Login
You're viewing the mastodonapp.uk public feed.
  • Gavingavin57@toot.wales
    Oct 14, 2026, 4:00 PM

    @rzeta0 @ScottHelme With a password, both you and the server you are logging into have a copy of your full password and possibly the seed for your 2FA. If that server is compromised, or you click on a phishing link and hand those credentials over to a hacker, your account can be compromised.

    With a passkey, you have half of your pass (private key), the server has the other half (public key). Only when they are together do they let you in and only on the website they were created on.

    💬 5🔄 0⭐ 0

Replies

  • Gavingavin57@toot.wales
    Oct 14, 2026, 4:04 PM

    @rzeta0 @ScottHelme The device or password manager the passkey is created in will normally ask for biometrics as a second factor.

    My advice is to find a password manager you like and that supports passkeys. Try it out on a few less important websites until you feel comfortable with them. If you use multiple platforms, a cross-platform password manager is the way to go.

    FWIW, I had similar concerns in the beginning, but now I really like them.

    💬 3🔄 1⭐ 0
  • amonduinamonduin@mstdn.ca
    Oct 14, 2026, 5:26 PM

    @gavin57 @rzeta0 @ScottHelme Biometrics are, IMO a downside to passkeys not an upside. They tie you to biometric locks on each device they are synced to and if that is your second factor you now are required to have a second device on you if the one you're using doesn't support the required biometrics.

    The upsides of passkeys are real, but there are real downsides that are really human related.

    💬 2🔄 1⭐ 0
  • Gavingavin57@toot.wales
    Oct 14, 2026, 5:44 PM

    @amonduin @rzeta0 @ScottHelme The thing is, the biometrics and the passkey are not necessarily the same thing. If you have a passkey stored in 1Password or Proton Pass (for example), it doesn't matter whether you are using FaceID, TouchID, Windows Hello or whatever the Android equivalent is.

    As long as you can prove you are 'you' and on 'your' device, it doesn't matter.

    On the other hand, anyone can use your password or 2FA if it is breached.

    💬 1🔄 1⭐ 0
  • 💬 1🔄 1⭐ 0
  • amonduinamonduin@mstdn.ca
    Oct 14, 2026, 5:52 PM

    @gavin57 @rzeta0 @ScottHelme

    I'm not saying passkeys have no good reasons for existing.

    Passkeys however are not a universal upgrade. If you're someone who spends most of their day in-tech minded circles sure they feel good but for regular people its just replacing something they do understand with something they don't understand for benefits they don't understand.

    💬 0🔄 1⭐ 0
  • peachfrontpeachfront@mas.to
    Oct 14, 2026, 11:59 PM

    @amonduin @gavin57 @rzeta0 @ScottHelme

    anybody like myself who has (more than once) been falsely identified as someone i am not in a place i was not by facial recognition will tell you that anything that relies on biometrics is ... not good

    💬 0🔄 0⭐ 0
  • argv[-1]argv_minus_one@mastodon.sdf.org
    Oct 14, 2026, 6:32 PM

    @gavin57

    Finding a password manager you like that supports passkeys won't do you any good because the server requires remote attestation and your password manager isn't on the server's approved list.

    If that hasn't been an issue for you yet, consider yourself temporarily fortunate. Remote attestation is part of the spec for a reason, and that reason is to ensure you are using a “secure” proprietary device.

    @rzeta0 @ScottHelme

    💬 1🔄 1⭐ 0
  • 💬 1🔄 1⭐ 0
  • 💬 0🔄 1⭐ 0
  • 💬 0🔄 0⭐ 0
  • 💬 1🔄 0⭐ 0
  • 💬 0🔄 0⭐ 0
  • argv[-1]argv_minus_one@mastodon.sdf.org
    Oct 14, 2026, 6:30 PM

    @gavin57

    If the server is compromised, my account is already compromised. The attacker now controls the server where my account lives.

    And the only things of mine that the attacker has are my password (which is only good for the server that the attacker already controls) and whatever is stored on the server (which, again, the attacker already controls).

    @rzeta0 @ScottHelme

    💬 0🔄 0⭐ 0
  • 💬 1🔄 0⭐ 0
  • Gavingavin57@toot.wales
    Oct 14, 2026, 7:36 PM

    @poetaster @rzeta0 @ScottHelme Well, as Passkeys only work on the domain they were created on, it’s difficult for someone to hand their credentials to a fraudulent website because the passkey won’t work.

    I’m not sure how you would socially engineer someone to give up their private key. You would need to compromise the device or the whole password manager account.

    💬 1🔄 1⭐ 0
  • poetasterpoetaster@mastodon.gamedev.place
    Oct 15, 2026, 5:56 AM

    @gavin57 @rzeta0 @ScottHelme I lived in Calgary when Mitnick walked out of the Nortel offices with Dat tapes handed to him directly. It is quite common for naive users to be led through a convincing corpo web flow to do precisely that private key compromise. I only use hardware devices that are effectively scanners. Some banks (Deutsche, Ing) still offer them. Not impervious to abuse but limited in scope and independant from other services.

    💬 0🔄 0⭐ 0
  • an actual busrenardboy@mastodon.social
    Oct 15, 2026, 12:18 AM

    @gavin57 @rzeta0 @ScottHelme Should be mentioned that following very basic security good practices will have your database contain salted hashes of user passwords, not the passwords themselves.

    Of course, whether the server you're connecting to as a client does this correctly is not something you can know but unless they did the extra effort of rolling out their own auth and did it terribly you're almost certainly good.

    💬 0🔄 0⭐ 0