129
Passkeys are not a trap. Use them! (hachyderm.io)
submitted 6 days ago by to c/privacy@lemmy.ml
173 comments fedilink hide all child comments
 

A rebuttal to an anti-passkey, pro-TOTP post that has made the rounds on Lemmy as well.

you are viewing a single comment's thread
view the rest of the comments
[–] 10 points 5 days ago* (4 children)

The biggest problem I have with passkeys is big companies aren't implementing them to improve your security - they're implementing them because it absolves them of liability and responsibility for implementing good security on THEIR end and allows them to implement whatever the fuck vibe-coded bullshit nonsense they want without any knowledgeable or skilled staff, and even if it's good for me too, I'm not inclined to do these assholes any favors. It'll just make them sloppier and lazier on other elements of security and they'll turn around and put the blame on the user, and courts will go right along with it because nobody in the legal system can find their asses with both hands.

  • permalink
  • fedilink
  • source
  • hideshow 4 child comments
    •
  • [–] 10 points 5 days ago (2 children)

    Using established and tested security implementations instead of rolling your own has been considered good practice since forever. It's not a bad thing.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 7 points 5 days ago* (last edited 5 days ago) (1 child)

    It's not about the implementation - it's about what passkeys do and don't do.

    Passkeys prevent someone from stealing hashed passwords from the SERVER, but if the server is already compromised badly enough to let someone in, all of the data stored on that server is compromised already anyway. Companies want to use passkeys because there is less involved in implementing secure login credentials, but that is only ONE tiny part of overall end to end security, and I do not for a SECOND believe that they are going to keep on highly skilled, security-minded developers at real salaries when the C-suite says "We're using passkeys. We're secure. Fire the high priced developers and get me some interns who can use Claude."

    TLDR: Passkeys are not a magic bullet and they aren't a game changer, and the false sense of security they push is dangerous.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 2 points 5 days ago

    I realy dont think that's a thing. End-user login security is a tiny footnote on page 729 of the 2000+ page security document of a large company's cyber security department. Switching that to passkeys will not change anything about how the company handles security. AI will. But not passkeys.

    And as we have seen many times, companies have been bad with security already and many password databases have been breached. Having a tool that limits the impact of bad security is a good thing.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 3 points 5 days ago

    Exactly, people keep focusing on whether passkeys are secure as a concept, and they are. However, what we actually need to talk about is how they're going to be used in the wild, and what companies are likely to do with them. That's what's going to affect vast majority of the people.

  • permalink
  • fedilink
  • source
  • parent