| ▲ | torstenvl 2 hours ago |
| > To an individual, the greatest risks are instead permanent account lockout, automated account bans, and device loss. By using passkeys, you gain better security against man-in-the-middle attacks but face the higher probability scenario of losing access to your accounts. I'm glad to see this view becoming more mainstream. Passkeys are grotesquely insecure. The only possible way to consider them more secure is if phishing attacks were more common and more damaging than lockout, which is so implausible that I reject the idea that someone could take that position in good faith. |
|
| ▲ | bennetthilberg 2 hours ago | parent | next [-] |
| > Passkeys are grotesquely insecure. Lockout is a real risk, but there is nothing insecure about passkeys. Private keys stored on the secure enclave + biometrics or passcode before any signature is produced + origin binding mogs a static string and a 6-digit TOTP (often generated with a secret key outside the secure enclave) that can be phished and entered from anywhere. Also, in many (possibly the majority) of scenarios where someone is locked out of their passkeys, they’d also be locked out of TOTPs and passwords. > The only possible way to consider them more secure is if phishing attacks were more common and more damaging than lockout You’d be surprised. |
| |
| ▲ | rcxdude 3 minutes ago | parent | next [-] | | Security as a field would be a lot less obnoxious if it did not neglect availability as an important facet of security. A 'security' system that obstructs legitimate access is also failing at its job. | |
| ▲ | torstenvl 2 hours ago | parent | prev [-] | | > Lockout is a real risk, but there is nothing insecure about passkeys. secure - adjective se· cure si-ˈkyu̇r -ˈkyər securer; securest 1 a: free from danger b: affording safety (a secure hideaway) c: TRUSTWORTHY, DEPENDABLE (a secure foundation) d: free from risk of loss Passkeys as a sole/required method of authentication increase the risk of permanent loss. In any other configuration they do not mitigate phishing risk. It is not possible to say there is nothing insecure about them. | | |
| ▲ | bennetthilberg 2 hours ago | parent [-] | | Reliability != security If a car breaks down every 50 miles we would call it unreliable. If a car’s doors don’t lock we would call it insecure. | | |
| ▲ | torstenvl an hour ago | parent [-] | | Pro tip: if your substantive argument requires gaslighting people about the literal definitions of words, maybe you should take a step back. | | |
| ▲ | bennetthilberg an hour ago | parent [-] | | > gaslighting That is some serious semantic bleaching! I’m not disputing the fact that “secure” has different meanings in different contexts. My point is that when we talk about the “security” of authentication methods, we almost always are referring to its resistance to attacks, exploits, social engineering, etc. If you tell the average non-technical person that “passkeys are insecure,” they’ll think that it’s easier for (WLOG) Russian hackers to phish or bypass their way through some website’s passkey requirement. And to be clear, I don’t think it’s ridiculous to say that right now, the risk of lockouts outweighs the security benefits of passkeys. But this is a fixable problem. If it gets easier to securely recover or back up passkeys, I think we can reach what is more clearly a “best of both worlds” of security and reliability. | | |
| ▲ | hnfong an hour ago | parent [-] | | The context is literally the line quoted from the article, which made it reasonably clear what the word was supposed to mean, and you decided that (1) you understood what they meant, and (2) deliberately tried to bring up an alternative meaning and object to it, and (3) continue arguing why (2) was justified by taking the sentence out of its context (and into your hypothetical context). | | |
| ▲ | bennetthilberg 22 minutes ago | parent [-] | | This line from quoted from the article? > security against man-in-the-middle attacks but face the higher probability scenario of losing access to your accounts The author says "security" against man-in-the-middle attacks. Are they not using the typical cybersecurity-context meaning of "secure" that I just mentioned? (Resistance against exploits, attacks, social engineering, etc.) And note that they say "higher probability scenario of losing access to your accounts" rather than something like "lower security against account loss" which would have been admittedly understandable, but a bit less clear since the more common cybersecurity meaning of "security" was just used. > deliberately tried to bring up an alternative meaning I am using the typical understanding of what "secure" means both 1) in the context of the quote from the article you used and 2) generally in the context of authentication methods. Let's not act like I dug up some obscure and irrelevant alternative definition. > and into your hypothetical context Is it really so unrealistic and hypothetical to think about how non-technical people (i.e., the vast majority of people) will interpret the at best questionable statement that "passkeys are insecure"? I stand by my claim that most people will get the wrong idea when they hear that. |
|
|
|
|
|
|
|
| ▲ | hnfong an hour ago | parent | prev | next [-] |
| > if phishing attacks were more common and more damaging than lockout The calculus changes if the service is a bank or your stock broker, which, if you are in any reasonable jurisdiction, if you can prove your identity (in court) they are legally obliged to ensure they give you back your money. But, for the vast majority of other internet services... I honestly don't think anyone would want to MITM my instagram account for example. |
|
| ▲ | talon8635 an hour ago | parent | prev [-] |
| Lockout sucks, but it’s not an indicator of insecurity. If anything it’s the opposite. I don’t use passkeys because I like BitWarden and two factor Just sayibg |
