Hardware Security Keys deployed to replace passwords is abuse.
They’re supposed to be a second factor.
Password managers with totp seems like the best solution.
I wouldn’t recommend hardware security keys to others. It’s just a ticking time bomb before they loose it and get fucked.
smartphones do use files and folders. They just don’t typically come with a file browser like your desktop does.
This is my biggest gripe about Android. It’s basically unusable.
Sure, I use Amaze from fdroid. But I tried to extract a compressed tarball and it literally couldn’t do it. And there were 0 apps in fdroid to extract compressed archives. What a useless OS.
Of you think Android is bad, wait until you see iOS…
Yes, someone really made TOTP for Game Boy. I cannot in good conscience actually recommend using this, but it will make you popular at parties. (At my parties in any case.)
You kinda did recommend it in the last sentence :(
This is a very badly written article that conflates TOTP with passwords and then uses that to try to draw a line between totp and passkeys. Passkeys are limited in use in the exact same way that password are. The entity making the website gets to decide the rules.
Attested passkeys will not happen for common big tech websites because they wouldn’t completely prevent the use of password managers.
All these companies are pushing for passkeys because they not only are vastly better for security, but because they remove liability for these companies.
The author falls down the steepest slope I’ve ever seen writing this article, and still fails to see the basic facts.
I wouldn’t be surprised if five years down the line companies figure out a way to use pass keys as a way to de-anonymize and track people.
Why? Just give them another passkey.
Usage isolation is 🥁 key.
The article is about the weakness of TOTP, not passkeys themselves.TOTP is a great solution.
It is?
Keep reading. The Hack explains how corporations can arbitrate which type of passkeys they might allow when their TOTP authenticator refuses your passkey settings.
So what makes passkeys so different? Well, they look very similar to TOTP on the surface. Both have an open standard (RFC 6238 for TOTP, WebAuthn for passkeys), so surely passkeys must have all these same nice properties as TOTP, right? At first glance it would seem so.
Don’t forget that unlike passwords and SMS codes and TOTP, passkeys are designed to function in the background without you ever seeing the details.
Wait for Big Tech to propose something just as convenient and secure but more clearly defined and with fewer strings attached. In the meantime if you want security, your Game Boy can provide you with TOTP.
It really seems like the article is drawing a strong distinction between TOTP and passkeys and saying TOTP is better though
Implementations.
What FIDOA decides to passkey and you with your website are totally different security agendas. The Hack goes into detail how corporations can refuse several of your passkey settings.They are not different implementations, they are completely different things. TOTP can’t have remote attestation or settings, it’s just a code. Passkeys are something else, that has some similarities (also generating a time-based code).
My hackles starting to go up when I started to see more and more websites push for passkeys.
I agree with all the points made in this post except I’m troubled by the conclusion that we should let big tech decide a better solution. That puts the power right back with part of the consortium that was focused as part of the whole passkey issue here. Not saying I know what would be a better alternative but I don’t agree that that is it.
