Keep reading. The Hack explains how corporations can arbitrate which type of passkeys they might allow when their TOTP authenticator refuses your passkey settings.

save

path: 0 26286705 26287525 26287609 26287671, hotness: undefined, score: 3, children: 3

chicken 5 points 13 hours ago

So what makes passkeys so different? Well, they look very similar to TOTP on the surface. Both have an open standard (RFC 6238 for TOTP, WebAuthn for passkeys), so surely passkeys must have all these same nice properties as TOTP, right? At first glance it would seem so.

Don’t forget that unlike passwords and SMS codes and TOTP, passkeys are designed to function in the background without you ever seeing the details.

Wait for Big Tech to propose something just as convenient and secure but more clearly defined and with fewer strings attached. In the meantime if you want security, your Game Boy can provide you with TOTP.

It really seems like the article is drawing a strong distinction between TOTP and passkeys and saying TOTP is better though

save

path: 0 26286705 26287525 26287609 26287671 26288093, hotness: undefined, score: 5, children: 2

tyler 4 points 9 hours ago

This is a very badly written article that conflates TOTP with passwords and then uses that to try to draw a line between totp and passkeys. Passkeys are limited in use in the exact same way that password are. The entity making the website gets to decide the rules.

Attested passkeys will not happen for common big tech websites because they wouldn’t completely prevent the use of password managers.

All these companies are pushing for passkeys because they not only are vastly better for security, but because they remove liability for these companies.

The author falls down the steepest slope I’ve ever seen writing this article, and still fails to see the basic facts.

save

path: 0 26289769, hotness: undefined, score: 4, children: 0

moldy_rice 3 points an hour ago

Hardware Security Keys deployed to replace passwords is abuse.

They're supposed to be a second factor.

save

path: 0 26294500, hotness: undefined, score: 3, children: 0

nate3d 3 points 10 hours ago

I agree with all the points made in this post except I’m troubled by the conclusion that we should let big tech decide a better solution. That puts the power right back with part of the consortium that was focused as part of the whole passkey issue here. Not saying I know what would be a better alternative but I don’t agree that that is it.

save

path: 0 26289595, hotness: undefined, score: 3, children: 0

moldy_rice 2 points an hour ago

Password managers with totp seems like the best solution.

I wouldn't recommend hardware security keys to others. It's just a ticking time bomb before they loose it and get fucked.

save

path: 0 26294746, hotness: undefined, score: 2, children: 0

moldy_rice 1 point an hour ago

Yes, someone really made TOTP for Game Boy. I cannot in good conscience actually recommend using this, but it will make you popular at parties. (At my parties in any case.)

You kinda did recommend it in the last sentence :(

save

path: 0 26294702, hotness: undefined, score: 1, children: 0

moldy_rice 0 points an hour ago

smartphones do use files and folders. They just don’t typically come with a file browser like your desktop does.

This is my biggest gripe about Android. It's basically unusable.

Sure, I use Amaze from fdroid. But I tried to extract a compressed tarball and it literally couldn't do it. And there were 0 apps in fdroid to extract compressed archives. What a useless OS.

save

path: 0 26294558, hotness: undefined, score: 0, children: 0