upvote
Yes, web apps should support passkeys directly and have a "log in with your passkey" button if there's a cookie indicating that you previously logged in with one. Also, don't screw up the UI by then sending you an email or text message with a confirmation code.

(If it's a browser that you haven't used before, perhaps be a little more paranoid.)

reply
I really hate this bullshit "security". Why on earth do I have to log in every single day? If anything, it gives an attacker more chances to either steal my password, or makes me more likely to be phished because logging in is so automatic now.

It has negative security. Log me in for a fucking month, stop wasting a minute of my time every day!

reply
It's also crazy that as far as technology has advanced, the concept of the username/password is still so prevalent. Passkeys are sort of changing things, it all still feels decidedly low-tech. Edit: Can you get a Yubikey as an RFID implant? ...asking for a friend.
reply
What is really crazy is that things that should be just an application locally installed on the device (such as PowerPoint) need a login at all.

There's a secondary issue of schools pushing children to use proprietary applications when perfectly serviceable alternatives exist (especially for school level work).

How the hell we all normalized this crap is maddening.

reply
Username/password is the easiest way to log in, assuming there is no stupid format requirements. It's just two strings stored in your password manager. The most retarded way to implement log in is actually magic email link, which requires opening your email client, waiting for the email to arrive, and copying the code. If you want to make it even worse, you can require that to be done using the same browser that is trying to log into the account.
reply
Because everything is sitting out on the public internet now, only protected by those things.
reply
Because the alternative is that a very long or unlimited session cookie can be stolen and used for months to impersonate you. That’s the tradeoff
reply
When was the last time that happened to a Gmail account? It has unlimited cookie sessions.
reply
I actually did this for my small saas Ive sold to a couple dozen companies, and while all my programming friends at the coworking office said I was crazy, Gmail and facebook were my go to answers. If they can do it safely, I might as well try.
reply
Then connect the browser directly to the secure element of the device, so the session cookie is cryptographically signed by something you are physically in possession of.
reply
Logging and alerting the user that their account is being used from a new context and requiring reauthentication when accessing the account from an unfamiliar IP/user agent would mitigate this to some extent.
reply
TPMs / secure enclaves can (in theory) prevent sessions or cookies from being stolen. Not claiming there aren't other attack vectors though.
reply
The alternative is offering offline versions of apps to students and allow students to open downloaded items off the cloud locally. It also means students don't require internet access when off campus.
reply
I'll take that risk, especially since I've basically never heard of a successful attack hinging on a stolen session cookie being used for months. Either you do what you'll do within a few minutes, or you never do.
reply
That's a great way for someone to siphon a lot of session tokens and then auction them off to a black hat.

It's also a great way to lose everything if you happen to lose your phone or laptop and it gets found a few hours or a day later and the antagonistic finder guesses your weak PIN.

In the US, service providers and manufacturers are often held liable for losses if they make something that has sub-standard security. Kia, for example, was held liable for making their cars too easy to steal. Banks have boatloads of things they have to do to protect their customers.

It's not really your choice to take the risk here, apparently.

reply
I don't remember the last time I had a workday that didn't involve logging into something that I definitely logged into not very long ago, that I use every single day, and it's so, so, so fucking tedious.

And it doesn't escape my notice that all the fucking things I have to log into over and over and over are using Microsoft auth. Which granted, I think every office worker would notice that just from the ubiquity of their software, but still. And, on top of it, Microsoft's login flows are remarkably, consistently clunky. The forms jump all over the place and it has to refresh the page like 5 times as it's processing your credentials, and lord help you if Outlook needed you to sign in and silently opened that stupid auth window, because if you go through the entire thing, odds are great that you'll get a "security token expired, please do it again" message at the end. Like I dunno personally I wouldn't get a security token until the user has actually interacted in some way with the stupid form but what do I know I've only been making software for like 13 fucking years.

Oh yeah, bonus points: I use the passkey thing for my MS Auth app on my phone, and every single goddamned time I sign in, it asks me if I want to.... wait for it... create a passkey.

Edit: Oh oh and, for the above? If you're working through your morning coffee and accidentally click OK instead of cancel, it'll sit there spinning forever, not sign in correctly, and then you get to do ALL THIS BULLSHIT AGAIN.

Just, truly the biggest circus with the most clowns over there.

reply
Fortunately I don't have to deal with Microsoft professionally, but anything Xbox related is also such a massive pain. More than 3 times now I've tried to login and got into an endless login loop.

If you look that up you'll see that people have been encountering that for over a decade.

I simply and truly don't get it.

Microsoft must have at least 80.000 devs. No one there ever wanted to fix this?

reply
> lord help you if Outlook needed you to sign in and silently opened that stupid auth window, because if you go through the entire thing, odds are great that you'll get a "security token expired, please do it again" message at the end.

Whenever I see the Outlook auth box I mash in some gibberish for my password to immediately get the "expired" notice so that I can enter my real auth info.

So if any admin happens to look, my baseline for incorrect passwords entered is 50%.

reply