News for hackers. Stuff that matters.

A comment on Passkeys are just passwords that require a password manager. Parent comment

Re:Passkeys are just passwords that require a password manager by Someone1234 on Monday August 04, 2025 @11:20PM (#44793986)
First-generation 2FA solved basic credential compromise issues using code-based methods (e.g. TOTP/HOTP). Modern 2FA (e.g. push notifications) adds authentication integrity, phishing resistance, and user validation through real-time, context-aware approvals.

Passkeys replace passwords and also render basic TOTP/HOTP-based 2FA unnecessary. However, they do not replace modern, push-based 2FA, which may still be needed in higher-assurance or enterprise scenarios.

Regardless personally I am waiting for full FIDO Alliance interoperability/sync, so I'm not locked into a single password manager. I've already had to migrate password managers after my choice was taken over by Private Equity.

[ Parent | on HN ]
Re:Passkeys are just passwords that require a password manager by esseph on Tuesday August 05, 2025 @12:11AM (#44794264)
Pushed based is also insecure, why would you want that if you have a passkey?
[ Parent | on HN ]
Re:Passkeys are just passwords that require a password manager by Almondsetat on Tuesday August 05, 2025 @01:12AM (#44794532)
Push notifications don't protect against realtime phishing attacks
[ Parent | on HN ]
Re:Passkeys are just passwords that require a password manager by crote on Tuesday August 05, 2025 @02:10AM (#44794810)
The main benefit of FIDO2 is origin verification: it is literally impossible to authenticate on a phishing website, as on a phishing website the browser won't send valid origin data to your token.

Push notification based 2FA can never obtain that level of security.

[ Parent | on HN ]
Re:Passkeys are just passwords that require a password manager by Afty on Tuesday August 05, 2025 @12:53PM (#44800594)
What happens if the origin changes? Suppose I have a passkey for Twitter.com, and now the site is named X.com? Is there some way to migrate the passkey?
[ Parent | on HN ]
Re:Passkeys are just passwords that require a password manager by Harvesterify on Tuesday August 05, 2025 @05:59AM (#44796179)
Push notifications are vulnerable to MFA fatigue/"bombing" attacks, that are used in the real world, cf. this breach on Uber:

https://www.darkreading.com/cyberattacks-data-breaches/uber-...

[ Parent | on HN ]
Re:Passkeys are just passwords that require a password manager by AlphaCerium on Tuesday August 05, 2025 @10:02AM (#44798102)
> I've already had to migrate password managers after my choice was taken over by Private Equity.

do you remember which one? hope it wasn't bitwarden :/

[ Parent | on HN ]