News for hackers. Stuff that matters.
Re:Passwordless authentication with FIDO2–beyond just the web by megous on Wednesday February 22, 2023 @05:28AM (#34893835)
Hardware keys are vulnerable to other things. Like getting stolen, getting lost, getting broken or getting hacked. Uasually at a moment where you can't readily replace them.

Phishing is possible to avoid.

Re:Passwordless authentication with FIDO2–beyond just the web by taeric on Wednesday February 22, 2023 @10:03AM (#34896632)
"Phishing is possible to avoid" is almost as true as "it is possible to write safe C code." Technically true, but practically not so much.

Now, I grant that for most of us, if you are the target of any nation state level actor, not much you can do. For the most part, they can just compel the party that has your data. That said, security keys are far safer than portable data.

Re:Passwordless authentication with FIDO2–beyond just the web by megous on Wednesday February 22, 2023 @02:26PM (#34901236)
I don't mind to differ on this one. Your reaction certainly didn't address any of my concerns about practicality of HW keys in any scenario where you're not just sitting at home and can lose your key, and will be fucked if you'll not be able to recover or downgrade your security for a little bit until everything's normal again.

Maybe to secure corporate accounts against phishing, or whatever. But for my personal stuff, I need to be able to recover in many ways at any time with just a random computer and internet access without any special HW that may not be readily obtainable the moment I need it.

Re:Passwordless authentication with FIDO2–beyond just the web by taeric on Wednesday February 22, 2023 @02:47PM (#34901567)
I don't think you are wrong, but I do find it funny how the threat models get built so differently.

My personal feel is I'm ok not having my key with me when I'm "out and about." Is no different than my not having some of my ID cards with me. Such that, I'm already "locked out" of many of my financial accounts and such when I am not at home. But, I fully ack that that is a personal choice here. I just can't think of any situation I've been in, in a LONG time, where I was needing to randomly use a computer.

Edit: It also occurs to me that keeping keys to get back into your home is almost certainly similar in concern here. As somewhat crazy as I think the "keychain" nature of these tokens is, it does address a large part of this problem.

Re:Passwordless authentication with FIDO2–beyond just the web by Brian_K_White on Thursday February 23, 2023 @12:48AM (#34907221)
I just realized that there are a lot of kids out there with all the balls necessary to hold their parent's keys hostage.

Even if you would never be tricked into giving up or losing your key, there are other people in your life who can do it either for themselves or be tricked or compelled into doing it for someone else while you're asleep or in the shower or any of 1000 opportunities every day. Would you immediately detect a good fake substitution? When would be the next important login that needed it?