Why is your grandpa or fictional billions users being MITM’d?

Passkeys are an end run on general purpose hardware largely under your own control, which is a much bigger issue in scale than dealing with customers who can’t access the services they pay for because of some byzantine security or know your customer laws/procedures.

▲

skybrian 4 hours ago | parent | next [-]

There is a reason that banks send increasingly strident text messages that they will never ask for this code.

	▲	Telaneo 3 hours ago \| parent [-]
		And then undermine that effort by actually asking for that code anyway.

▲

throwawayffffas 4 hours ago | parent | prev | next [-]

For their bank accounts, search tech support scam on youtube to see how that goes. Btw passkeys do nothing to stop this, they probably make it easier since grandpa doesn't have to search for a password or unlock a password manager to send his money to the scammers.

▲

danpalmer 4 hours ago | parent [-]

Convincing someone to log in to their bank and send you money is strictly harder than convincing someone to log in to their bank.

▲

throwawayffffas 4 hours ago | parent [-]

There is a middle ground where people are convinced to download a trojan and click ok once.

▲

somerandom2407 2 hours ago | parent | next [-]

And if the bank implements the best form of Passkey (and implements it well) in this case it would require the user to biometrically authenticate before sending money (perhaps based on dollar amount or transaction volume) to a new account. The user would hopefully learn over time that the biometric requirement is aligned with money transfers and would grow suspicious if they were prompted for it during a scam session.

▲

grebc an hour ago | parent [-]

You’re making life miserable with such ideas.

I bought a house earlier this year and the bank froze my deposit I sent to the real estate agent.

I rang the bank straight away and badgered them to unlock it ASAP in case the sale fell through for their BS fraud department to sift it.

They blamed the fact the real estate they’d never transacted with before, I politely told them they’re based in one state while I was purchasing in another.

It took 2 hours of back and forth to get them to send it, even after they did all their security questions.

It’s all a fugazi, they/governments do not want you having large amounts of money - it’s as simple as that.

	▲	somerandom2407 35 minutes ago \| parent [-]
		Actually it's kind of the opposite. Right now the banks know how easy it is for someone to end up getting scammed, so they try to be really strict on picking up on potentially fraudulent transactions precisely because they can't trust endpoint security. If they have something like this in place, they will have greater confidence in the transaction being genuine and less likely to block it. In this case, for such a large amount of money, relative to the size of your account, they might still be very cautious about it, but it would be less likely to cause an issue.

▲

danpalmer 3 hours ago | parent | prev [-]

I'm not sure I follow this point? A trojan would fail to exfiltrate passkeys (assuming they're stored securely). It would be able to see a valid login and potentially use that session or exfiltrate the session, but wouldn't be able to get persistent account access. This seems better than stealing a password and getting persistent account access, or possibly stealing a TOTP code for the same. It's bad, but I think it's made better by passkeys? Unless I'm misunderstanding your point.

	▲	throwawayffffas 3 hours ago \| parent \| next [-]
		A trojan would succeed in using your session and potentially start sessions from your device in cases where your key does not require your confirmation or where they have found a bug to bypass that (it maybe as simple as providing simulated input events to the system). My point is the gains are overstated the main weakness is almost always user action. Passkeys will not magically solve all our security problems.
	▲	zten 3 hours ago \| parent \| prev [-]
		I think they're just counting on coaching the person through whatever privilege escalation is required when the trojan wants access to the passkey.

▲

danpalmer 4 hours ago | parent | prev [-]

Why are they being MITM'd? Because some people want money and don't mind breaking laws.

▲

grebc 4 hours ago | parent [-]

Seems to me that the institutions of the FIDO alliance would have better luck chasing these people that break laws.

Instead we’re increasingly locked out of devices we buy and told/mandated this is how you’ll use them.

▲

danpalmer 4 hours ago | parent | next [-]

You want corporations to get more into law enforcement? These things are already crimes, law enforcement agencies already go after them. Would I like more public funding for that? Absolutely. When we've solved crime then let's go back to using passwords, or even just usernames at that point, after all no one will hack them.

	▲	grebc 4 hours ago \| parent [-]
		Since you’ve made up a question I didn’t ask or intimate, I’ll leave the discussion here.

▲

habinero 21 minutes ago | parent | prev [-]

"Just solve crime, bro" is certainly one approach to computer security.