1220
I love password based login (lemmy.world)
submitted 8 months ago by to c/programmer_humor@programming.dev
154 comments fedilink hide all child comments
 
you are viewing a single comment's thread
view the rest of the comments
[–] 14 points 8 months ago (8 children)

I forget. Are passkeys the access method that prevents you from logging in ever again if you lose access to a device?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 8 child comments
    •
  • [–] 17 points 8 months ago (4 children)

    Typically, no. You're thinking of TOTP/Authenticator based 2FA. Those still come with backup codes in case you break the phone that has the TOTP codes warehoused. I always recommend keeping those backup codes saved in the notes of whatever password manager you're hopefully using.

    Passkeys are essentially just one half of a cryptographic key pair (like what you'd use for authenticating SSH without passwords). These allow you to authenticate once using password + 2FA, then use the generated passkey for future sessions. Since these are much more complex than passwords and remove the need to actually remember anything, they are significantly more secure.

    There are also some other features that I'm forgetting, and that may not be a perfectly accurate description, but I think you can get the gist.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 9 points 8 months ago (3 children)

    Passkeys are supposed to be bound to one device and protected by that device's OS's secure enclave. If you have a second device you're supposed to create a second passkey.

    That's why many sites will flat out refuse to let you create a passkey with a desktop browser since a PC-stored passkey doesn't fit the security model.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 3 points 8 months ago

    Yeah, that's how I understood it to work, as well. I didn't mention it because I've seen a bunch of different implementations that don't seem to work that way. I didn't want to speak too much on that specific point, since I don't have a very thorough understanding of it.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 4 points 8 months ago (1 child)

    Websites should not get to dictate my security model. I'll accept annoying me about being less secure because I get that people are dumb, but you've gotta choose somehow! Also, any passkey is safer than a password, so that's still BS.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 3 points 8 months ago

    The logic behind it is that a smartphone-bound passkey represents two factors of authentication: what you have (the phone) and who you are (the fingerprint used to unlock the phone's passkey store).

    Anything on a PC is easily copied and can only ever be safely assumed to represent one factor: what you know (the password to unlock your password manager). Thus the benefit of getting a two-factor authentication in one convenient step falls away.

    Of course it's still super annoying, especially if you don't really trust your smartphone OS vendor and use a portable password manager already.

  • permalink
  • fedilink
  • source
  • parent