475
Harebrained logic (europe.pub)
submitted 2 days ago by to c/assholedesign@lemmy.world
107 comments fedilink hide all child comments
 

Typing a password slows you down, so now you'll need to enter a 2fa and a password. Fucking brilliant!

you are viewing a single comment's thread
view the rest of the comments
[–] 2 points 1 day ago (2 children)

Syncable passkeys do make it easier to handle new devices, but break one of the key values of passkeys - device atteststion. Syncable passkeys are effectively just long passwords as they aren't tied to a device, meaning anyone who gets ahold of the passkey can access your accounts.

At least with syncable passkeys you can't have a website leak your passkey (as they asymmetric keys), but with password+MFA a leaked password doesn't give direct access to your accounts.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 2 points 1 day ago* (1 child)

    Too many services don't allow multiple passkeys per account. If they are supposed to be device level attestation, you need to be able to enroll one per device. I know that there are some frameworks to connect an enrolled device to attest, but that a) plain doesn't work well for some configs, and b) is annoying. I understand having a hardware security key for some stuff, but I feel like having that be a random ass phone for most people isn't really that desirable.

    I feel like syncable passkeys are a band aid on top of most services having no idea how to implement passkeys well.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 2 points 1 day ago

    That's good to know, I've honestly been avoiding them as I find the rollout and concept from to be questionable at best.

    Given those issues I'll be curious to see if passkeys keep up their momentum. It sounds a lot like a solution that solves some problems while creating other problems.

  • permalink
  • fedilink
  • source
  • parent