Pulse of Truth

1565 readers

45 users here now

Cyber Security news and links to cyber security stories that could make you go hmmm. The content is exactly as it is consumed through RSS feeds and wont be edited (except for the occasional encoding errors).

This community is automagically fed by an instance of Dittybopper.

founded 2 years ago

MODERATORS

krogoth@infosec.pub

Passkeys are incompatible with open-source software (www.smokingonabike.com)

submitted 2 days ago by lemmydev2@infosec.pub to c/pulse_of_truth@infosec.pub

9 comments fedilink hide all child comments

Comments

you are viewing a single comment's thread
view the rest of the comments

[–] calamityjanitor@lemmy.world 2 points 1 day ago

Software passkeys can't provide attestation and don't. A service requiring it would reject every apple and google device too. Its a feature for hardware like yubikeys and smart cards used by governments to ensure it's not a knockoff with backdoors.

No thats actually not an issue at all if your device is secure and uses full disk encryption.

Oh I see your computer is secure well then nothing to worry about 🤣

If i want to write down my private key on a piece of paper and type it in by hand then thats my issue to deal with and not theirs.

With a hardware FIDO2 key, the private key never leaves the device, instead it signs challenges. Malware on the PC can't access the private key and make it's own copy.

Using software keys, they are at least encrypted in the vault until you open it, then there'll be a window of time with a plain copy in memory that malware can potentially grab.

Your plaintext private key file can be stolen by malware easily and immediately. You would actually be better off with it written on a post it note.

Course in real life malware is gonna be stealing your browser cookies to gain access to your accounts and avoid the whole keypass thing. In the world that FIDO was born, authentication is happening all the time and any possibility of key theft is considered a compromise.