Pulse of Truth

2571 readers

136 users here now

Cyber Security news and links to cyber security stories that could make you go hmmm. The content is exactly as it is consumed through RSS feeds and wont be edited (except for the occasional encoding errors).

This community is automagically fed by an instance of Dittybopper.

Commenting rules:

Be respectful.
No bigotry (including racism, sexism, homophobia, transphobia).
No pornography.
Nothing illegal.
More rules will be added when necessary

founded 3 years ago

MODERATORS

krogoth@infosec.pub

Passkeys are a trap. Do not use them. (nonfunctional.substack.com)

submitted 22 hours ago by lemmydev2@infosec.pub to c/pulse_of_truth@infosec.pub

8 comments fedilink hide all child comments

Seems like every website wants us to stop using passwords. There is a replacement we are being asked to use instead called passkeys. This should be a tad concerning if passwords are familiar to you and you don’t fully understand these nebulous passkeys.

Websites say that passkeys are more secure or more convenient or something similarly beneficial. While it is true that passkeys can be far more secure than passwords, and may indeed be more convenient, that’s not the whole story. Passkeys are not designed to prioritize your interests. Like the Trojan Horse, passkeys are legitimately elegant on the surface, but there is something troubling inside.

What’s important to know is that unlike with any other kind of login credential, you do not have ultimate control over your passkeys. With passwords, you can choose where to write them down; with authenticator apps, you can decide for yourself which ones to use (they’re pretty interchangeable); and with physical security keys you can hand them to your colleague if you really trust them. But with passkeys come a hidden dial that lets the websites you use them on gradually remove your ability to do as you please with them.

you are viewing a single comment's thread
view the rest of the comments

[–] libewa@feddit.org 2 points 20 hours ago

You can use your smartphone to authenticate on your PC (as long as both have Bluetooth, I think), or you could buy two hardware tokens from one of the vendors on the market.