Create accountLogin

Recent searches

No recent searches

Search options

Only available when logged in.
en.osm.town is one of the many independent Mastodon servers you can use to participate in the fediverse.
An independent, community of OpenStreetMap people on the Fediverse/Mastodon. Funding graciously provided by the OpenStreetMap Foundation.

Administered by:

Server stats:

256
active users

en.osm.town: AboutProfiles directoryPrivacy policy

Mastodon: AboutGet the appKeyboard shortcutsView source codev4.3.7

#Passkeys

0 posts0 participants0 posts today
Replied to Karl Voit :emacs: :orgmode:
Public
ksp1968

@publicvoit @keno3003
Ich habe 2 FIDO2 HW-Token und bin davon begeistert. Für den durchschnittlichen Anwender gut geeignet. Sehr einfach anzuwenden. Schade das nicht viel mehr Anbieter davon Gebrauch machen.
Zum Vergleich: Mit TOTP bin ich gescheitert. Das ist aufwändiger, und wenn man nicht richtig weiß wie es geht, kann man sich leicht ausschließen (Backup Schlüssel bei Einrichtung sofort sichern nicht vergessen.)
#fido2 #token #passkeys #security

Continued thread
Public
Karl Voit :emacs: :orgmode:

@keno3003 (2/2) Der einzige Schutz dagegen ist, wenn man physische #FIDO2-Tokens verwendet ("device-bound passkeys" nur in der "roaming-authenticator"-Variante!), die das Auslesen des Geheimnisses prinzipiell ausschließen. Dies ist also die einzige wirklich Phishing-resistente Authentifizierungsmethode.

IMO sollten also die Tipps am Ende vom Video *mit Fokus auf Sicherheit* anders lauten:

- am besten 2 #FIDO2 HW-Tokens besorgen und für alle #Passkeys verwenden (für #IDAustria Österreich: oesterreich.gv.at/dam/jcr:972a)

- keine phishing-gefährdeten Fall-Back-Mechanismen verwenden: also nur den 2. FIDO2-Token

- jede 2FA ist besser als keine

- niemals Passwörter in die Cloud schicken (Cloud-PW-Manager)

HTH 🙇

#security#Sicherheit#Authentifizierungsmethoden
Public
Karl Voit :emacs: :orgmode:

@keno3003 ad "Das Problem mit Passkeys" youtube.com/watch?v=u7Ti-Jc-b3

Sorry, dass #Passkeys immer absolut resistent gegen #Phishing sind, stimmt leider nicht.

arxiv.org/abs/2501.07380
"Another concern could be social engineering, where a user is tricked into sharing a passkey with an account controlled by an attacker."

Meiner Interpretation nach ermöglicht also das Transferieren von Passkeys zu anderen Personen eindeutig Phishing-Methoden. Die sind vielleicht noch nicht in der Praxis aufgetaucht aber ausschließen kann man es keinesfalls.

(1/2)

YouTubeDas Problem mit Passkeys 🤔By c't 3003
Replied in thread
Public
Karl Voit :emacs: :orgmode:

@yacc143 FYI: #Passkeys and #FIDO2 (= "device-bound #passkey" which can be divided into "platform-" and "roaming-authenticators") are identical except the #cloud-sync mechanism (as of my current understanding).

So unfortunately, they get mixed up or are considered as totally different things. Both is wrong.

In reality, they are very similar except that FIDO2 hardware tokens ("device-bound passkeys" only in their "roaming-authenticator" variant) are designed that way, that Passkeys are not being able to extracted from the device (at least for the moment).

Therefore, users of HW tokens can't be tricked into transferring their passkey to a rogue third party, which is possible with all other Passkey variants. Therefore: passkeys are NOT #phishing-resistant in the general case.

#security#authentication#2FA
Public *
Karl Voit :emacs: :orgmode:

#TroyHunt fell for a #phishing attack on his mailinglist members: troyhunt.com/a-sneaky-phish-ju

Some of the ingredients: #Outlook and its habit of hiding important information from the user and missing #2FA which is phishing-resistant.

Use #FIDO2 with hardware tokens if possible (#Passkeys without FIDO2 HW tokens are NOT phishing-resistant due to the possibility of being able to trick users with credential transfers: arxiv.org/abs/2501.07380) and avoid Outlook (or #Microsoft) whenever possible.

Further learning: it could happen to the best of us! Don't be ashamed, try to minimize risks and be open about your mistakes.

Note: any 2FA is better than no 2FA at all.

Troy Hunt · A Sneaky Phish Just Grabbed my Mailchimp Mailing ListYou know when you're really jet lagged and really tired and the cogs in your head are just moving that little bit too slow? That's me right now, and the penny has just dropped that a Mailchimp phish has grabbed my credentials, logged into my account and exported the mailing
#email#malware#security
Public
Pixelcode 🇺🇦

Honestly, I don't really get the point of NFC-enabled FIDO2 tokens / hardware #Passkeys: Obviously, their NFC support is meant for phones, but to actually use the key, your phone's operating system must support #FIDO2 in the first place.

Instead of connecting your #NFC token, you could just as well use your phone's internal FIDO2 storage (usually biometrically secured). NFC is not even useful for ungoogled devices, as #MicroG also has internal FIDO2 support (which I use all the time).

Public
Karl Voit :emacs: :orgmode:

@technotenshi #Passkeys are not prone to #phishing according to my understanding of:
arxiv.org/abs/2501.07380

The paper describes that it's possible to fool Passkey owners to transfer their #Passkey to attackers: "Another concern could be social engineering, where a user is tricked into sharing a passkey with an account controlled by an attacker."

However, the authors disagree with my interpretation.

The only really secure method is hardware #FIDO2 tokens where the secrets can't leave the device.

arXiv.orgDevice-Bound vs. Synced Credentials: A Comparative Evaluation of Passkey AuthenticationWith passkeys, the FIDO Alliance introduces the ability to sync FIDO2 credentials across a user's devices through passkey providers. This aims to mitigate user concerns about losing their devices and promotes the shift toward password-less authentication. As a consequence, many major online services have adopted passkeys. However, credential syncing has also created a debate among experts about their security guarantees. In this paper, we categorize the different access levels of passkeys to show how syncing credentials impacts their security and availability. Moreover, we use the established framework from Bonneau et al.'s Quest to Replace Passwords and apply it to different types of device-bound and synced passkeys. By this, we reveal relevant differences, particularly in their usability and security, and show that the security of synced passkeys is mainly concentrated in the passkey provider. We further provide practical recommendations for end users, passkey providers, and relying parties.
Replied in thread
Public
Karl Voit :emacs: :orgmode:

@0xF21D Any more reason to switch to FIDO2 with hardware tokens or #Passkeys.

The latter only if you trust the service providers and if you don't need protection against phishing. With Passkeys and their optional delegation feature you can be tricked into transferring to a hacker. 😞

With a #FIDO2 hardware token, you're really safe.

Public *
Philip Gillißen

Because I found out via try & error: some pages don't find their #passkeys with #Firefox on #Android, which they just created. This happens if you have a password service as default like #Keepass2Android. Creation works though. Chrome just works.

Easy solution: setup Google wallet as your default password service, then switch to Keepass2Android again and add Wallet as additional service.

Do this via settings password, default password service

This should be a blog post.

Screenshot of Android settings for passwords, passkeys and accounts. Preferred service is set to Keepass2Android, below there's a button to edit this. Below there's a list of additional services, Google is selected there with a checkbox set to true.
#passkey#KeePass
ExploreLive feeds
About