Pomal comments on Passkeys are a trap. Do not use them.

[–] Pomal@sh.itjust.works 5 points 1 week ago (7 children)

There’s a difference between FIDO2 standards, whereby Hardware Tokens, like yubikeys, are not a trap. Of course software derived passkeys are antithetical to privacy, due to their opportunities for abuse like Microsoft’s deployment of the FIDO2 standard.

permalink

fedilink

source

hideshow 7 child comments

[–] Ferk@lemmy.ml 2 points 1 week ago* (last edited 1 week ago) (6 children)

I think the concern is more about the freedom for the user to be able to decide what keys to use and how.

In particular, the author seems to want to share 1 account with multiple people, and enforcing "User-Present User-Verified Non-Copyable Hardware-Backed passkey" as the only accepted method for a service would allow for services to start restricting account sharing more effectively.

permalink

fedilink

source

parent

hideshow 6 child comments

[–] Pomal@sh.itjust.works 3 points 1 week ago (4 children)

The standard allows an infinite number of tokens

permalink

fedilink

source

parent

hideshow 4 child comments

[–] Ferk@lemmy.ml 4 points 1 week ago* (3 children)

You can have an infinite number of tokens with a single YubiKey, but that's not the concern.

The issue is that a website can limit how many different passkeys you are allowed to register to a single account of their service.

So it does not matter if your device can provide infinite keys when the service only accepts one.

permalink

fedilink

source

parent

hideshow 3 child comments

[–] Pomal@sh.itjust.works 1 point 1 week ago (2 children)

Right, then they’re opersting outside of the bounds of the Internet and should be appropriately shamed.

permalink

fedilink

source

parent

hideshow 2 child comments

[–] Ferk@lemmy.ml 4 points 1 week ago* (last edited 1 week ago) (1 child)

Yes, ideally that's what should happen.

In practice, I've seen way too many times big corpo getting away with anticonsumer practices because their mainstream audience is willing to put up with it.

Specially when they introduce it slowly (say.. they start by allowing a reasonable but fixed number of keys ..then they lower the limit but start putting a small fee for each additional key.. then they lower the limit to 1, increase the fee, etc).. they'll test the waters and try to reach a level that enough of the mainstream would accept to maximize the money they make.

permalink

fedilink

source

parent

hideshow 1 child comment

[–] Pomal@sh.itjust.works 3 points 1 week ago

Frog inna pot

permalink

fedilink

source

parent

[–] dropdrip@lemmy.ml 2 points 1 week ago* (last edited 1 week ago)

You never had any fucking freedom in regards to these services. The article is a bug-scare and is just trash. You might as well rail against their requirements to include numbers and special-characters in passwords--"oh, that's infringing on my freedoms! Just yesterday you accepted my password of "password", but now it's no longer acceptable? Wow fascism! Telling people they need to have numbers and special-characters! This is a slippery slope. People rise up and don't put any numbers or special-characters in your passwords!" I can't deride enough the point of view that originated this article. It's the most brain-dead boomer point of view I've yet seen. An epitome of manchild that's endemic to tech.

permalink

fedilink

source

parent