Technology

59989 readers

2308 users here now

This is a most excellent place for technology news and articles.

Our Rules

Follow the lemmy.world rules.
Only tech related content.
Be excellent to each another!
Mod approved content bots can post up to 10 articles per day.
Threads asking for personal tech support may be deleted.
Politics threads may be removed.
No memes allowed as posts, OK to post as comments.
Only approved bots from the list below, to ask if your bot can be added please contact us.
Check for duplicates before posting, duplicates may be removed

Approved Bots

founded 2 years ago

MODERATORS

189

The War on Passwords Is One Step Closer to Being Over (www.wired.com)

submitted 2 months ago by GreenEngineering3475@lemmy.world to c/technology@lemmy.world

134 comments fedilink hide all child comments

“Passkeys,” the secure authentication mechanism built to replace passwords, are getting more portable and easier for organizations to implement thanks to new initiatives the FIDO Alliance announced on Monday.

you are viewing a single comment's thread
view the rest of the comments

[–] unskilled5117@feddit.org 36 points 2 months ago* (last edited 2 months ago) (3 children)

The lock-in effect of passkeys is something that this protocol aims to solve though. The “only managed by your device” is what keeps us locked in, if there is no solution to export and import it on another device.

The protocol aims to make it easy to import and export passkeys so you can switch to a different provider. This way you won’t be stuck if you create passkeys e.g. on an Apple device and want to switch to e.g. Bitwarden or an offline password manager like KeyPassXC

The specifications are significant for a few reasons. CXP was created for passkeys and is meant to address a longstanding criticism that passkeys could contribute to user lock-in by making it prohibitively difficult for people to move between operating system vendors and types of devices. […] CXP aims to standardize the technical process for securely transferring them between platforms so users are free […].

[–] nevemsenki@lemmy.world 16 points 2 months ago* (last edited 2 months ago) (1 children)

That's between platforms though. I like my stuff self-managed. Unless it provenly works with full offline solutions I'll remain sceptical.

[–] darklamer@lemmy.dbzer0.com 15 points 2 months ago (1 children)

I like my stuff self-managed.

Bitwarden / Vaultwarden is a popular available working solution for self-hosting and self-managing passkeys (as well as passwords).

[–] EngineerGaming@feddit.nl 2 points 2 months ago (1 children)

TBH I don't see a reason why something as simple as a password manager needs a server, selfhosted or not. I don't get the obsession with syncing everything, so would rather stick with normal KeepassXC.

[–] synestine@sh.itjust.works 6 points 2 months ago (1 children)

Have you never lost your password device (phone, laptop, etc) suddenly and unexpectedly? That's when you really want that file synced somewhere else. But then it's too late. Bonus on many password vault servers is shared folders, so one can share their garage door code with the family but keep the bank account details to oneself.

[–] EngineerGaming@feddit.nl 4 points 2 months ago* (last edited 2 months ago)

No, but this is very unlikely because I do keep regular backups manually. I just don't feel the need for it to be a constantly-online server.

[–] RecluseRamble@lemmy.dbzer0.com 3 points 2 months ago (1 children)

And who forces all the corps to correctly implement that protocol? Getting you locked in is in all of their interests, after all.

[–] unskilled5117@feddit.org 4 points 2 months ago* (last edited 2 months ago)

I think it‘s fair to remain skeptical but the big organizations were part of the development, so there seems to be some interest. And it‘s not always in their interest to lock users in, when it also prevents users from switching to their platform.

Development of technical standards can often be a fraught bureaucratic process, but the creation of CXP seems to have been positive and collaborative. Researchers from the password managers 1Password, Bitwarden, Dashlane, NordPass, and Enpass all worked on CXP, as did those from the identity providers Okta as well as Apple, Google, Microsoft, Samsung, and SK Telecom.

[–] umbrella@lemmy.ml 1 points 2 months ago

not the first time i hear this though. im skeptical until proven otherwise