Login
You're viewing the mastodonapp.uk public feed.
  • ma𝕏poolmaxpool@mathstodon.xyz
    Oct 14, 2026, 3:10 PM

    @ScottHelme

    That's why the proposal: "third-party password manager, paired with an independent TOTP app" seems like the the best solution for personal use until passkeys have mature ecosystem.

    Authentication is decoupled from OS vendor. Password vault and TOTP tokens exist independently. Even if Apple or Google bans your identity, you keep your credentials, can log in from any browser or OS, and can update your contact email on those third-party services.

    I'm no expert, but if I understand the situation correctly, FIDO alliance has draft for transferring passkeys between ecosystems (Apple, Android, Google, Linux,... ) but it does not exist in practice.

    It's probably just an attempt in lock-in to slow walk, or refuse to implement these parts.

    💬 1🔄 0⭐ 1

Replies

  • Scott HelmeScottHelme@infosec.exchange
    Oct 14, 2026, 3:14 PM

    @maxpool Right, but all I'm saying is you need to swap "password and TOTP" with "passkey" in that explanation and you're better off.

    If someone already has their password in a password manager, what's the difference to it being a passkey in there instead?

    All password managers I've seen can sync passkeys across any device where the password manager is installed.

    💬 1🔄 0⭐ 1
  • timtimcappalli@infosec.exchange
    Oct 14, 2026, 3:31 PM

    @ScottHelme

    this is one of the primary reasons whatarepasskeys.info was created: to help users find a credential manager that works for them and help them understand passkeys more generally.

    @maxpool

    💬 1🔄 0⭐ 0
  • Juan C Nunojuancnuno@mastodon.social
    Oct 14, 2026, 4:22 PM

    @timcappalli @ScottHelme @maxpool

    > If someone already has their password in a password manager, what's the difference to it being a passkey in there instead?

    I can export my passwords out of Google Password Manager into a CSV. I can open it in a text editor and see my passwords in there. But I can't export passkeys the same way. I understand that the Credential Exchange Protocol is a thing and can use the flow to import them into Bitwarden or whatever but I prefer a little less opaqueness.

    💬 1🔄 0⭐ 0
  • timtimcappalli@infosec.exchange
    Oct 14, 2026, 4:32 PM

    @juancnuno

    do you think that is appropriate for an elderly parent who can be easily tricked into exporting all their passkeys in plain text and uploading them to an attacker's site?

    If plaintext export is something you want, there are credential managers which will give you that. Use them. But I don't think that's appropriate for the majority of consumers.

    @ScottHelme @maxpool

    💬 2🔄 1⭐ 0
  • 💬 1🔄 1⭐ 0
  • 💬 1🔄 1⭐ 0
  • GerardGerardThornley@hachyderm.io
    Oct 14, 2026, 7:40 PM

    @timcappalli @amonduin @juancnuno @ScottHelme @maxpool The older users I know are still using pieces of paper (or worse, an excel file!) to manage their passwords. Even TOTP is beyond at least some of them. SMS-based 2FA is frustrating to them but they have at least learned what they're expected to do.
    For a certain age group, change - any change at all - is really, really difficult to cope with. It's confusing, and ultimately pushes them to reject technology. Then they feel isolated because so many things assume some level of online capability.

    💬 1🔄 1⭐ 0
  • 💬 1🔄 1⭐ 0
  • GerardGerardThornley@hachyderm.io
    Oct 14, 2026, 10:08 PM

    @timcappalli @amonduin @juancnuno @ScottHelme @maxpool Oh, I appreciate the risks arrayed against them. But if folks are struggling to cope with what they already have, the right solution is not asking them to learn something new.
    I think for some people it might be better to move their interface to services offline - support people living in a simpler world.

    💬 0🔄 0⭐ 0
  • Epic NullEpic_Null@infosec.exchange
    Oct 14, 2026, 6:09 PM

    @timcappalli @juancnuno @ScottHelme @maxpool Actually, if we're bringing up elderly (grand)parents, this introduces a new concern AGAINST passkeys.

    Grandma IS going to do something dumb. I AM going to need to sign in to her accounts on my own devices. I AM going to need to fix hr accounts.My mom IS needing to take over her finances to get her bills paid.

    Sure, grandma may not be able to handle a plaintext export, but as de-facto tech support? I'm going to find that feature invaluble.

    💬 1🔄 1⭐ 0
  • Patrickppb1701@ppb.social
    Oct 14, 2026, 6:19 PM

    @Epic_Null @timcappalli @juancnuno @ScottHelme @maxpool you can also run into issue with shared accounts to spouse/partner. I don't move some of the shopping accounts we use to them because for reasonable reasons my wife doesn't want the extra hoops of another app or having to find a specific device to okay it. Not when if it sends me mfa code I can rattle it off to her and she's just slightly inconvenienced but logged in.

    💬 1🔄 0⭐ 0
  • 💬 0🔄 1⭐ 0
  • 💬 2🔄 1⭐ 0
  • 💬 2🔄 1⭐ 0
  • 💬 0🔄 0⭐ 0
  • 💬 0🔄 1⭐ 0
  • 💬 1🔄 1⭐ 0
  • Epic NullEpic_Null@infosec.exchange
    Oct 14, 2026, 9:04 PM

    @timcappalli @ppb1701 @juancnuno @ScottHelme @maxpool Yeaaaaaaaaaaaaaah I have met my grandma and on a scale of 1 to 10 the probability of that happening is a -50. As in somehow it would create a different, worse crisis if I tried to do that.

    As for my mom, I have learned that the things that make me happy with a password manager are non-starters for her.

    We have different needs and getting us on the same password manager is gonna be a "no".

    💬 0🔄 1⭐ 0
  • 💬 0🔄 0⭐ 0
  • 💬 0🔄 1⭐ 0