HaraldvonBlauzahn@feddit.org to Linux@lemmy.mlEnglish · 10 hours agoPasskeys are a trap. Do not use them.nonfunctional.substack.comexternal-linkmessage-square35linkfedilinkarrow-up164arrow-down123cross-posted to: hackernews@lemmy.bestiver.se
arrow-up141arrow-down1external-linkPasskeys are a trap. Do not use them.nonfunctional.substack.comHaraldvonBlauzahn@feddit.org to Linux@lemmy.mlEnglish · 10 hours agomessage-square35linkfedilinkcross-posted to: hackernews@lemmy.bestiver.se
minus-squareSecureTaco@lemmy.asc6.orglinkfedilinkEnglisharrow-up35arrow-down1·9 hours agoThis is such a crazy take. Here’s a major rebuttal from mastodon.
minus-squareHaraldvonBlauzahn@feddit.orgOPlinkfedilinkarrow-up1·2 hours agoFAANG companies are not using “bait and switch”? Do you have control how Google implements that, or a remedy if they suddenly include attestation?
minus-squaresem@lemmy.blahaj.zonelinkfedilinkarrow-up3·edit-23 hours agoIs TOTP always phishable? Like the phisher says “tell me the code in your authenticator app”? But can’t say “tell me your passkey?” This kind of explains to me why passkeys are so annoying – they are designed for if you’re always going to be using the same device all the time. I wish password managers could hold passkeys reliably – they keep failing for me.
minus-squarelone_faerie@lemmy.blahaj.zonelinkfedilinkEnglisharrow-up3·3 hours agoPhishing isn’t just over the phone. A phishing website that’s imitating say a bank website is just as easy to get the TOTP than it is the password.
This is such a crazy take. Here’s a major rebuttal from mastodon.
FAANG companies are not using “bait and switch”?
Do you have control how Google implements that, or a remedy if they suddenly include attestation?
Is TOTP always phishable? Like the phisher says “tell me the code in your authenticator app”? But can’t say “tell me your passkey?”
This kind of explains to me why passkeys are so annoying – they are designed for if you’re always going to be using the same device all the time.
I wish password managers could hold passkeys reliably – they keep failing for me.
Phishing isn’t just over the phone. A phishing website that’s imitating say a bank website is just as easy to get the TOTP than it is the password.