240
What the !#@% is a Passkey?
(www.eff.org)
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
this post was submitted on 04 Nov 2023
240 points (94.1% liked)
Technology
35003 readers
210 users here now
This is the official technology community of Lemmy.ml for all news related to creation and use of technology, and to facilitate civil, meaningful discussion around it.
Ask in DM before posting product reviews or ads. All such posts otherwise are subject to removal.
Rules:
1: All Lemmy rules apply
2: Do not post low effort posts
3: NEVER post naziped*gore stuff
4: Always post article URLs or their archived version URLs as sources, NOT screenshots. Help the blind users.
5: personal rants of Big Tech CEOs like Elon Musk are unwelcome (does not include posts about their companies affecting wide range of people)
6: no advertisement posts unless verified as legitimate and non-exploitative/non-consumerist
7: crypto related posts, unless essential, are disallowed
founded 5 years ago
MODERATORS
I’m of the mindset that locally stored keys and/or social solutions are better than throwing all passwords in a single place.
All passwords for large amounts of people in a single place is begging for a break-in.
I spend a lot of time studying solutions in this space as I’m a long time crypto solutions dev. Lots of ideas and discussions to be had.
I’m not disagreeing with you, just having a dialogue.
That's probably true, but perfect can't be the enemy of good. Getting everyone who currently uses the worst method (a single global password) to use a better method means that better method has to be easier than that, and as things lie right now, most security researchers agree that the method most likely to succeed is removing roadblocks, both client-side and server-side, to make password mangers even easier and more secure (whether you want to store it locally or not is really up to you, and again, it is already an option). We're not talking about people who already try to stay secure, or care about the exact details. You and I already know we care about security and do our best, presumably. The crucial thing is to onramp Bob Q. Public, the middle manager whose password on everything is
rover73because he loves his dog, and any solution more complicated than remembering one password and clicking one button is going to be too much change for him to get around to doing itOnboarding new users securely is in the forefront of most minds in my industry because the current standard is a 12 word phrase written on paper, which most users throw in a cloud solution or screenshot.
The stakes are even higher in crypto where you’re protecting, without recourse, large sums of value. Passkeys are a critically needed solution for my industry. But they need coupled with a social or offline storage recovery mechanism.