Create accountLogin

Recent searches

No recent searches

Search options

Only available when logged in.
eupolicy.social is one of the many independent Mastodon servers you can use to participate in the fediverse.
This Mastodon server is a friendly and respectful discussion space for people working in areas related to EU policy. When you request to create an account, please tell us something about you.

Administered by:

Server stats:

244
active users

eupolicy.social: AboutProfiles directoryPrivacy policy

Mastodon: AboutGet the appKeyboard shortcutsView source codev4.3.6

#Passkeys

8 posts8 participants2 posts today
Replied in thread
Public
Steven Zekowski

@thenewoil
I use #diceware random words and have never used as few as 3 so this doesn’t surprise me. The author advocates for using #passkeys but I have so far resisted that advice from him and others. Using a #password mgr with a browser extension, passkeys seem to be only a small increase in utility. Also don’t like the “black box” aspect of passkeys: what are they, where are they locally, how secure is this system. Happy to hear how I am wrong to be a passkey skeptic.

Public *
David Nelson

I’ve been on a tear setting up hardware-bound #passkeys on my YubiKeys for services that support true passwordless.

It’s still regrettably rare, but Google, Microsoft, and Yahoo all support it, which does cover most people’s email.

My password manager has never done me wrong but it’s reassuring to know I can get into my most important accounts without it.

Bonus points to Microsoft for letting you completely remove your password from your account. You can’t phish something that doesn’t exist.

Continued thread
Public
Karl Voit :emacs: :orgmode:

@keno3003 (2/2) Der einzige Schutz dagegen ist, wenn man physische #FIDO2-Tokens verwendet ("device-bound passkeys" nur in der "roaming-authenticator"-Variante!), die das Auslesen des Geheimnisses prinzipiell ausschließen. Dies ist also die einzige wirklich Phishing-resistente Authentifizierungsmethode.

IMO sollten also die Tipps am Ende vom Video *mit Fokus auf Sicherheit* anders lauten:

- am besten 2 #FIDO2 HW-Tokens besorgen und für alle #Passkeys verwenden (für #IDAustria Österreich: oesterreich.gv.at/dam/jcr:972a)

- keine phishing-gefährdeten Fall-Back-Mechanismen verwenden: also nur den 2. FIDO2-Token

- jede 2FA ist besser als keine

- niemals Passwörter in die Cloud schicken (Cloud-PW-Manager)

HTH 🙇

#security#Sicherheit#Authentifizierungsmethoden
Public
Karl Voit :emacs: :orgmode:

@keno3003 ad "Das Problem mit Passkeys" youtube.com/watch?v=u7Ti-Jc-b3

Sorry, dass #Passkeys immer absolut resistent gegen #Phishing sind, stimmt leider nicht.

arxiv.org/abs/2501.07380
"Another concern could be social engineering, where a user is tricked into sharing a passkey with an account controlled by an attacker."

Meiner Interpretation nach ermöglicht also das Transferieren von Passkeys zu anderen Personen eindeutig Phishing-Methoden. Die sind vielleicht noch nicht in der Praxis aufgetaucht aber ausschließen kann man es keinesfalls.

(1/2)

YouTubeDas Problem mit Passkeys 🤔By c't 3003
Replied in thread
Public
Karl Voit :emacs: :orgmode:

@yacc143 FYI: #Passkeys and #FIDO2 (= "device-bound #passkey" which can be divided into "platform-" and "roaming-authenticators") are identical except the #cloud-sync mechanism (as of my current understanding).

So unfortunately, they get mixed up or are considered as totally different things. Both is wrong.

In reality, they are very similar except that FIDO2 hardware tokens ("device-bound passkeys" only in their "roaming-authenticator" variant) are designed that way, that Passkeys are not being able to extracted from the device (at least for the moment).

Therefore, users of HW tokens can't be tricked into transferring their passkey to a rogue third party, which is possible with all other Passkey variants. Therefore: passkeys are NOT #phishing-resistant in the general case.

#security#authentication#2FA
ExploreLive feeds
About