391
I don't like passkeys | Ethan Hawksley (hawksley.dev)
submitted 1 month ago by to c/technology@lemmy.world
150 comments fedilink hide all child comments
you are viewing a single comment's thread
view the rest of the comments
[–] 4 points 1 month ago (1 child)

I don't think that github has to know that. You could be using a password manager and choose to make it a minimum character boring password or meet minimum complexity requirements or use the same password on a million sites. You have to secure your credentials; complying with the minimums of a service isn't security.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 2 points 1 month ago

    GitHub doesn't need to know that - I think that's why it's a bit of a cop out for MFA. Sure, your bitwarden may implement MFA, but just a chrome browser isn't MFA.

    Passkeys enable sites to offload the responsibility of securing accounts to the user, and if the user chooses a weaker way to implement them, GitHub doesn't give a fuck.

  • permalink
  • fedilink
  • source
  • parent