News for hackers. Stuff that matters.

A comment on FIDO Alliance publishes new spec to let users move Passkeys across providers. Parent comment

Re:FIDO Alliance publishes new spec to let users move Passke... by sitharus on Wednesday October 16, 2024 @09:51PM (#41865701)
It depends on your security risk profile and the type of passkey provided. The passkey's response describes if the credential is transferrable or not, and if the user has been positively verified as present.

They're as secure as having your password + 2FA in a password manager.

[ Parent | on HN ]
Re:FIDO Alliance publishes new spec to let users move Passke... by prophesi on Wednesday October 16, 2024 @11:12PM (#41866087)
Should be noted that there's still debate on user presence, to the point that someone submitted a CVE[0][1] on KeePassXC for not abiding by this part of the protocol (and which I take Keepass's side).

[0] https://github.com/keepassxreboot/keepassxc/issues/9339

[1] https://keepassxc.org/blog/2023-06-20-cve-202335866/

edit: This actually might be a better thread to hear some of the debate between an Okta dev and the KeepassXC team:

https://github.com/keepassxreboot/keepassxc/issues/10406

[ Parent | on HN ]