News for hackers. Stuff that matters.
Re:Microsoft Confirms Password Deletion for 1B Users by tptacek on Tuesday December 17, 2024 @03:16PM (#42444857)
Passkeys are cryptographically phishing-resistant, and password managers just disable a convenience feature when a heuristic check fails. It's not the same thing. I don't care if you feel like the latter protection is sufficient for you or should be for others; they simply aren't the same, and that was what the comment upthread suggested.
Re:Microsoft Confirms Password Deletion for 1B Users by lolinder on Tuesday December 17, 2024 @03:20PM (#42444883)
Whether or not they're the same as a bit of a red herring, the question is whether the marginal added benefit of cryptographic phishing resistance is worth the trade-off in UX which introduces new kinds of vulnerabilities due to undesirable user behavior and/or implementation workarounds. And to answer that question you can't just dismiss the security offered by password managers—it's a very real protection that needs to be factored in to your assessment of the strengths and weaknesses of each system.
Re:Microsoft Confirms Password Deletion for 1B Users by tptacek on Tuesday December 17, 2024 @03:20PM (#42444891)
Take it up with the person who said the two countermeasures were literally equivalent. You're not going to get anywhere with me on this.
Re:Microsoft Confirms Password Deletion for 1B Users by lolinder on Tuesday December 17, 2024 @03:25PM (#42444936)
Which user/comment are you referring to? The top-level comment? I'm the person you replied to initially, and that's not what I said, so I'm assuming you're referring to something else.
Re:Microsoft Confirms Password Deletion for 1B Users by tptacek on Tuesday December 17, 2024 @03:53PM (#42445215)
passkeys stored in a password manager aren't any more secure in practical terms than random passwords stored in a password manager

It is my contention that this statement is:

1. Categorical,

2. False, and

3. Categorically false

Re:Microsoft Confirms Password Deletion for 1B Users by diffeomorphism on Tuesday December 17, 2024 @10:24PM (#42447855)
And you would be wrong. You somehow jumped from "in practical terms" to "literally equivalent".
Re:Microsoft Confirms Password Deletion for 1B Users by tptacek on Tuesday December 17, 2024 @10:26PM (#42447863)
They are not comparable in practical terms.
Re:Microsoft Confirms Password Deletion for 1B Users by diffeomorphism on Tuesday December 17, 2024 @10:37PM (#42447922)
Maybe, maybe not. You went out of your way to attack a straw man instead of showing any of that. So why should I believe you now?
Re:Microsoft Confirms Password Deletion for 1B Users by tptacek on Tuesday December 17, 2024 @10:42PM (#42447942)
I have no idea who you are, am comfortable with who does and does not believe me here, and think you should do you. But no: the two approaches do not offer comparable practical security.

From the questions and comments across the rest of this thread, the misunderstanding here seems clear: the person I'm responding to did not realize that FIDO2 cryptographically binds credentials to sites.