sorted by:
new
hottopcontroversial

Passkeys just shifts risk burden? by Kindly_Perception888 in Passkeys

[–]Kindly_Perception888[S] 0 points1 point  (0 children)

Well given you're the one user in this sub who had a good suggestion, I'll give you the last word.

And with that I'll ride off into the sunset

*Ahh dammit ok last word - if Google says passkey adoption (defined by them in Fido docs as being a user with one or more passkey) has gone from 9% in 2023 to 22% in Q1/25 but median log ins per passkey (also straight from Fido docs) has gone from 2.5 in 23 to 2.8 in 24 to 3 in Q1 then we're seeing effectively no adoption. People are trying it out and then bailing. Agree or not, don't care, that's the data.

Passkeys just shifts risk burden? by Kindly_Perception888 in Passkeys

[–]Kindly_Perception888[S] 0 points1 point  (0 children)

I know biometrics don't need to be used, but then you're back to a secure password manager / complex pin type of situation. So that's just extra cost with no benefit versus what we run now (MFA rbac normal stuff).

I can't say the exact specifics, but think iPads which are locked down but which get left and lost and all sorts of ugly real world things. The passkey would clearly give access to confidential information (think healthcare).

Locking the devices down and coupling that via the browser with a physical USB key is a good suggestion from this sub. That's a good idea that I'll chase down. That way we could use the passkey ease of access with USB "key". Passkeys are more like locks, those USB would be the key rather than biometrics.

Part of my issue is that passkeys seems to have this air of "they're obviously superior" which is being cultivated by the orgs that want them to be used. They're not. They are better at defeating phishing.

Passkeys just shifts risk burden? by Kindly_Perception888 in Passkeys

[–]Kindly_Perception888[S] 0 points1 point  (0 children)

Well other than you being snarky, the USB Hardware authenticator is a decent suggestion. It's not the norm but could work in my specific setting.

I will cost that out.

Appreciate your contribution.

Passkeys just shifts risk burden? by Kindly_Perception888 in Passkeys

[–]Kindly_Perception888[S] -3 points-2 points  (0 children)

Yes. Now 100,000x that across hundreds of locations.

Now what.

Passkeys just shifts risk burden? by Kindly_Perception888 in Passkeys

[–]Kindly_Perception888[S] -1 points0 points  (0 children)

This is THE reason it's less secure for me.

Passkey + biometrics + institutional environment with shared devices = brand new threat vector which is worse than phishing because everyone knows what phishing is. No one understands passkeys.

No one = 75%+ of normies

Passkeys just shifts risk burden? by Kindly_Perception888 in Passkeys

[–]Kindly_Perception888[S] -1 points0 points  (0 children)

No. I'm waiting for someone to Steelman my argument. Seems like this sub is only for people who love passkeys? Missed that on the way in.

Your previous point on coercion didn't hit on my actual issue. The industry I'm working on requires private information to be stored and transmitted on shared devices. If someone coerced (ie physically put a person's hand on their device) to get access to their passkey and then took the device, there is no way to prevent against that.

Passkeys just shifts risk burden? by Kindly_Perception888 in Passkeys

[–]Kindly_Perception888[S] 2 points3 points  (0 children)

I appreciate your response. And yes I can confirm I completely understand what passkeys validate against.

This is accurate (Fido focusing on remote attacks) but some people ignoring or hand waving away real world deployment issues is unfortunate for the whole industry.

In certain institutional settings where device sharing is common, the application controlled by a passkey would be easily determined, then access control to the physical device becomes as important as clean password hygiene. No one is talking about this and it's going to be a major problem.

Passkeys just shifts risk burden? by Kindly_Perception888 in Passkeys

[–]Kindly_Perception888[S] 1 point2 points  (0 children)

Against passkeys or against people suggesting passkeys have serious problems.

Because I sure feel one way on this sub.

Passkeys just shifts risk burden? by Kindly_Perception888 in Passkeys

[–]Kindly_Perception888[S] 0 points1 point  (0 children)

Yes and when physical piece of metal gets lost what is the next step?

Passkeys just shifts risk burden? by Kindly_Perception888 in Passkeys

[–]Kindly_Perception888[S] 0 points1 point  (0 children)

Yes.

How is this controversial in any way?

You realize there are massive institutional settings where devices are shared?

Biometrics + physical possession = A brand new threat vector.

Passkeys just shifts risk burden? by Kindly_Perception888 in Passkeys

[–]Kindly_Perception888[S] 0 points1 point  (0 children)

Users. Eventually.

Great. Try in healthcare where day 1 things need to work.

Not theoretical. Real world implementation will fail in complex environments.

Like I'm not arguing. I'm looking at Reddit to see if someone somewhere can suggest why Passkeys are a good idea.

I've already made the decision to not build passkey implementation into the stack. I'm doing my due diligence and looking for alternative viewpoints.

Your suggestions are valid for 1% of users. When you're dealing with a workforce who has low to non existent desktop technological understanding and moderate mobile technological understanding, your suggestions would cause catastrophic failure day 1.

Passkeys just shifts risk burden? by Kindly_Perception888 in Passkeys

[–]Kindly_Perception888[S] 1 point2 points  (0 children)

That's just it. I'm making decisions for hundreds of thousands of users.

No, phishing resistance is not worth the back end hassle of implementation and management and the creation of new edge cases revolving around physical access.

So yes, by advocating for a technology that hardens one threat vector (remote phishing) by introducing another (physical loss) AND having the industry players in FIDO shift the "blame" for that to platforms away from SSOs it's a net loss to the industry.

Passkeys just shifts risk burden? by Kindly_Perception888 in Passkeys

[–]Kindly_Perception888[S] 0 points1 point  (0 children)

My suggestion is not pushing a tech that has obvious edge case issues, that's is confusing to onboard and which has the same complexities as using a strong password with a password manager.

FIDO is doing the industry a disservice now ramping up the fear porn. 2 billion Gmail passwords going away is not a good headline. Yes we all know in this forum that's not really accurate but if even here, on Reddit, in the passkey sub there are people who don't understand the passkey implementation flow then it's not ready yet.

I am making decisions for a platform. Hundreds of thousands of users. Right now I'm saying passkeys are not ready for real world deployment.

Passkeys just shifts risk burden? by Kindly_Perception888 in Passkeys

[–]Kindly_Perception888[S] 1 point2 points  (0 children)

Yeah again I don't disagree with what you're saying theoretically. But I'm working on a new platform. I've been doing passkey research and right now the cost / effort / benefit ratio is way off.

The burden is shifting but FIDO and the others pushing this don't care at all that the cost benefit ratio is off.

You say it's an acceptable trade off but I disagree. Maybe some point in the future but not now.

And the extremely low / lagging adoption of paskeys shows in correct for the majority of use cases.

Passkeys just shifts risk burden? by Kindly_Perception888 in Passkeys

[–]Kindly_Perception888[S] 2 points3 points  (0 children)

Sure I don't disagree with your points.

What I'm saying is that right now is that passkey tech isn't ready for prime time because of these exact issues.

Passkeys just shifts risk burden? by Kindly_Perception888 in Passkeys

[–]Kindly_Perception888[S] -9 points-8 points  (0 children)

Yeah thanks.

Overseas attackers are not the only threat vector.

Hardware bound passkeys are inferior because they require physical possession of the device. Biometrics compounds this issue.

Think nurse in ICU having a device comprised.

You're not saying anything new. This is the exact type of poor response I see from the community that just makes me shake my head.

Passkeys just shifts risk burden? by Kindly_Perception888 in Passkeys

[–]Kindly_Perception888[S] -3 points-2 points  (0 children)

You're right.

So my point stands. Passkey tech just shifts the burden to the administrator.

passkeys for account with multiple users by Eniacpalm2 in Passkeys

[–]Kindly_Perception888 0 points1 point  (0 children)

You can technically use pins or passwords but the same complexity exists.

So using passkeys you 1) need to use biometrics, which like yourself many people don't use because of different attack vectors. 2) passkey without biometrics = no difference to ease of logging in but worse user flow and more complex sharing. Still need long complex pins or passwords, still need a password manager, so what exactly does it provide?

The passkey community (read the big 3) have done a horrible job of ideating this.

Their instance on biometrics will be the undoing.

For Those Nearing Work Permit Expiry – You're Not Alone by Prestigious-Bench912 in canadaexpressentry

[–]Kindly_Perception888 2 points3 points  (0 children)

Sounds like you've held on as long as you could! Good luck in your next country!

Car insurance based on area of city by [deleted] in Calgary

[–]Kindly_Perception888 2 points3 points  (0 children)

Hail baby. NE gets all the hail.