- cross-posted to:
- privacy@lemmy.ml
- cross-posted to:
- privacy@lemmy.ml
You must log in or register to comment.
There’s a difference between FIDO2 standards, whereby Hardware Tokens, like yubikeys, are not a trap. Of course software derived passkeys are antithetical to privacy, due to their opportunities for abuse like Microsoft’s deployment of the FIDO2 standard.
I think the concern is more about the freedom for the user to be able to decide what keys to use and how.
In particular, the author seems to want to share 1 account with multiple people, and enforcing “User-Present User-Verified Non-Copyable Hardware-Backed passkey” as the only accepted method for a service would allow for services to start restricting account sharing more effectively.
The standard allows an infinite number of tokens
You can have an infinite number of tokens with a single YubiKey, but that’s not the concern.
The issue is that a website can limit how many different passkeys you are allowed to register to a single account of their service.
So it does not matter if your device can provide infinite keys when the service only accepts one.
Right, then they’re opersting outside of the bounds of the Internet and should be appropriately shamed.
Yes, ideally that’s what should happen.
In practice, I’ve seen way too many times big corpo getting away with anticonsumer practices because their mainstream audience is willing to put up with it.
Specially when they introduce it slowly (say… they start by allowing a reasonable but fixed number of keys …then they lower the limit but start putting a small fee for each additional key… then they lower the limit to 1, increase the fee, etc)… they’ll test the waters and try to reach a level that enough of the mainstream would accept to maximize the money they make.
Frog inna pot
You never had any fucking freedom in regards to these services. The article is a bug-scare and is just trash. You might as well rail against their requirements to include numbers and special-characters in passwords–“oh, that’s infringing on my freedoms! Just yesterday you accepted my password of “password”, but now it’s no longer acceptable? Wow fascism! Telling people they need to have numbers and special-characters! This is a slippery slope. People rise up and don’t put any numbers or special-characters in your passwords!” I can’t deride enough the point of view that originated this article. It’s the most brain-dead boomer point of view I’ve yet seen. An epitome of manchild that’s endemic to tech.
I’ve noticed a couple of sites pushing these things. I decline.
I’m glad physical books and long walks outdoors are still good alternatives, as long as I leave my phone at home.
I suspect it won’t be optional in the future, though. More and more there aren’t non-digital options to important functions. How long before we’re all forced to bank online, and those who can’t are dragged along by some sort of hodgepodge solution using public kiosks? They’ll force new accounts to be online only, and wait for the naysayers to die off. Cash will be outlawed.
In some countries we are already actually forced to use banking on or phones. People like it a lot, but older people are struggling or forgetting about it and enduring. I hate it because of this exactly, the way older people is getting left behind.
Amazon keeps pushing me to use them and I can say without a doubt that it’s a shit idea to use them for a shared household. I’ll stay on a password with TOTP please and thank you.
Great writeup
I can only assume the article was written by a petulant child.
The author is bemoaning lack of agency on services they never had agency over. Twitter, Netflix, Google’s Android et. al. are all private dictatorships. It is not up to you whether they implement user-defined passwords or some other mechanism of authentication. Already these commercial enterprises use more than just a password. They look at machine and browser behavior, yet there’s not a peep about this ‘background’ analysis that determines whether a remote-computer can interact with the private-dictatorship’s corporate computer-resources. It is just as authoritarian as any example they wrote about.
The entire rant is a rant against passkeys’ security: they’re secure and because they’re secure they’re bad. It’s nonsensical text dressed up as, “but they might do nebulous bad things!” They’re already doing bad things, yet like a child, the author doesn’t want to change their behavior. They want to continue being a good little consumer piggy in the play-pen of surveillance-capitalism. You never had agency here: grow up. No one gives a shit if your consumer brain-dead mind can or can’t share a Netflix password.
Government agencies are members of these associations because economies are becoming more and more dependent on software and computers: it’s in their nations’ interests to secure these digital systems.
Again, using Apple’s iPhone, Google’s Android or Microsoft’s Windows is subjecting yourself to a private dictatorship. To then complain about something that annoys you whilst you continue to voluntarily subjugate yourself is absolutely moronic.
Nothing was written of hardware-passkeys. That is passkeys that reside on physical tokens. Passkeys are more secure than user-defined passwords; passkeys are more secure than user-defined passwords with a weak second-factor such as via e-mail or SMS; Passkeys are more secure than user-defined passwords with a TOTP code.
You can use hardware-passkeys on libre-computers, or mangled-mutts like Nura. This was conveniently not mentioned at all.
They talk about yubikeys in the footnote, which isn’t the best place to talk about them. They do not rant about how passkeys are bad because they are secure, they neutrally explain all the cool features and then they explain attestation, which is the only part they don’t like. Also, they don’t say that they use Windows, Android, macOS and iOS themselves and bemoan the oligopoly; they say most people use these operating systems instead of librecomputers, and bemoan the oligopoly on behalf of other people who don’t know better, or use windows because [general excuse for why people who aren’t the author use windows]. It is perfectly consistent to think of the author themselves as well informed about what linux they as an individual can install. I think we can blame the author for not making the article about how to install libre software, but taking that it is about passkeys as a given, it explains which part of them is harmful to software freedom. Maybe they even should have said that using android is to voluntarily subjugate oneself. But the article is about what the author wants other people to do, even if they aren’t explicit enough about that rejecting passkeys while using chrome is a temporary solution. They are the type of person that believes temporary solutions have value.
🫰🫰🫰
Edit: snaps
deleted by creator
