Re:Hype Will Turn Your Security Key into Junk
by eep_social on Thursday July 13, 2023 @09:34PM
(#36718390)
Now do the passkey (or is it webauthn?) failure modes. They are a nightmare as outlined in the top post in this thread by dmix.
They're no different than a password manager regardless of what shitty tricks Google is trying du jour.
Re:Hype Will Turn Your Security Key into Junk
by badrequest on Thursday July 13, 2023 @09:35PM
(#36718394)
All of that is for naught if it's too much of a pain in the ass for normal folks to use.
Re:Hype Will Turn Your Security Key into Junk
by lelandbatey on Thursday July 13, 2023 @09:59PM
(#36718554)
I'm desperately looking forward to my password manager integrating support for Passkeys such that I can:
1. Back up my keys to paper and restore them from paper
2. Disregard/end-run around the "user presence verification" challenge if I want to.
I already deal with a ton of "acknowledge this push notification" or "type in this TOTP code" to verify, and automating every one of those interactions has lifted a huge amount of distraction and hassle from my everyday login-access dances interrupting me every hour or two.
Re:Hype Will Turn Your Security Key into Junk
by tadfisher on Thursday July 13, 2023 @10:33PM
(#36718776)
I worry that more and more security people will make their orgs require authenticator attestation, which basically compares a burned-in cert against those certs blessed by FIDO. If too many websites submit to that stupidity, the idea that you can use your Bash-scripted password manager for resident key auth becomes a figment.
Re:Hype Will Turn Your Security Key into Junk
by gre345t34 on Friday July 14, 2023 @01:58AM
(#36719989)
Primary issue with FIDO is not the specs themselves but the extremely confusing nomenclature that FIDO put zero effort into clarifying.
Re:Hype Will Turn Your Security Key into Junk
by throwaway892238 on Tuesday July 18, 2023 @12:18AM
(#36767751)
That is all way more complex than you're acknowledging. I bet you that for the hundreds of millions of dollars that will be spent every year on all of that crap, and all of the pain it will cause in a variety of ways, it will prevent maybe 1000 actual attacks globally per year.
Security does not need to be an arms race. Good enough is good enough.
This is simply not true. WebAuthN is not overcomplicated needlessly (I wouldn't even call it overcomplicated, it's literally just a signed challenge/response dance). It improves on Passwords+2FA in a few notable ways:
1. It prevents shared secrets from traversing the wire.
2. It naturally enforces that users are all using secure authentication keys without password rules nonsense.
3. It kills 2FA by allowing Relying Parties to request user presence verification as part of the primary challenge.
4. It is origin-bound which prevents fishing.
Passwords don't have any of these properties. And since your password manager handles the details for you, why wouldn't you want it to improve its implementation under the hood since it makes things better for you with zero effort on your part.