55
Passkeys are a trap. Do not use them. (nonfunctional.substack.com)
submitted 1 day ago by to c/linux@lemmy.ml
45 comments fedilink hide all child comments
you are viewing a single comment's thread
view the rest of the comments
[–] 6 points 1 day ago* (5 children)

Is TOTP always phishable? Like the phisher says "tell me the code in your authenticator app"? But can't say "tell me your passkey?"

This kind of explains to me why passkeys are so annoying -- they are designed for if you're always going to be using the same device all the time.

I wish password managers could hold passkeys reliably -- they keep failing for me.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 5 child comments
    •
  • [–] 11 points 1 day ago (1 child)

    Phishing isn't just over the phone. A phishing website that's imitating say a bank website is just as easy to get the TOTP than it is the password.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 2 points 16 hours ago*

    That makes a lot of sense. And on the password manager, you have to click through the "use password on new website?" security dialog so often it becomes a nuisance warning and wouldn't protect you from a phishing website, since you're so used to clicking through it.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 3 points 21 hours ago (1 child)

    Nobody is (should be) stopping you from enrolling all your devices, and synced passkeys (e.g. iCloud Keyring) are part of the spec.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 1 point 16 hours ago

    I am thwarted all the time by having many passkeys enrolled in the password manager, all named "passkey", because the website kept prompting me to make more whenever i logged in. Yet the website still prompts me to "input your security key", ignoring all the saved passkeys.

  • permalink
  • fedilink
  • source
  • parent