Comment on Google will now make passkeys the default for personal accounts

• alvvayson@lemmy.world ⁨1⁩ ⁨year⁩ ago

  Bitwarden is also supporting passkeys, so it won’t make a difference for their users whether they use passwords or passkeys.

  And the fact that you don’t see anything wrong is more a you problem. Boomer mentality, dude. Don’t became one.

  source

  • Kusimulkku@lemm.ee ⁨1⁩ ⁨year⁩ ago

    It would probably be better for you to explain what’s wrong and not just call them a boomer as if that explains it.

    source

    • alvvayson@lemmy.world ⁨1⁩ ⁨year⁩ ago

      If they want to be a Boomer and stick to 20th century solutions, why should I care?

      If it works for them, fine. Nothing wrong with that.

      It’s obviously not working for most people. Most people reuse weak passwords and get their passwords hacked. Passkeys solve that for those users.

      That’s why the whole industry is shifting to passkeys.

      source

      • Kusimulkku@lemm.ee ⁨1⁩ ⁨year⁩ ago

        “It’s old so it’s bad” is not a very convincing argument.

        I think he was wondering how technically the new solution is better, especially compared to password database solutions where complex password and password reuse isn’t an issue.

        source

        • -> View More Comments
      • wildginger@lemmy.myserv.one ⁨1⁩ ⁨year⁩ ago

        It kinda sounds like you dont actually know whats wrong, and are just blindly following the trends.

        Doesnt that make you the boomer?

        source

        • -> View More Comments
      • HubertManne@kbin.social ⁨1⁩ ⁨year⁩ ago

        oh man. so I am a boomer. good to know.

        source
  • V0lD@lemmy.world ⁨1⁩ ⁨year⁩ ago

    What do you see that’s wrong with it that we don’t if I may ask?

    source

    • DeadlineX@lemm.ee ⁨1⁩ ⁨year⁩ ago

      Mostly phishing. Passkeys can’t be phished. And really, passwords are awful in general for security purposes. You don’t have to use your phone or google or apple or whatever.

      I actually have a physical usb key that I use as a passkey. Its just a more secure login implementation and will likely be the only option in the future.

      source

      • hedgehog@ttrpg.network ⁨1⁩ ⁨year⁩ ago

        Passkeys can be phished, it’s just much more difficult than with passwords, TOTP MFA, SMS MFA, other OTPs, or push notification-based MFA (e.g., Duo or the way Microsoft, Apple, and Google push a notification to their app and you confirm and/or enter the key).

        Passkey is extremely phishing resistant in the same as Webauthn MFA and U2F MFA are, in that origin checks by the browser prevent attackers from initiating the auth process. But it can still be attacked in these ways:

        1. XSS bug in the target website
        2. Browser vulnerability
        3. Malicious browser (not a concern on iOS but a concern everywhere else)
        4. Compromise of any cert in the chain between you and the target website
        5. Convincing the user to install (or using malware to install) a root certificate, or compromising one you already installed (e.g., for work)
        6. Bookmarklet/clipboard/devtools attacks

        From memory, passkeys, webauthn, and u2f should prevent over 99% of phishing attacks that are successful without them in place.

        There’s also the risk of the passkey itself being compromised, though that level of risk is dependent on your device / how you’re storing your passkeys and isn’t a “phishing” risk.

        source

        • -> View More Comments
  • Engywuck@lemm.ee ⁨1⁩ ⁨year⁩ ago

    Boomer you mom, idiot. Fuck off.

    source
• confusedbytheBasics@lemmy.world ⁨1⁩ ⁨year⁩ ago

  Long passwords can still be phished. Passkeys cannot. It’s a huge upgrade.

  source

  • Engywuck@lemm.ee ⁨1⁩ ⁨year⁩ ago

    I don’t think so, but whatever.

    source

    • confusedbytheBasics@lemmy.world ⁨1⁩ ⁨year⁩ ago

      What do you mean? Do you not believe the anti-phishing features will work as described for a reason?

      source