this post was submitted on 15 Oct 2024
189 points (92.0% liked)
Technology
71502 readers
4140 users here now
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related news or articles.
- Be excellent to each other!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, this includes using AI responses and summaries. To ask if your bot can be added please contact a mod.
- Check for duplicates before posting, duplicates may be removed
- Accounts 7 days and younger will have their posts automatically removed.
Approved Bots
founded 2 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
If the passkeys aren't managed by your devices fully offline then you're just deeper into being hostage to a corporation.
The lock-in effect of passkeys is something that this protocol aims to solve though. The “only managed by your device” is what keeps us locked in, if there is no solution to export and import it on another device.
The protocol aims to make it easy to import and export passkeys so you can switch to a different provider. This way you won’t be stuck if you create passkeys e.g. on an Apple device and want to switch to e.g. Bitwarden or an offline password manager like KeyPassXC
That's between platforms though. I like my stuff self-managed. Unless it provenly works with full offline solutions I'll remain sceptical.
Bitwarden / Vaultwarden is a popular available working solution for self-hosting and self-managing passkeys (as well as passwords).
Have you never lost your password device (phone, laptop, etc) suddenly and unexpectedly? That's when you really want that file synced somewhere else. But then it's too late. Bonus on many password vault servers is shared folders, so one can share their garage door code with the family but keep the bank account details to oneself.
And who forces all the corps to correctly implement that protocol? Getting you locked in is in all of their interests, after all.
I think it‘s fair to remain skeptical but the big organizations were part of the development, so there seems to be some interest. And it‘s not always in their interest to lock users in, when it also prevents users from switching to their platform.
That's a great way to lose access if your device gets lost, stolen, or destroyed. Which is why I'm against and will continue to be against forcing 2FA and MFA solutions onto people. I don't want this, services don't care if we're locked out which is why they're happy to force this shit onto people.
Well yeah, that is true. Security and convenience are usually at odds... MFA has place, unless you don't mind some guy from russia access your online bank account ; but I definitely wouldn't use it on all my accounts.
Yeah and since Online bank accounts can also almost always be reset if you lose the 2FA/MFA key by calling customer support, or going to your bank and speaking with themt in person, there's almost no risk of losing access completely. It's a service you have access to because you're you. Something that isn't the case with Reddit, Github, Lemmy accounts, or Masotodon. I'm not able to regain access after losing those 2FA solutions by virtue of being myself, they treat you just like the attacker in those cases. Really not worth it there, both since what is being protected isn't worth it, and the risk far outweighs it.
Access to my main email account (outlook) is currently blocked because someone decided to try a password from some earlier leak and locked it. It can only be unlocked with SMS MFA, which I can't use because I'm travelling abroad. There is no other way to do it. The other option they give you a form that only works if you don't have MFA set up (it says so on the faq). I even asked someone to fill the form from my home computer so the location data matches earlier accesses, but didn't work. You also can't contact support without logging in. If I had lost/changed that phone number for any reason, I would lose access forever. Luckily I will be back home soon.
I had a similar scary situation like that before where the phone number linked to the account wasn't mine anymore. Luckily I was able to get back because I was still logged in on another computer and it hadn't kicked me out yet, I was able to go to account settings and remove the phone number, then google let me log into the account again. Had I been kicked out of the account, I would've lost it for sure.
Y'all here talking so smart ignore another thing - the more complex your solutions are, the deeper you are into being hostage to everyone capable of making the effort to own you.
Don't wanna be hostage - don't use corporate and cloud services for things you need more than a bus ticket.
You are being gaslighted to think today's problems can be solved by more complexity. In fact the future is in generalizing and simplifying what exists. I'm optimistic over a few projects, some of which already work, and some of which are in alpha.
Thank goodness you didn’t mention any names
Projects don't react too well to premature attention.
Not to mention Apple let's you SHARE them with airdrop.