News for hackers. Stuff that matters.

A comment on Microsoft Confirms Password Deletion for 1B Users. Parent comment

Re:Microsoft Confirms Password Deletion for 1B Users by lxgr on Tuesday December 17, 2024 @03:40PM (#42445085)
There is no "authorize a new device" for passkeys. You'd need to actually run the "register new passkey" or "authenticate using passkey" flows on the attacker's device.

That's why they are so much more secure than passwords and even TOTP or "click approve to authenticate" flows!

[ Parent | on HN ]
Re:Microsoft Confirms Password Deletion for 1B Users by Wowfunhappy on Wednesday December 18, 2024 @02:05PM (#42453688)
...this is also the problem with passkeys. It makes it so much harder to move to a new device, and easier to get locked out.
[ Parent | on HN ]
Re:Microsoft Confirms Password Deletion for 1B Users by lxgr on Wednesday December 18, 2024 @08:50PM (#42457538)
There are now synchronizing authenticators that solve this problem pretty well (including open source and platform agnostic ones!), but as a result obviously also exist on a different point on the security-availability/convenience line.
[ Parent | on HN ]