391
I don't like passkeys | Ethan Hawksley (hawksley.dev)
submitted 1 month ago by to c/technology@lemmy.world
154 comments fedilink hide all child comments
you are viewing a single comment's thread
view the rest of the comments
[–] 3 points 1 month ago (2 children)

I wouldn't classify passkeys as MFA tho, they are a passwordless method that's more secure than most MFA methods. Afaik it's based on signed certificates or something like that and that's virtually unhackable unless someone gets physical access to your device (and that's game over anyway).

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 1 point 1 month ago* (1 child)

    But bitwarden uploads it to the cloud to be used on any computer, AFAIK.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 4 points 1 month ago

    Bitwarden uploads the whole vault (the whole json of passwords, passkey codes, MFA identifiers, credit card info...) encrypted with your master password. Meaning that whatever is on the cloud should be virtually unbreakable. That's why every time you write the password in the extension or Android app or whatever it takes a second or two to open, because it's downloading and decrypting everything locally.

    When you update a password they need to reencrypt the whole vault and re-upload it again even though it's wasteful since that's their whole security plan.

  • permalink
  • fedilink
  • source
  • parent