271
submitted 1 month ago by exu@feditown.com to c/technology@lemmy.world
(page 2) 50 comments
sorted by: hot top controversial new old
[-] egerlach@lemmy.ca 8 points 1 month ago

I wish FIDO had paid more attention to SQRL. It's long in the tooth now, but with some attention it could have been a better solution than passkeys, IMO.

[-] PushButton@lemmy.world 7 points 1 month ago

I always thought of passkeys as a convenient way to authenticate.

I am password-less on multiple services.

I have an authentication app on my phone that authenticate me when I am away of my computers. I have passkeys on my personal computer and another set of passkeys on my work laptop.

If I have to authenticate from your computer I simply use my auth app, click on "it's a public computer" and I am good to go.

The dude discovered a butter knife and he tries to replace his spoon with it just to realize it doesn't work well for eating a soup.

load more comments (4 replies)
[-] AsudoxDev@programming.dev 6 points 1 month ago* (last edited 1 month ago)

Passkeys are only good if they aren't in a online password manager. They are better than TOTP 2FA in terms of security and phishing resistance. I see 2FA as a last resort when someone even gets into my password manager. Storing passkeys completely makes this useless, as I'm sure anyone that can log into my accounts would've done so by getting a hold of my unencrypted password manager database. Unless android provides a real offline way of storing passkeys in the device, I am not interested alot.

[-] Appoxo@lemmy.dbzer0.com 4 points 1 month ago

Actual zero knowledge encrypted password managers with 2FA?

load more comments (4 replies)
[-] ParadoxSeahorse@lemmy.world 4 points 1 month ago

Why not just passkeys with a “magic link” fallback though?

This is the same as forgotten password so ytf not

[-] jagged_circle@feddit.nl 3 points 1 month ago

If you're using a hardware token to replace passwords, you're doing 2FA wrong

[-] jagged_circle@feddit.nl 3 points 1 month ago

Dunno, we rolled it out without issue. But of course they also had keepass. You want password AND (TOTP token or hardware token)

load more comments
view more: ‹ prev next ›
this post was submitted on 16 Oct 2024
271 points (86.3% liked)

Technology

59674 readers
1870 users here now

This is a most excellent place for technology news and articles.


Our Rules


  1. Follow the lemmy.world rules.
  2. Only tech related content.
  3. Be excellent to each another!
  4. Mod approved content bots can post up to 10 articles per day.
  5. Threads asking for personal tech support may be deleted.
  6. Politics threads may be removed.
  7. No memes allowed as posts, OK to post as comments.
  8. Only approved bots from the list below, to ask if your bot can be added please contact us.
  9. Check for duplicates before posting, duplicates may be removed

Approved Bots


founded 1 year ago
MODERATORS