Also, those stupid annoying modern log in pages where it just asks for your email, then refreshes to a page with a password, because the password managers are hit and miss on detecting the log in form when it does that shit and why the fuck are we doing an extra step oage anyway???
Also This strange trend to split username and password on to two separate pages, or only showing the password field after confirming the username
Not that strange. Different users may belong to different groups which may have different authentication backends. The associated authentication method is brought up once a username has been provided.
if your choice of api route directly affects your auth flow something is very wrong.
I don’t like it when I need to sign in twice for single sign-on. The email/username then tells the system if they need to be directed to another sign in page. Like Google or Microsoft. This then allows you access without having to give them your password.
You can do that as part of an OAuth workflow. You don’t need to have them on separate pages for that to happen.
Yes, but, it also lets them slurp up email addresses. Routing users is legit tho.
This reminds me of another annoying one, often related to these routing pages.
I type in my email, then it routes to “create an account”. Or WORSE it mimmicks the thing the OP is complaining aboit and says it sent me a verification email, then prompts me to make an account.
Like fucker, I have a dozen+ email addresses, if my email isn’t an account, just tell me so I can try a different one.
- Username
- Password
- MFA
- Do the whole process all over again because the remember this device is on step 2 and it’s impossible to go back
Bonus stage 0: special login URL decided to crap out, and going back to any point in history automatically redirects to the error page that you can’t use to log in, so you need to keep going back and trying to copy the URL before it redirects becausw Firefox interprets pressing “stop” as “do whatever you want idk”
Fucking aws…
You forgot step 2.5: incorrectly identifying stoplights 6 times in a row.
At least identifying shit is easy, I have seen some wild captchas. Roblox for a while had some really crazy ones where its like “Identify the shape that most closest matches the answer to this math problem”, and the shapes are all highly stylized numbers on a field that is basically a colorblind test.
Math? I’d drop the entire service for that. We enslave rocks and teach them math and language to avoid more math.
Oh fuck, the stone piles -thing is the worst of those. Tiny images, badly generated so you can’t see shit, multiple rounds that have six or so images each round, you can’t make a single mistake, and you get to know did you make any mistakes only after completing all of the rounds. It’s straight up abuse
Once I had to try over five times and still kept failing, so I just gave up. I guess I’m not a human anymore
I actually like seeing those, when I have time, because I assume they are training ai with it and using my selections as tagging data. Pick all the cars: nope, everything but cars.
I’m probably the reason you fail, because I’m poisoning the data and reducing the confidence scores for the tags.
I remember when doing those captcha felt like improving computer science and that was a positive thing, teaching computers to see. How quickly we’ve fallen.
I do that shit too, fuck the AI training. The Terminators will stopnat every set of stairs thinking its a stop light
You’re probably getting flagged. You have to be just slightly off. Miss one or two by a square or two. And remember that image so you repeat it every time.
It’s a whole mini game sometimes. I hate them with every fiber of my being.
It took me years to learn that you’re supposed to do them very slowly. Otherwise it will keep bothering you to fill out more. Pretend you are 80 years old and you’re good to go on your first try.
And the auto-submitting TOTP entry form where you’re apparently not allowed to make a typo. And obscuring the TOTP number like it’s a password or state secret.
This is because of Enterprise Single Sign On. You can try this for yourself by going to https://gmail.com/ and enter the email of a public person at a large org, for example the CEO of Doordash (
tony@doordash.com). After you enter the email, you get sent to Doordash’s employee portal to authenticate. Based on the email you provide, Gmail has to figure out if you need to provide a password to gmail itself or if the email authenticates another way.It’s not like you can’t add a “Log in with your company’s SSO” button to the form. That works just fine and at least Microsoft does something like that.
Not sure I’d take design inspiration from Microsoft of all places. Also https://login.live.com/ has the same workflow email -> continue -> password. Not sure where you’re seeing Log in with SSO option.
I see the Login with SSO option all over the place. Of course, that assumes the users actually understand what that means, and they know whether or not they need to click it.
And remembers which one they choose when registering.
Zoom has it, for example.
My company uses Entra ID (or whatever they’ve renamed it to this week) and it’s a pretty common sight in our login flow. I think our SharePoint instance does it so it should be something MS does.
Of course it all depends on w how the company configures it.
Ok, I think I get what you’re saying. You mean have a different form input without the password, like how it’s done here: https://eu.app.orcasecurity.io/login? I guess that’s one way to do it, but it’s not really intuitive from a user perspective, since the first thing you see is a password field, and then think you don’t have access because you don’t have a password. This one comes to mind because I have had to tell people to click the tab for the email only field, not email and password.
I also often see implementations where there’s a first step where you have to select how to log in. It’s an extra click but very clear (and usually one of the options is some form of SSO where that one click fully logs you in if you already have a session open).
No it doesn’t work fine, because it confuses people, and provides the potential for working-around SSO.
That ones because users like choice. They need to look up who you are to know how you’ve chosen to authenticate. At least, that’s how it started. Some could be doing it because the big kids are, but that’s why the big kids do.
And they support choice because businesses want to use their login infrastructure and refuse to share. So you enter “user@businessOrUniversity.com.edu” and it forwards you to your institutional login.1Password handles this gracefully
That’s there to support routing to an identity provider for SAML2 SSO.
Came here to say that! For the love of God, stop with this nonsense!
The best I’ve seen was yesterday where a website had the log-in button greyed out after the password manager filled my creds in.
So I had to manually click both the email and password field. Just click them. Then it enabled the log-in button.
So someone took their time to write a piece of JS that said “If the user hasn’t focused both fields at least once, no login”. Literally why? Extra code that does nothing useful.
I was hoping passkeys would be the solution to this madness, but it seems to me the entire spec gives too much power to the OS Makers and too little to the users because “mUh AtTtEsTatIoN” so now I don’t know anymore
I’ve definitely run into that. Even more frustrating is when there was one particular site that forced me to actually delete the last character of my password and then retype it. Just focusing in the field wasn’t enough, I had to actually send it a keystroke. And Ctrl-V to paste the password in manually didn’t count. I suppose typing a random character at the end and then deleting it would have worked too.
When ctrl+v is disabled to “prevent brute force bots” or something ridiculous
that’s when I grab my trusty Don’t Fuck With Paste extension
I used to have this problem with the payroll website ADP! So cursed
I’ve seen this a stupid number of times. I wish I could remember which websites…
My utitlies website doesn’t let you login if the password field is autofilled by the browser. Whatever Angular-based form validation they are using doesn’t play nice with Firefox’s saved password feature. You have to manually type something in the password field, so I always add and remove a space from the password.
I sent an email to their support, hoping they would fix it, but they just responded saying that they can’t reproduce it.
Well, I can reproduce it. I even told you how. That sounds like a skill issue.
lol nice, this is one tech thing I have not complained about even though I hit it a few times a year
Oh, it gets worse. I’ve had some where I have to enter a character into the boxes before it would figure its shit out…
They inevitably didn’t write it for that reason. They wrote it to say the field is invalid until the user changes it to be valid after someone landed on the page holding the enter key down and instantly locked themselves out after submitting the form 50 times in 3 seconds.
Unless you know otherwise, it’s easy to think that “form interaction” is the same as “form changed”, and one of those is much easier to check.I’m unsure what you mean about passkeys. I don’t think I’ve heard anyone mention significant concessions to os makers and I’m pretty tuned in on the topic.
deleted by creator
It’s not perfect but will break many bot logins and people trying different logins from data leaks.
Bots will just use the underlying endpoint.
So someone took their time to write a piece of JS that said “If the user hasn’t focused both fields at least once, no login”. Literally why? Extra code that does nothing useful.
If anything, 30 seconds in Greasemonkey should fix that one (either blocking the function that is doing it, or manually firing click events on the fields).
Or worse:
Use email link -> use password instead
Enter password
Now enter the code that we sent you your email…
2 factor authentication, only when you feel like it.
They might as well be piping the password to
/dev/null
HEY BUT DO YOU WANT TO USE A PASSCODE?? PASSCODE! PASSCODE! USE THE PASSCODE! -_-
Yeah what the hell is up with that one? Seems so sketchy
Passkeys are okay, but your browser and OS want you to use them because you can’t just take a passkey to another platform, you have to create a new one, and it’s a pain in the ass.
It’s a lock-in gimmick latching on to a real useful solution.
Password managers can hold Passkeys now and they’re portable. Bitwarden stores all of mine, use them on any machine.
Yeh, I have passkeys in bitwarden.
I get it. Once they become ubiquitous, you click “login” your password manager prompts you to select account, and you are in.
No password that can be leaked, incorrectly stored, brute forced.
Corporations can pre-register company service passkeys for new users.
It’s like mTLS, except staged.While true, it still means you’re locked into only being able to log in from a browser that has the password manager extension installed and logged in. Sometimes I want to log in from another machine, or another OS, or another browser, or even an incognito window that doesn’t have access to my extensions.
That’s an implementation issue, not an inherent problem with passkeys.
You can do that without an extension. There’s a bunch of different protocols that let you, for example, use your phone as the authenticator.
You can log in with your phone on a computer you’ve never used before by scanning a QR code and credentials never leave your device.That’s what hardware keys are for. Even the cheap lines of fido USB keys (ca $20) can safe passkeys. And your phone can too.
It’s good but for some reason I can’t use them on my degoogled android phone. Doesn’t pop up to select… It thinks I want to use a yuibkey or other device.
KeepassDX as well.
That’s false. My passkeys sync to my password manager and are available on all my devices
Ok that makes a lot of sense. It definitely seems like it’s more for them than it is for the user’s “convenience”
My passkeys are tied to my phone, which I use via the browser and OS. I keep them in my password manager running on the phone. My password manager supports the open spec for securely migrating credentials between vendors.
It may be difficult to believe but they want you to use them because they’re legitimately significantly better.
Users are silly. They blame Microsoft for bad passwords. They blame Google for forgotten passwords. They blame Facebook when they click on a phishing link. They blame apple when apple “lets” someone who they gave their password to see their pictures. They blame apple when they don’t let the user in just because they forgot their password and every recovery mechanism.
Everyone involved has a significant issue with passwords because they cost them user satisfaction, credibility, or money directly. The reason cross vendor transfer has been slow is because everyone wants to be the leader, since if everyone follows your lead you get to make it work better with your stuff.
Passkeys are fine. It’s just MTLS but by marketers (if by passcode you mean passkeys. otherwise, what’s a passcode?)
God I hate those stupid magic links. They’re WAAAAYYY slower than just using my password manager.
AND they kinda contribute to locking you into Big Tech. I sometimes have problems with those stupid links because I don’t have a Gmail account. Somewhere along the stupid chain there’s probably some stupid check that delays or blackholes emails to non-big-tech domains.
Based.
Email is terrible. It’s an unreliable communication system. You cannot depend on sent emails arriving in the recipient’s mailbox—even the spam folder.
People incorrectly assume that all emails at least get to their spam folder. They don’t. There are multiple levels of filters that prevent most emails from ever making it that far because most email traffic is bots blasting phishing links, scams, and spam. Nobody wants phishing and scam emails, but the blocks that prevent those are being used by big tech to justify discriminating against small mail servers.
I can’t remember the site, now, but I literally couldn’t log into one this week because the email never arrived.
I can’t remember the site, now, but I literally couldn’t log into one this week because the email never arrived.
Well, email allows you to solve that issue by self-hosting. But what you can’t solve is that if you do self-host, gmail will drop your emails to spam or just discard them completely, just because it feels like it, even if you do the whole dance with DMARC and have used the domain for a good few years. It’s frustrating as shit.
I had an email never arrive because I used Firefox for Linux. It worked on my phone in a different browser. God knows what went on there. I suppose their website never really registered I even made a request from my desktop even though it told me the email was on the way. Really strange.
alternatives to passwords are just excuses to harvest info
Not if it comes to hardware-based passkeys I would argue
true, but i would also argue that’s a much less utilised alternative. most people don’t even know what that is even though it’s a great redundancy.
they don’t need to know what’s happening when a panel pops up on their phone, says touch the fingerprint scanner, and enrolls a passkey. it’s on the companies
It is quite normal to ask for an email address at registration even when using password based authentication.
*it has been become quite normalized
No email would be fine for most people, but then there would be the small number of folks who will cry all hell when they forget their passwords and/or secret questions and can’t get in…
It was more or less the default many moons ago, then just a username became more common, now it is back to email or some third party login
Ah but you see it’s one factor of authentication that also conveniently loops in whichever email provider is spying on you
Ding! Ding!
This is the real answer: mail providers get to track you, your service get constant confirmation that your email is live (so they can send more ads from themselves plus their 400 closest affiliates). It’s a win-win situation for everyone /s.
“The
beatingsenshitification will continue, until moral is improved.”Of course. How would Microslop or Google LLMs snoop on your data then? You guys really make no effort… /s
Just let me use passkeys at this point. The way that people typically use passwords is less secure anyway, why not just make it as simple as possible?
I would love to use my physical Yubikey, but all the websites I’ve seen that allow passkey login always deny both Yubikeys.
That’s a shame, yubikeys are a really neat tool. I’ve considered picking one up so many times
I forget. Are passkeys the access method that prevents you from logging in ever again if you lose access to a device?
Typically, no. You’re thinking of TOTP/Authenticator based 2FA. Those still come with backup codes in case you break the phone that has the TOTP codes warehoused. I always recommend keeping those backup codes saved in the notes of whatever password manager you’re hopefully using.
Passkeys are essentially just one half of a cryptographic key pair (like what you’d use for authenticating SSH without passwords). These allow you to authenticate once using password + 2FA, then use the generated passkey for future sessions. Since these are much more complex than passwords and remove the need to actually remember anything, they are significantly more secure.
There are also some other features that I’m forgetting, and that may not be a perfectly accurate description, but I think you can get the gist.
I always recommend keeping those backup codes saved in the notes of whatever password manager you’re hopefully using
Wouldn’t this undo some of the security of even having 2FA? If your password manager was somehow breached the attacker would have all your passwords and your 2FA codes, right?
Passkeys are supposed to be bound to one device and protected by that device’s OS’s secure enclave. If you have a second device you’re supposed to create a second passkey.
That’s why many sites will flat out refuse to let you create a passkey with a desktop browser since a PC-stored passkey doesn’t fit the security model.
Websites should not get to dictate my security model. I’ll accept annoying me about being less secure because I get that people are dumb, but you’ve gotta choose somehow! Also, any passkey is safer than a password, so that’s still BS.
The logic behind it is that a smartphone-bound passkey represents two factors of authentication: what you have (the phone) and who you are (the fingerprint used to unlock the phone’s passkey store).
Anything on a PC is easily copied and can only ever be safely assumed to represent one factor: what you know (the password to unlock your password manager). Thus the benefit of getting a two-factor authentication in one convenient step falls away.
Of course it’s still super annoying, especially if you don’t really trust your smartphone OS vendor and use a portable password manager already.
Yeah, that’s how I understood it to work, as well. I didn’t mention it because I’ve seen a bunch of different implementations that don’t seem to work that way. I didn’t want to speak too much on that specific point, since I don’t have a very thorough understanding of it.
Only if you use the OS built-in saving.
Most password managers support them at this point, making them portable and secure.
No? My password manager holds them so they are available everywhere…
Yes
And then…
The password manager can’t fill the form. You’ve got to change your 10-word, unique passphrase because it’s 3 months old. And you have to verify with a text.
Oh and then you have to type it in on your TV with a remote and on-screen keyboard.
Also you better hope you used the password manager for this obscure app you don’t remember signing up with.
It used a different URL for sign in so isn’t picked up by the password manager.
The password is too strong doesn’t accept Ukraine letters.
Dose your granny have the a password manager. She should but would she understand how it works.
As an autistic person I felt this in my bones. I cannot STAND email based authentication.
I love FIDO logins and next to fucking no one implements them :(
And when they do they only offer them as the second factor.
Yes, let me first input my password (from a password manager), the let me approve with a passkey that is meant to make my password not necessary.
But email based login: FUCK THAT SHIT.
I actually prefer using FIDO2 as a second factor only cos I use YubiKey which can only store 100 RKs.
Depending on the security needs using hardware based security as a second factor while still requiring some other form of auth is not actually a bad idea.
What are they?
Public key cryptography tied to physical hardware, so if you lose your phone / usb key, you need to use your backup recovery code; a fairly short one time password that negates the security benefits of Fido in one easy step.
It can also use biometrics, but that requires every device you log in on to have biometric readers.
Or you could use multiple fido key’s as backups
Absolutely 100%. Click login, accept passkey signature, logged in. This is the way to go
Magic link is lazy 2fa.
Implement TOTP support, you lazy fucks.
What’s the 2nd factor? Email and what else?
Email is considered insecure as a 2nd factor. TOTP stands for Time-based One-Time Password. Usually you store a seed and that combined with the time generates a time based password. If someone intercepts it, it’s only valid for a certain time frame (I think about a minute or so), after which it’s invalid.
Just to add, SMS is also incredibly insecure as a 2FA
Arguably less secure than email.
Yes but email is only a second factor when used in addition to a first factor (e.g. password). If it’s just magic link without password, then email is the only factor
Passkeys ❤️
If they arent on a USB stick, protected against being copied, they are only a single factor that instill false safety.
Depends on the system. The thing where your password manager is managing your passkeys? That’s a single factor unless it’s doing something tricky that none of them do.
When it’s the tpm or a Bluetooth connection to your phone? That’s actually two factors, and great.I’m curious what you think tricky is?
For instance, 1Password requires your secret key for initial login/setup on a device along with the username and password. After initial login/setup the secret key is no longer required, but you still need the password to access.
I’d call that a fair trade off. Someone would need to know my password and have unfettered access to my previously set up device to login, or they would need to know the secret key.
The secret key is not stored by 1Password (the company). If you store it in 1Password and the last device is lost/broken/stolen then your account is essentially dead. You have no way to get back in.
It can totally be fine for your needs, and secure while it does so, and not be two factors.
It’s a question of what’s required for access. In this case, they would need your password and to have had some manner of device access at some point to steal the value used by 1password to verify you at one point had the secret key. Someone with a keylogger from a random untargeted malware infection could plausibly get sufficient information. It’s really good 1 factor.
To be two factor there would need to be a requirement for two factors to be demonstrated at auth time. For example, if 1password encrypted the passkeys in such a way that the passkey could not ever leave the device, like via certain types of hardware backed key storage, then unlocking the vault is proof of something you know, and the usage of the signature is proof you have the chip.
The trickery comes about in the techniques available to move the passkey between encrypted hardware devices without it ever being exposed or loosing the “device you control” assurances.For the record, I use 1password. Just not for passkeys on desktop. I prefer the Bluetooth connection to my phone, since phones currently do a much better job providing uniform targets for what’s needed to provide the proper two factor for something like passkeys.
Can it be copied from your phone? (e.g. by migrating your phone via a backup)
Then it can be compromitted and is essentially a single factor (because some website permit you to login via the key only).
Only if you’d need to completetly renew the key, then it’s truly secure.There are secure ways to transfer the key that preserve the properties that make it useful as two factors in one.
Basically, the device will only release the key in an encrypted fashion readable by another device able to make the same guarantees, after the user has used that device to authenticate to the first device using the key being transferred.
A backup works the same way.
Website wants you to make a passkey, go to login but the entry form only accepts the user name, then you have to click next to password which may or may not accept the passkey.
Is that FIDO? What’s the difference?
Or the obscure ways for 2FA/MFA. Passkeys are mostly cloud based. Yeah fuck no! The weakest Passkey is weaker than my usual random generated password, if the site don’t do any shady business and require a weak password. Hardware keys are luckily not pushed for usage. I don’t like them either. You require at least 2, for backup reasons. They also cost quite some money and they have zero auth. Just connect to usb and tap it. Also retrieving the backup and get a replacement for a defective one, takes some time.
Good old TOTP as 2FA is perfect, paired with a strong, random password. With my TOTP, I have an encrypted backup in my cloud, on my NAS, older backups in secure places and backup codes in several places. The TOTP App I use is open source and I have a mirror of the source code.
This should be enough security, if sites don’t screw up all the time. You can bypass 2FA all the time. Even the credit card company screwed up big time. Usually you get 2 separate letters, one with your pin and one with your card. Both came on the same day. Also I actually didn’t needed the pin in the first place. I was able to add the card to the app and see the pin there, without actually verifying anything, except the credit card number.
Maybe when passkeys are supported in my password manager, I will try it but so far it isn’t and switching is not an option, as it doesn’t support the features I need. There is an open issue for an alternative password manager, with that feature request and it has some people wanting it, but its still not added. But passkeys doesn’t fix the issue for me using stronger keys, it fixes the site owners to allow stronger keys but they are still not required to use it. Some devs are just weird. I’ve read one PR for an FOSS project I use, where someone wanted to implement a universal oath or such stuff, that would support all types of external authentifications. Nope, the dev refused the PR and they wanted to stay at the 2 proprietary implementations, for 2 services, even though this universal implementation would work with these 2 too. I can’t tell exactly what it was. I was experimenting with an auth service for my self hosted stuff, to not deal with several accounts and rights systems. This service was the first one which I wanted to switch and they didn’t wanted to support it, leaving me with the standard login.
What password manager doesn’t support passkeys these days?
Vanilla KeePass. The Dev isn’t interested to providing a communication outside of its program, but he clarified, that plugins have all the right access, to do that but as it seemed to the dev, there is no dev interested to making such a plugin. KeePassXC does support it but they are still missing entry templates. This is the only missing feature that is holding me back to switch.
What the hell are passkeys? I think outside deep tech forums, nobody knows what they are.
Simplest way I can think to explain it is that it’s similar in concept to SSL. If you understand SSL you should be able to understand passkeys.
Every hardware based key I ever used also required PIN, but as far as expense and backups, yes, for personal use the cost generally may not be justified. I got all my personal ones as a bundle that was on sale. For work I would argue that some businesses can easily justify the cost to create a rotating stock of hardware keys to deal with lost keys. Generally in that environment you have centralized PKI, where you can revoke the certificate on the lost key and then issue a new certificate on a new hardware key. This doesn’t help for all sign in methods tied to hardware keys, but can be very practical when implemented right.
I also agree on TOTP as the ultimate generic 2FA method, with several worsening options until the despised email or sms 2FA. I will also add that you can setup TOTP on modern hardware keys, where you must insert and complete PIN entry. The inconvenience is that you must have all your keys and password manager available at setup time for places that don’t support multiple TOTP codes.
I didn’t invested too much time into hardware keys but requiring additional software on other PCs, still is a no-go for me. With my current setup, I only need my smartphone and I always carry it around.
For business use, this is a whole different topic. With a proper setup, all machines would require the software and you shouldn’t access these accounts outside from company devices. Its also an expense which the company must carry and its easier for them to handle backups. Also in that Setup, you can have SSO/LDAP, where you can physically proof that you are you and requesting resetting the MFA. With an online service, they usually require a weak proof, like just the access to an email account.
I just needed to think of the scene from the Simpsons, where Mr. Burns and Smithers go all through the security checks and in the end, there is a flimsy open backdoor, where a stray dog entered the room. All security in the front doesn’t matter, if the backdoor is not secure at all and until the backdoor is that unsecure, I’m not willing to add money and time, to make the front door more secure.
You can force auth on hardware passkeys for every activation. A sort of local password. Much more secure, also if somebody is in possession of your passkey and you didn’t just loose it somewhere you would be fucked anyways.
I have three, one for home, one for backup, and one for travel. I can See why ppl. Are annoyed by that, but speaking of costs, you can get these starting from ~20 Dollars. Additionally, passkeys could and should replace passwords and not EB generally used as 2FA.
Also many password managers (incl. FOSS) do support Passkeys, but having them in your password manager makes them arguably useless. Same if you use 2FA on your phone and a password manager and your phone gets compromised somehow.
I quote myself from a different comment:
I just needed to think of the scene from the Simpsons, where Mr. Burns and Smithers go all through the security checks and in the end, there is a flimsy open backdoor, where a stray dog entered the room. All security in the front doesn’t matter, if the backdoor is not secure at all and until the backdoor is that unsecure, I’m not willing to add money and time, to make the front door more secure.
The phone argument lacks a bit. Accessing the TOTP App and the password manager do require a separate authentification, to get encrypted. Sure if they snatch my phone away, when its fully unlocked, including my password manager, they have access for a limited time. They need to be fast enough, until I can remotly lock it or until it automatically locks itself. Android phones can now detect when they are stolen. Either by the movement or when it goes offline. The latter I tested and it’s not instant, but you still don’t have long.
I don’t think about potential backdoors. If there is no known backdoor, then I deem it save. Sure they also could me to unlock the phone. This would be xkcd 538. And this applies to any security.
Adding more security and inconvenience doesn’t make sense to me, so long the backend is shit. So far a few big companies did screw up hard in their backend and dozens of smaller sites do some bad stuff, that it doesn’t really matter how strong your login is. Here I reference back to my quote.
In a closed system, like a company, this added security makes sense, as they usually control the backend as well. If my CEO would send me a text request to reset his logins, I would call him or walk to his office, and ask him directly. Sure with AI, they could impersonate his voice but I don’t think they can impersonate his way to speak.
Well Passkeys are a good step to enhance security and remove potential backdoors from companies for one. As you have your private key that cannot be easily imitated and is checked by the company that you use.
And generally speaking, your phone can be attacked via software without even having physical access. So if your phone is infected they gain access (at some point during usage) to both your password manager and your 2FA. It is just never a good idea to have multiple thongs in one place.
On a side note, with physical access to one of your devices for a longer time, most things can be accessed by a malicious actor.
Of course everything can be hacked. When I think something is compromised, then I need to change everything. So far I didn’t heard of any remote zero click compromise. With the fancy hacking tools of some companies, its not publicly known how they gained access. I suspect either physical access or some malware. But we are speaking on a high level of hacking, that most people don’t need to be scared off. At that level, there are other things to worry about.
When we just look at the dangers an average person might encounter, this level of security is fine. I do had accounts compromised and I can exactly tell what my mistake was. One was sharing my password with someone else and not knowing how secure his devices where and not having 2FA. The second one was that I used the same password everywhere. At this point I was switching to generated passwords and still didn’t had every account changed (the unimportant ones).
Of course Passkeys are by nature a more secure implementation, as you are unable to save plaintext passwords but there is one thing that this can’t solve and that’s being that they remove and reset your auth, without verifying your identity. Hackers still can steal session tokens and sites don’t need to require additional authentification, when altering your authentification.
