undefined

points

[-]

> Thats because the people behind passkeys are paternalistic and don't trust users.

To be fair, trusting users with passwords/credentials is how we got into the mess of phishing et al in the first place.

by kingstnap4 hours ago|

parent|

[-]

The phishing resistance on fake websites is largely a function of the fact its an ssh key and you can't man in the middle those after first setup because you have known_hosts, which in the case of passkeys gets replaced with the website certificate technology.

The baking in "which authenticator is storing this passkey" and "require user to provide biometrics/pin to verify presence for this passkey" and "don't make it easy or possible to export passkeys" behaviour is more just control.

I guess it sort of helps if the threat model is complete remote code execution inside the victims brain because you got them to export their keys to you, but it seems more useful for websites and governments whitelisting what hardware and software they deem acceptable.

by joshuamorton2 hours ago|

parent|

[-]

> I guess it sort of helps if the threat model is complete remote code execution inside the victims brain because you got them to export their keys to you, but it seems more useful for websites and governments whitelisting what hardware and software they deem acceptable.

Reminder that Facebook has warnings and prevention mechanisms to avoid users pasting malicious JavaScript into the console on Facebook.com (which would exfiltrate session cookies).

Preventing users from accessing these keys directly makes sense!