1220
I love password based login (lemmy.world)
submitted 7 months ago by to c/programmer_humor@programming.dev
154 comments fedilink hide all child comments
 
you are viewing a single comment's thread
view the rest of the comments
[–] 4 points 7 months ago (13 children)

Magic link only is the wirst kind of login systems. However, I don’t know any big real companies that use this.
If you don’t like passwords, just use passkeys.

  • permalink
  • fedilink
  • source
  • hideshow 13 child comments
    •
  • [–] 7 points 7 months ago (8 children)

    Wasn't passkeys basically "passwords, but Google has control of them"?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 8 child comments
    •
  • [–] 7 points 7 months ago (6 children)

    dont think so. what i gatherd passkeys is a public/private key scheme, much like pubkey auth in ssh logins.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 6 child comments
    •
  • [–] 3 points 7 months ago (4 children)

    Its still just a single factor if some body steals your private key.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 1 point 7 months ago (1 child)

    Yes, buts it’s not something that can be easily guessed or found on a post it on the monitor

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 2 points 7 months ago

    True dat. But if they compromise your computer the first thing the look for is key files.

    Like my ssh keys are in a root permission file. Protected from general sight, but if somebody compromises my PC with a CVE on then goodbye keys.

    At least with hardware key it is removable and requires a button press.

    So accessing becomes physical access or quantum computer cracking

  • permalink
  • fedilink
  • source
  • parent
  • [–] 2 points 7 months ago

    Not even close.

    Passkey is a generic technology not specific to any vendor. While there are a few versions of it, the long story short is it uses an encryption key you have to authenticate you rather than a password. This makes phishing extremely difficult if not impossible.

    There's lots of passkey implementations. All the major browsers have one built in with their included password managers. Most good password managers like BitWarden or 1Password also support pass keys. And if you want to be extra secure, the passkey can be an actual hardware token like a YubiKey.

    So yeah you see Google pushing passkeys a lot, and if you use Google password manager it will store your pass keys. But you also see Apple pushing it, and Microsoft also.

  • permalink
  • fedilink
  • source
  • parent