News for hackers. Stuff that matters.

A comment on Passkeys are just passwords that require a password manager. Parent comment

Re:Passkeys are just passwords that require a password manager by Gigachad on Monday August 04, 2025 @10:26PM (#44793700)
The main benefit you get is that you don't have to type in 2FA codes anymore since 2FA was built to solve credential stuffing / password reuse which isn't a problem on Passkeys.

It is nice to just have a one click login for things.

[ Parent | on HN ]
Re:Passkeys are just passwords that require a password manager by Someone1234 on Monday August 04, 2025 @11:20PM (#44793986)
First-generation 2FA solved basic credential compromise issues using code-based methods (e.g. TOTP/HOTP). Modern 2FA (e.g. push notifications) adds authentication integrity, phishing resistance, and user validation through real-time, context-aware approvals.

Passkeys replace passwords and also render basic TOTP/HOTP-based 2FA unnecessary. However, they do not replace modern, push-based 2FA, which may still be needed in higher-assurance or enterprise scenarios.

Regardless personally I am waiting for full FIDO Alliance interoperability/sync, so I'm not locked into a single password manager. I've already had to migrate password managers after my choice was taken over by Private Equity.

[ Parent | on HN ]
Re:Passkeys are just passwords that require a password manager by esseph on Tuesday August 05, 2025 @12:11AM (#44794264)
Pushed based is also insecure, why would you want that if you have a passkey?
[ Parent | on HN ]
Re:Passkeys are just passwords that require a password manager by Almondsetat on Tuesday August 05, 2025 @01:12AM (#44794532)
Push notifications don't protect against realtime phishing attacks
[ Parent | on HN ]
Re:Passkeys are just passwords that require a password manager by crote on Tuesday August 05, 2025 @02:10AM (#44794810)
The main benefit of FIDO2 is origin verification: it is literally impossible to authenticate on a phishing website, as on a phishing website the browser won't send valid origin data to your token.

Push notification based 2FA can never obtain that level of security.

[ Parent | on HN ]
Re:Passkeys are just passwords that require a password manager by Afty on Tuesday August 05, 2025 @12:53PM (#44800594)
What happens if the origin changes? Suppose I have a passkey for Twitter.com, and now the site is named X.com? Is there some way to migrate the passkey?
[ Parent | on HN ]
Re:Passkeys are just passwords that require a password manager by Harvesterify on Tuesday August 05, 2025 @05:59AM (#44796179)
Push notifications are vulnerable to MFA fatigue/"bombing" attacks, that are used in the real world, cf. this breach on Uber:

https://www.darkreading.com/cyberattacks-data-breaches/uber-...

[ Parent | on HN ]
Re:Passkeys are just passwords that require a password manager by AlphaCerium on Tuesday August 05, 2025 @10:02AM (#44798102)
> I've already had to migrate password managers after my choice was taken over by Private Equity.

do you remember which one? hope it wasn't bitwarden :/

[ Parent | on HN ]
Re:Passkeys are just passwords that require a password manager by aaomidi on Monday August 04, 2025 @10:29PM (#44793709)
Yes but also depends on how the end system is configured.

You can require Google IDP to still have 2FA with passkeys.

[ Parent | on HN ]
Re:Passkeys are just passwords that require a password manager by adiabatty on Saturday August 09, 2025 @03:01AM (#44844623)
I have one-click login with 2FA codes stored in 1Password.

And 1Password will still let me export my crazy-long password and TOTP code to a plain text file if I want to switch to a different password manager (of course, I’ll have to do some planning beforehand to make sure that the export destination doesn’t get picked up by my backup software).

[ Parent | on HN ]