67
Passkeys are a trap. Do not use them (nonfunctional.substack.com)
submitted 5 days ago by [M, B] to c/hackernews@lemmy.bestiver.se
26 comments fedilink hide all child comments
 

Comments

you are viewing a single comment's thread
view the rest of the comments
[–] -1 points 5 days ago (1 child)

Implementations.
What FIDOA decides to passkey and you with your website are totally different security agendas. The Hack goes into detail how corporations can refuse several of your passkey settings.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 4 points 4 days ago

    They are not different implementations, they are completely different things. TOTP can't have remote attestation or settings, it's just a code. Passkeys are something else, that has some similarities (also generating a time-based code).

  • permalink
  • fedilink
  • source
  • parent