Do you really believe your average Apple, Google/Android or Microsoft/Windows user use these?
- 1 Post
- 11 Comments
Joined 3 years ago
Cake day: April 5th, 2024
You are not logged in. If you use a Fediverse account that is able to follow users, you can follow this user.
I’m telling you why passkeys are garbage:
Case 1
- Login to website
- Maybe use 2FA device
- Website creates session cookie
Never have to login again for the next few months
Case 2
- Go to website
- Use password manager to auto fill credentials
Click like 2 buttons and you’re done
Case 3
- Create passkey
- Passkey is stored on propietary, trust me bro, “we will never share this with the NSA or FBI” Apple or something account where you can’t export them
- User becomes dependent on cloud provider
- User will easier forget their real login data because they don’t use them
- User is fucked if account get’s locked/deleted
- User can still be hacked by simply compromising machine
- No 2FA
Of course OP is too incompetent to post the link to the source, so here we go again:
0·16 days agoAre these real vulnerabilities or are these “When Mars and Jupiter are aligned next to each other and you compile the kernel backwards X might crash” ones?
0·27 days agoI really like reading some stuff like that from a website that summarises a few mastodon posts and additionally adds 10 ads and trackers.
How about posting the original source next time?
0·1 month agoNot updating stuff + Public sign ups enabled (did you even read the setup guide?) + Unrestricted internet access
Yeah I wonder what could possibly go wrong…
But great writeup
That’s the neat point. You don’t have to use one when you enter your normal login credentials and the average user like does not use one.
But with passkeys you are forced to use one and the average user will use the default one of their vendor.
Yeah because they obviously don’t care about security (like machine compromise - that’s why there is 2FA in the first place), which contradicts all advantages of passkeys.