36
Passkeys are not a trap. Use them! (hachyderm.io)
submitted 2 weeks ago by to c/linux@lemmy.ml
29 comments fedilink hide all child comments
 

Crossposted from https://feddit.org/post/36692057

A rebuttal to an anti-passkey, pro-TOTP post that has made the rounds on Lemmy as well.

you are viewing a single comment's thread
view the rest of the comments
[–] 4 points 2 weeks ago (1 child)

Maybe one extra thing you are missing is passkeys are resistant (not proof) to phishing. The user returns an 'assertion' that:

uses the private key to digitally sign a challenge value from the server, together with contextual information such as the requesting origin

https://developer.mozilla.org/en-US/docs/Web/Security/Authentication/Passkeys

It useless to pretend to be the bank as you'll get an assertion from the user you can't replay and the user's passkey implementation should spot the origin is wrong and refuse to sign it anyway (as I understand it).

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 3 points 2 weeks ago

    Maybe? I'd say that TOTP is probably more 'phishable' than passkeys - but I doubt there are actual stats on it.

    If an end-user is the kind of person that's fooled by a fake bank website that is on the wrong domain with a sketchy certificate - and approve 2FA requests without much thought - then it is probably likely they'd be fooled by a fake bank website that says, "per our recent updates, [yesterday's date] is the last date to switch to using an updated web browser. Our bank website is no longer compatible with this web browser, please open one of these browsers [list of any major browser useragent not identified as the current browser] and attempt login again".

    That could either completely bypass their pre-configured bank passkey with legacy login to the fake bank, or the attackers could just pushing them to configure a new passkey to the fake bank on the new browser (the attackers wouls set up a real passkey to the real bank in parallel, using the supplied credentials in the background).

    There is certainly proof of concept and examples in the wild of significant cases of people being tricked into approving additional devices with passkeys.

  • permalink
  • fedilink
  • source
  • parent