Or the obscure ways for 2FA/MFA. Passkeys are mostly cloud based. Yeah fuck no! The weakest Passkey is weaker than my usual random generated password, if the site don't do any shady business and require a weak password. Hardware keys are luckily not pushed for usage. I don't like them either. You require at least 2, for backup reasons. They also cost quite some money and they have zero auth. Just connect to usb and tap it. Also retrieving the backup and get a replacement for a defective one, takes some time.

Good old TOTP as 2FA is perfect, paired with a strong, random password. With my TOTP, I have an encrypted backup in my cloud, on my NAS, older backups in secure places and backup codes in several places. The TOTP App I use is open source and I have a mirror of the source code.

This should be enough security, if sites don't screw up all the time. You can bypass 2FA all the time. Even the credit card company screwed up big time. Usually you get 2 separate letters, one with your pin and one with your card. Both came on the same day. Also I actually didn't needed the pin in the first place. I was able to add the card to the app and see the pin there, without actually verifying anything, except the credit card number.

Maybe when passkeys are supported in my password manager, I will try it but so far it isn't and switching is not an option, as it doesn't support the features I need. There is an open issue for an alternative password manager, with that feature request and it has some people wanting it, but its still not added. But passkeys doesn't fix the issue for me using stronger keys, it fixes the site owners to allow stronger keys but they are still not required to use it. Some devs are just weird. I've read one PR for an FOSS project I use, where someone wanted to implement a universal oath or such stuff, that would support all types of external authentifications. Nope, the dev refused the PR and they wanted to stay at the 2 proprietary implementations, for 2 services, even though this universal implementation would work with these 2 too. I can't tell exactly what it was. I was experimenting with an auth service for my self hosted stuff, to not deal with several accounts and rights systems. This service was the first one which I wanted to switch and they didn't wanted to support it, leaving me with the standard login.

[–] KairuByte@lemmy.dbzer0.com 6 points 23 hours ago (2 children)

What password manager doesn’t support passkeys these days?

[–] ZeldaFreak@lemmy.world 1 points 12 hours ago

Vanilla KeePass. The Dev isn't interested to providing a communication outside of its program, but he clarified, that plugins have all the right access, to do that but as it seemed to the dev, there is no dev interested to making such a plugin. KeePassXC does support it but they are still missing entry templates. This is the only missing feature that is holding me back to switch.

[–] onlinepersona@programming.dev 0 points 17 hours ago (1 children)

What the hell are passkeys? I think outside deep tech forums, nobody knows what they are.

[–] KairuByte@lemmy.dbzer0.com 1 points 5 hours ago

Simplest way I can think to explain it is that it’s similar in concept to SSL. If you understand SSL you should be able to understand passkeys.

[–] jake_jake_jake_@lemmy.world 3 points 21 hours ago

Every hardware based key I ever used also required PIN, but as far as expense and backups, yes, for personal use the cost generally may not be justified. I got all my personal ones as a bundle that was on sale. For work I would argue that some businesses can easily justify the cost to create a rotating stock of hardware keys to deal with lost keys. Generally in that environment you have centralized PKI, where you can revoke the certificate on the lost key and then issue a new certificate on a new hardware key. This doesn't help for all sign in methods tied to hardware keys, but can be very practical when implemented right.

I also agree on TOTP as the ultimate generic 2FA method, with several worsening options until the despised email or sms 2FA. I will also add that you can setup TOTP on modern hardware keys, where you must insert and complete PIN entry. The inconvenience is that you must have all your keys and password manager available at setup time for places that don't support multiple TOTP codes.

[–] Legianus@programming.dev 2 points 22 hours ago (1 children)

You can force auth on hardware passkeys for every activation. A sort of local password. Much more secure, also if somebody is in possession of your passkey and you didn't just loose it somewhere you would be fucked anyways.

I have three, one for home, one for backup, and one for travel. I can See why ppl. Are annoyed by that, but speaking of costs, you can get these starting from ~20 Dollars. Additionally, passkeys could and should replace passwords and not EB generally used as 2FA.

Also many password managers (incl. FOSS) do support Passkeys, but having them in your password manager makes them arguably useless. Same if you use 2FA on your phone and a password manager and your phone gets compromised somehow.

[–] ZeldaFreak@lemmy.world 1 points 11 hours ago (1 children)

I quote myself from a different comment:

I just needed to think of the scene from the Simpsons, where Mr. Burns and Smithers go all through the security checks and in the end, there is a flimsy open backdoor, where a stray dog entered the room. All security in the front doesn't matter, if the backdoor is not secure at all and until the backdoor is that unsecure, I'm not willing to add money and time, to make the front door more secure.

The phone argument lacks a bit. Accessing the TOTP App and the password manager do require a separate authentification, to get encrypted. Sure if they snatch my phone away, when its fully unlocked, including my password manager, they have access for a limited time. They need to be fast enough, until I can remotly lock it or until it automatically locks itself. Android phones can now detect when they are stolen. Either by the movement or when it goes offline. The latter I tested and it's not instant, but you still don't have long.

I don't think about potential backdoors. If there is no known backdoor, then I deem it save. Sure they also could me to unlock the phone. This would be xkcd 538. And this applies to any security.

Adding more security and inconvenience doesn't make sense to me, so long the backend is shit. So far a few big companies did screw up hard in their backend and dozens of smaller sites do some bad stuff, that it doesn't really matter how strong your login is. Here I reference back to my quote.

In a closed system, like a company, this added security makes sense, as they usually control the backend as well. If my CEO would send me a text request to reset his logins, I would call him or walk to his office, and ask him directly. Sure with AI, they could impersonate his voice but I don't think they can impersonate his way to speak.

[–] Legianus@programming.dev 1 points 8 hours ago (1 children)

Well Passkeys are a good step to enhance security and remove potential backdoors from companies for one. As you have your private key that cannot be easily imitated and is checked by the company that you use.

And generally speaking, your phone can be attacked via software without even having physical access. So if your phone is infected they gain access (at some point during usage) to both your password manager and your 2FA. It is just never a good idea to have multiple thongs in one place.

On a side note, with physical access to one of your devices for a longer time, most things can be accessed by a malicious actor.

[–] ZeldaFreak@lemmy.world 2 points 7 hours ago

Of course everything can be hacked. When I think something is compromised, then I need to change everything. So far I didn't heard of any remote zero click compromise. With the fancy hacking tools of some companies, its not publicly known how they gained access. I suspect either physical access or some malware. But we are speaking on a high level of hacking, that most people don't need to be scared off. At that level, there are other things to worry about.

When we just look at the dangers an average person might encounter, this level of security is fine. I do had accounts compromised and I can exactly tell what my mistake was. One was sharing my password with someone else and not knowing how secure his devices where and not having 2FA. The second one was that I used the same password everywhere. At this point I was switching to generated passwords and still didn't had every account changed (the unimportant ones).

Of course Passkeys are by nature a more secure implementation, as you are unable to save plaintext passwords but there is one thing that this can't solve and that's being that they remove and reset your auth, without verifying your identity. Hackers still can steal session tokens and sites don't need to require additional authentification, when altering your authentification.