Passkey technology is elegant, but it's most definitely not usable security

Re:Passkey technology is elegant, but it's most definitely n... by Borealid on Monday December 30, 2024 @10:34AM (#42550170)

Oh, one more thing!

> There is no way to name a token to keep track of which one it is

Tokens support listing which credentials are stored on them, and most (not 100%, but most) tokens also support storing an arbitrary blob of data at least 1024 bytes in size. You can name your token if you want to name your token.

[ Parent | on HN ]

Re:Passkey technology is elegant, but it's most definitely n... by amluto on Monday December 30, 2024 @11:19AM (#42550664)

This does absolutely nothing to help me keep track of which physical gadget matches which token listed in the GitHub 2FA page without manually typing some kind of descriptor and hopefully getting it right.

[ Parent | on HN ]

Re:Passkey technology is elegant, but it's most definitely n... by lxgr on Monday December 30, 2024 @11:23AM (#42550713)

Github lets me name my passkeys. There's a little pencil icon next to each one (on [1]), and as far as I remember it even prompted me for a name when I originally created it.

[1] https://github.com/settings/security

[ Parent | on HN ]

Re:Passkey technology is elegant, but it's most definitely n... by amluto on Monday December 30, 2024 @12:23PM (#42551344)

Indeed. But it’s on me to manage it. There ought to be a way to tell my computer, once, the name of a token.

[ Parent | on HN ]

Re:Passkey technology is elegant, but it's most definitely n... by lxgr on Monday December 30, 2024 @12:25PM (#42551362)

There does seem to be some way. I'm relatively sure I've seen keys pre-labeled with the name of my password manager in the past.

Some sites make bad assumptions, though, e.g. labeling every passkey I create as "iCloud Keychain" (because my user agent tells them I'm on macOS, and they assume that it must be that then).

[ Parent | on HN ]