Hype Will Turn Your Security Key into Junk

Re:Hype Will Turn Your Security Key into Junk by lelandbatey on Thursday July 13, 2023 @09:59PM (#36718554)

I'm desperately looking forward to my password manager integrating support for Passkeys such that I can:

1. Back up my keys to paper and restore them from paper

2. Disregard/end-run around the "user presence verification" challenge if I want to.

I already deal with a ton of "acknowledge this push notification" or "type in this TOTP code" to verify, and automating every one of those interactions has lifted a huge amount of distraction and hassle from my everyday login-access dances interrupting me every hour or two.

[ Parent | on HN ]

Re:Hype Will Turn Your Security Key into Junk by tadfisher on Thursday July 13, 2023 @10:33PM (#36718776)

I worry that more and more security people will make their orgs require authenticator attestation, which basically compares a burned-in cert against those certs blessed by FIDO. If too many websites submit to that stupidity, the idea that you can use your Bash-scripted password manager for resident key auth becomes a figment.

[ Parent | on HN ]