Comment on Passkeys might really kill passwords

• monko@lemmy.zip ⁨9⁩ ⁨months⁩ ago

  Not sure exactly what you’re getting at, but any authentication model must be designed with the assumption that a user can lose all their devices, passkeys included. That’s where fallbacks come into play. Even with Apple’s system, you can recover your keychain through iCloud Keychain escrow, which (according to their help page) uses SMS:

  To recover your keychain through iCloud Keychain escrow, authenticate with your Apple ID on a new device, then respond to an SMS sent to a trusted phone number.

  While SIM swaps aren’t super common, they’re not the most difficult attack. Passkeys are strong against direct attacks, for sure. But if I can reset your account using a text message sent to a device I control, is it really that much more secure?

  source

  • unconfirmedsourcesDOTgov@lemmy.sdf.org ⁨9⁩ ⁨months⁩ ago

    So if you lose access to all of your devices, you’re completely locked out of everything until you’re able to get a new working phone activated on a trusted phone number? The trade-off of inconvenience for security here just doesn’t seem worth it to me.

    source

    • monko@lemmy.zip ⁨9⁩ ⁨months⁩ ago

      Depends on the provider in question. While Apple does allow SMS recovery, they also let you designate a trusted contact who can let you in as an alternative. This is obviously more convenient (if you have a friend or family member who can be available when you need them), but the situation with SMS vulnerabilities is still my main gripe.

      source
  • Pulptastic@midwest.social ⁨9⁩ ⁨months⁩ ago

    Is it possible to use some kind of fingerprinting to identify people? It works for marketers, could that idea be used for security?

    I am a total noob who is interested, if I come across as uninformed it is because I am.

    source

    • monko@lemmy.zip ⁨9⁩ ⁨months⁩ ago

      Totally! Browser and device fingerprinting are commonly used as first-line defenses against ATOs (account takeovers). There are other kinds of fingerprinting, like those that can learn about your installed hardware and drivers. Really, I’m learning about more fingerprinting methods all the time. That said, decisions are usually made based on several different information sources. These include variables like:

      • GPS geolocation
      • IP address/location
      • Time of day
      • Device ID, OS version, browser version, etc.
      • Hardware profiles, including CPU and GPU architecture/drivers
      • User behavior like mouse movement, typing patterns, and scrolling
      • Whether the user is connecting via a known VPN IP address
      • Cookies and extensions installed on the browser

      There’s even some buzz around “behavioral biometrics” to identify individuals by how they type, but this is still not the sole method of identification. It’s mainly about flagging bots who don’t type like humans. However, learning how an individual types can help you determine if a subsequent visitor is the actual account owner or a bad actor.

      In my experience, fingerprinting and adjacent identity proofs are rarely used in isolation. They’re often employed for step-up authentication. That means if something doesn’t match up, you get hit with a 2FA/MFA prompt.

      Step-up can be pretty complex if you want it to be, though, with tons of cogs and gears in the background making real-time adjustments. Like you might not even realize you’ve been restricted during a session when you log in to your bank account, but once you try to make a transfer, you’ll get an MFA prompt. That’s the UX people in action, trying to minimize friction while maintaining security.

      source