completely different things. TOTP can't have remote attestation or settings, it's just a code. Passkeys are something else, that has some similarities (also generating a time-based code). permalink fedilink source parent
[–] waltersf@bookwyr.me -1 points 5 days ago (1 child) Implementations. What FIDOA decides to passkey and you with your website are totally different security agendas. The Hack goes into detail how corporations can refuse several of your passkey settings. permalink fedilink source parent hideshow 1 child comment replies: [–] black0ut@pawb.social 4 points 4 days ago They are not different implementations, they are completely different things. TOTP can't have remote attestation or settings, it's just a code. Passkeys are something else, that has some similarities (also generating a time-based code). permalink fedilink source parent
[–] black0ut@pawb.social 4 points 4 days ago They are not different implementations, they are completely different things. TOTP can't have remote attestation or settings, it's just a code. Passkeys are something else, that has some similarities (also generating a time-based code). permalink fedilink source parent