"TOTP is phishable."

i can safely say both articles were made by insane people. all i can say is, to keep using generated passwords and offline 2fa codes. dont click on the naked lady in the spam folder.

have a good night, kids.

Let's just go ahead and add a third, fourth, AND fifth authentication factor so maybe I'll kill myself first thing every morning

Passwords are protected (for now) by the first amendment. You can't be compelled to tell what it is. Passkeys can be seized with a warrant. This only matters in the US but it does matter and I literally never see that addressed.

Passkeys are 100% not a trap, but they've been fucked over by being allowed to be portable. Now your passkey is only as good as the portable password solution you're using to store it. They're meant to be 1:1 computer->service. Then there's the issue that most of the sites that accept passkeys let you bypass them with passwords or TOTP anyway.

TOTP, however, is REALLY fucked. Even a rudimentary phishing email can get your time-based key, get in and fuck your account over in real time.

Passkeys are extremely phishing-resistant. They are the best thing we have short of a YubiKey at the moment.

Yubikeys are amazing, But they're not meant to be permanently carried, just used to stitch your securred devices together.

Not much of a rebuttal imho. We still have the problem that passkeys are ok in theory, but in practice they're being pushed as a way to increase lock-in and don't offer compelling advantages over well-managed passwords.

The author of this post works in Apple, Passwords team. They do not deny that there’s attestation; they argue that it’s only used to prevent bad actors.

Cool, we’ll trust corporations then!

I use hardware keys to connect to my own self-hosted services and login on (some of) my devices. There is no 3rd party involved.

Some of them like NitroKey are even open hardware. I have backup hardware keys.

It's amazing. I can't believe it took me so long to rely on them.

So... IMHO if you don't like (hardware) passkey it's because you dislike services relying on them, no the keys themselves.

The biggest problem I have with passkeys is big companies aren't implementing them to improve your security - they're implementing them because it absolves them of liability and responsibility for implementing good security on THEIR end and allows them to implement whatever the fuck vibe-coded bullshit nonsense they want without any knowledgeable or skilled staff, and even if it's good for me too, I'm not inclined to do these assholes any favors. It'll just make them sloppier and lazier on other elements of security and they'll turn around and put the blame on the user, and courts will go right along with it because nobody in the legal system can find their asses with both hands.

Hmmm, for someone complaining that another post makes logical leaps, this one has a pretty glaring contradiction that severely undermines their own argument:

The post is predicated on the idea that a feature of WebAuthn called “attestation”, which is only used in high-assurance and usually corporate scenarios, and usually with physical hardware security keys, will be leveraged to hurt people, somehow. The post posits that a website like X will bait and switch users: first, you get a passkey. Then, later, scary “attested” passkeys! This simply isn’t possible to do because attestation isn’t supported on the web for mass market, consumer authentication. Attestation for passkeys (software-based, syncable credentials) is antithetical to their mass market goals, and would freeze out independent, non-corporate-backed credential managers. It’s an explicit non-goal of the designers of passkeys, who work together in a forum anyone can join. And trust me, websites and apps like banks repeatedly asked for attestation at the beginning of the industry’s passkey journey. The platforms, browsers, and credential management apps have held firm that the goal of passkeys is reducing phishing and not some kind of trusted computing scheme. (And I will note: over my dead body!)

In other words, "attestation is bad and everyone is against it, but it's a feature of the standard." What they are really claiming is that there is something that for now is stopping governments and corporations from pushing attestation, but how long will that hold? I didn't have a horse in this race when I first started reading these posts, but this counter-argument is flawed and it makes me lean toward the camp against passkeys.

Attestation for passkeys (software-based, syncable credentials) is antithetical to their mass market goals, and would freeze out independent, non-corporate-backed credential managers. It’s an explicit non-goal of the designers of passkeys, who work together in a forum anyone can join.

The web wasn't supposed to be controlled by corps either, and look where we are now.

If passkeys were to follow the same path as the web, here's what it would look like. Corporate passkeys get the most users because of OS integration and convenience. Now that they have all the users they can commandeer the standards, and make them so complex and evolve so quickly that non-corporate implementations can't keep up (think Firefox vs Chrome). Corporations convince websites to drop support for outdated passkeys, citing security issues. Non-corporate implementations are locked out. Monopoly is established.

And now that passkeys are centralized to corps, the government can exert power on them, mandating hardware attestation for things like hardware-backed id and age verification. They push for backdoors, so they can log into anybody's account. Bye bye privacy.

After reading both of the posts, I'm kind of back where I started with passkeys: neutral. I'm pretty happy with my current setup of a self-hosted password manager, diceware master passphrase and strong, unique passwords for every account, along with an open source app for TOTP. I only ever see passkeys pushed on me for work-related accounts anyway, but I'm not using them there either. I do have a question though if someone can answer: are passkey protected logins also vulnerable to stolen session cookies?

Sounds like something BigPassKey would say

Let's get back to after 10 years because this was the same debate about drm in browsers and now we have this https://www.w3.org/TR/encrypted-media-2/

I have a basic question, I learned that MFA should draw from multiples of "things you have" (totp) and "things you know" (passwords). There's all this talk of passkeys replacing passwords, but aren't passkeys in the "thing you have" category, not the "thing you know" category? My worry is that an unlocked computer or unlocked phone will let someone access ALL of a person's accounts because now they have the thing and don't need you at all. Putting access to my entire digital life behind my 4-9 point lock symbol? Or worse, a fingerprint?

This was on hackernews this morning.

The author is in the passkey business.

The most pertinent question there imho was : What do passkeys offer that random strong passwords + a pw manager do not?

There was a wall of comments, but no concise answer.

======== You buy a new super secure lock for your house, but to get in you go to one of the 3 conveniently located HomeDepot's in your city. You simply prove your identity to the guy there. He verifies you in the system. Then he gives you a one time pass to your house.

If its such a great idea, you can pay me now to do it for your home.

Nah, lock-in is not a safety feature. 16+ random chars are plenty, and if cracking gets better I'll go to 20 or 30 chars. My pw manager doesn't care what strings go in it or which device opens it up.

I'm telling you why passkeys are garbage:

Case 1

• Login to website
• Maybe use 2FA device
• Website creates session cookie

Never have to login again for the next few months

Case 2

• Go to website
• Use password manager to auto fill credentials

Click like 2 buttons and you're done

Case 3

• Create passkey
• Passkey is stored on propietary, trust me bro, "we will never share this with the NSA or FBI" Apple or something account where you can't export them
• User becomes dependent on cloud provider
• User will easier forget their real login data because they don't use them
• User is fucked if account get's locked/deleted
• User can still be hacked by simply compromising machine
• No 2FA

I'm using GNU pass, it doesn't support passkeys. I'm using Arch with Firefox. When a site requesting a passkey, Firefox says touch the key. I don't know what to do so I cancel the process and search for a workaround.

For example npmjs.org, they require passkey for publishing packages, so I rather have to create an API token which supposed to be for CICDs and publish the package with that instead.

It's f*cking awkward. I have a secure password manager, offline, nowhere shared, even the passwords are encrypted. Don't force passkeys on me for no reason, I was secure before as well. And even if you do, at least it should work. As always Linux users left behind.

2. Describing TOTP as a “great solution” for adding security to a password-based account. When the most common threat model on the web is phishing (a word the post never mentions!), TOTP hardly buys you anything. TOTP is phishable.

If (after decades of awareness) you manage to get phished while using TOTP, you shouldn't be trusted with a phone or any digital information at all

But they are annoying. Like it's fine if you only use one device, but I don't fucking know where my phone is, that's why I am on my laptop

no, fuck passkeys. they will lock everyone in with their proprietary bullshit.

use a good generated password in a manager if you will. don't trust anything corps are pushing.

Why would I want a convenient passkey stored securely inside my password manager if I can just, much more conventiently, lock myself out of my account by losing my phone?