https://mastodon.social/@rmondello@hachyderm.io/117428259125...
> 1. Intentionally presenting things that are complicated as inherently suspicious. (Delivering security by design can be complicated, yes!)
This is a matter of opinion. Personally I think making a technology understandable is more important than incomprehensible but secure.
> 2. Describing TOTP as a “great solution” for adding security to a password-based account. When the most common threat model on the web is phishing (a word the post never mentions!), TOTP hardly buys you _anything_. TOTP is phishable.
Phishing isn’t a big threat to regular consumers. It’s a bigger threat to workers at corporations and government agencies. These places have IT departments. They have better solutions than passkeys, including using a Yubikey as a second factor. It may be based on WebAuthn but it’s not a passkey.
> 3. Seeming to be unbothered by how many logical leaps are being taken without actually understanding the topic being discussed.
Why are the logical leaps? I don’t see any. What I see is clearly delineated hypotheses for future scenarios. We can’t predict the future but the original author is predicting a particularly dire future, whereas rmondello is predicting a better future.
Can you back that up with data? Anecdotally regular people get phished all the time, why do you think banks are sending out frequent reminders, show banners on their websites and apps about phishing attempts in the wild and mail providers explicitly showing if something is an official Google / Fastmail communication and when it's not.
When I see phishing mail they are always for banking, Google / iCloud accounts and not specifically targeted at "corporate" or government agencies.
Banks are sending out frequent reminders because scammers are still out there. They pretend to be banks. But they don’t ask for your password anymore. They scare you into action to buy them a gift card. They tell you the IRS is coming after you or the bank is going to wire out all your money unless you listen to them. They tell you your computer is infected with a virus that will steal money unless you copy-paste a special command to kill the virus inside Windows Run. That’s not phishing. That’s not a problem solvable by passkeys.
Just because you haven't seen it, doesn't mean it's not happening. I'm getting a monthly email from my brokerage (IKBR) that literally says phishing:
> Our clients have seen a wave of “phishing” attempts in which scammers are impersonating Interactive Brokers. They send requests—sometimes by text, sometimes by email—for urgent updates of client information (often tax or other key information) and include login links pointing to websites that appear legitimate but are actually fake websites. If you click those links, you may inadvertently give bad actors access to your account.
> To be very honest here, you risk having KeePassXC blocked by relying parties. ... I've already heard rumblings that KeepassXC is likely to be featured in a few industry presentations that highlight security challenges with passkey providers, the need for functional and security certification, and the lack of identifying passkey provider attestation (which would allow RPs to block you, and something that I have previously rallied against but rethinking as of late because of these situations).
https://github.com/keepassxreboot/keepassxc/issues/10407#iss...
They need to remove attestation from the spec. Instead of promising no one will ever use it, just get rid of it and solve the problem.
You could make it purple