Pulse of Truth

2571 readers

136 users here now

Cyber Security news and links to cyber security stories that could make you go hmmm. The content is exactly as it is consumed through RSS feeds and wont be edited (except for the occasional encoding errors).

This community is automagically fed by an instance of Dittybopper.

Commenting rules:

Be respectful.
No bigotry (including racism, sexism, homophobia, transphobia).
No pornography.
Nothing illegal.
More rules will be added when necessary

founded 3 years ago

MODERATORS

krogoth@infosec.pub

Passkeys are a trap. Do not use them. (nonfunctional.substack.com)

submitted 22 hours ago by lemmydev2@infosec.pub to c/pulse_of_truth@infosec.pub

8 comments fedilink hide all child comments

Seems like every website wants us to stop using passwords. There is a replacement we are being asked to use instead called passkeys. This should be a tad concerning if passwords are familiar to you and you don’t fully understand these nebulous passkeys.

Websites say that passkeys are more secure or more convenient or something similarly beneficial. While it is true that passkeys can be far more secure than passwords, and may indeed be more convenient, that’s not the whole story. Passkeys are not designed to prioritize your interests. Like the Trojan Horse, passkeys are legitimately elegant on the surface, but there is something troubling inside.

What’s important to know is that unlike with any other kind of login credential, you do not have ultimate control over your passkeys. With passwords, you can choose where to write them down; with authenticator apps, you can decide for yourself which ones to use (they’re pretty interchangeable); and with physical security keys you can hand them to your colleague if you really trust them. But with passkeys come a hidden dial that lets the websites you use them on gradually remove your ability to do as you please with them.

you are viewing a single comment's thread
view the rest of the comments

[–] confusedwiseman@lemmy.dbzer0.com 5 points 18 hours ago

Great article to help understand passkeys and why not to use them.

I’ve skirted away from passkeys for years because I didn’t understand them, and admittedly, I never tried. I use a password manager, strong random passwords, and 2FA in most places where possible. (I have objections to SMS based 2FA, but that’s a different topic.

Reflecting a bit, as hard as sites “push” use a passkey, it sets off the spidey-senses. Oh, it’s so they have more control over you, your account, and your hardware… (not always, but pinky promise we/microsoft/netflix/google/apple would never restrict/impact your selection of applications or hardware outside of our control.)