News for hackers. Stuff that matters.

A comment on Microsoft Confirms Password Deletion for 1B Users. Parent comment

Re:Microsoft Confirms Password Deletion for 1B Users by tptacek on Tuesday December 17, 2024 @03:20PM (#42444891)
Take it up with the person who said the two countermeasures were literally equivalent. You're not going to get anywhere with me on this.
[ Parent | on HN ]
Re:Microsoft Confirms Password Deletion for 1B Users by lolinder on Tuesday December 17, 2024 @03:25PM (#42444936)
Which user/comment are you referring to? The top-level comment? I'm the person you replied to initially, and that's not what I said, so I'm assuming you're referring to something else.
[ Parent | on HN ]
Re:Microsoft Confirms Password Deletion for 1B Users by tptacek on Tuesday December 17, 2024 @03:53PM (#42445215)
passkeys stored in a password manager aren't any more secure in practical terms than random passwords stored in a password manager

It is my contention that this statement is:

1. Categorical,

2. False, and

3. Categorically false

[ Parent | on HN ]
Re:Microsoft Confirms Password Deletion for 1B Users by diffeomorphism on Tuesday December 17, 2024 @10:24PM (#42447855)
And you would be wrong. You somehow jumped from "in practical terms" to "literally equivalent".
[ Parent | on HN ]
Re:Microsoft Confirms Password Deletion for 1B Users by tptacek on Tuesday December 17, 2024 @10:26PM (#42447863)
They are not comparable in practical terms.
[ Parent | on HN ]
Re:Microsoft Confirms Password Deletion for 1B Users by diffeomorphism on Tuesday December 17, 2024 @10:37PM (#42447922)
Maybe, maybe not. You went out of your way to attack a straw man instead of showing any of that. So why should I believe you now?
[ Parent | on HN ]
Re:Microsoft Confirms Password Deletion for 1B Users by tptacek on Tuesday December 17, 2024 @10:42PM (#42447942)
I have no idea who you are, am comfortable with who does and does not believe me here, and think you should do you. But no: the two approaches do not offer comparable practical security.

From the questions and comments across the rest of this thread, the misunderstanding here seems clear: the person I'm responding to did not realize that FIDO2 cryptographically binds credentials to sites.

[ Parent | on HN ]