Discussion
https://nonfunctional.substack.com/p/passkeys-are-a-trap-do-not-use-them
TIL that passkeys have remote attestation built-in. Without a US-American phone running software signed by a US-American company, on which you need to be signed in with your legal identity (thus rendering you unable to use it if you're sanctioned by the US), there is a pretty good chance that you'll be unable to use your passkeys in the future. That seems pretty damn terrible.
Don't use passkeys.
@pojntfx@mastodon.social isn't that just a protocol? I think Chipass implements that and you can use that to store passkeys.
@pojntfx@mastodon.social oh there was more to the article, kinda too late didn't realise uff... But idk if Passkeys are generally bad idea. It is big tech all over again. Because I myself like that idea unless you do all the attestation bs.
@ekatwired Yes and yes. I like passkeys too conceptually, but the remote attestation - esp. the way that this wouldl likely be done w/ the Google/Apple duopoly, similar to Play Integrity - is a dealbreaker IMHO
For now it's password manager + TOTP for me.
@pojntfx @ekatwired PW manager + TOTP doesn't help in some scenarios with phishing or MITM.
@pojntfx I guess the part I don't get is, how does refusing to use them in the meantime help? I agree it's bad if Facebook starts saying you have to prove you have a Macbook to use their website, but if Apple implements the API can't they still require that regardless of whether you've ever used non-attested keys previously? It seems like the only way to prevent that situation would be regulation, or one of the major device vendors refusing to implement the attestation part of the standard.
TOTP does nothing against modern phishing attacks so it worries me to see it being recommended as if it's comparable.
Install Fedizen
Get the full app experience
@pojntfx Since #passkeys are always about service authentication, how does that differ from any other situation where this service doesn't want you to access it any more? So your argument is not an argument against Passkeys but against stupid services. 🤔
I'd say: don't use *services* which you don't trust.
That also includes passkey providers and their services, independent from the #authentication method used and more. 🤷
At least Passkeys as well as #FIDO2 (both preferably using USB/NFC hardware tokens!) protect you from #phishing and #MITM. You don't have full protection otherwise. So it comes down to which risk is more important to you: a service provider becoming bad or protection of your account as long as you're using that service.
https://karl-voit.at/2018/08/12/password-management/
#security #20180812_PasswordManagement
Password Management