Technology

59960 readers

3388 users here now

This is a most excellent place for technology news and articles.

Our Rules

Follow the lemmy.world rules.
Only tech related content.
Be excellent to each another!
Mod approved content bots can post up to 10 articles per day.
Threads asking for personal tech support may be deleted.
Politics threads may be removed.
No memes allowed as posts, OK to post as comments.
Only approved bots from the list below, to ask if your bot can be added please contact us.
Check for duplicates before posting, duplicates may be removed

Approved Bots

founded 2 years ago

MODERATORS

[email protected]

265

Passkeys might really kill passwords (www.theverge.com)

submitted 10 months ago by [email protected] to c/[email protected]

177 comments fedilink hide all child comments

Passkeys: how do they work? No, like, seriously. It’s clear that the industry is increasingly betting on passkeys as a replacement for passwords, a way to use the internet that is both more secure and more user-friendly. But for all that upside, it’s not always clear how we, the normal human users, are supposed to use passkeys. You’re telling me it’s just a thing... that lives on my phone? What if I lose my phone? What if you steal my phone?

you are viewing a single comment's thread
view the rest of the comments

[–] [email protected] 4 points 10 months ago* (last edited 10 months ago) (5 children)

So you really need two independent devices with their own passkeys to back each other up.

[–] monko 6 points 10 months ago (4 children)

Not sure exactly what you're getting at, but any authentication model must be designed with the assumption that a user can lose all their devices, passkeys included. That's where fallbacks come into play. Even with Apple's system, you can recover your keychain through iCloud Keychain escrow, which (according to their help page) uses SMS:

To recover your keychain through iCloud Keychain escrow, authenticate with your Apple ID on a new device, then respond to an SMS sent to a trusted phone number.

While SIM swaps aren't super common, they're not the most difficult attack. Passkeys are strong against direct attacks, for sure. But if I can reset your account using a text message sent to a device I control, is it really that much more secure?

[–] [email protected] 4 points 10 months ago (1 children)

So if you lose access to all of your devices, you're completely locked out of everything until you're able to get a new working phone activated on a trusted phone number? The trade-off of inconvenience for security here just doesn't seem worth it to me.

[–] monko 2 points 10 months ago

Depends on the provider in question. While Apple does allow SMS recovery, they also let you designate a trusted contact who can let you in as an alternative. This is obviously more convenient (if you have a friend or family member who can be available when you need them), but the situation with SMS vulnerabilities is still my main gripe.

load more comments (2 replies)