kdklol

I couldn't be so cold as to give Graphene to my grandmother. That said, I am writing this from Graphene myself, having never touched an Apple device in my life.

They arguably never did. Android updates are all-encompassing, unlike Windows. You still depend on manufacturers of your hardware (motherboard, CPU) to provide firmware updates (BIOS, Microcode). How old is your Motherboard's firmware? You probably don't even know, because most people don't consider these things important, which is a mistake. On Android, generally, firmware updates are included.

They do have extra 2 years of partial "transitional" support, if I'm not mistaken. But yes, even they will not support them forever as it's not financially feasible without help in the form of first-party updates.

Not quite true, many popular services do have it. Especially the big ones.

The thing is, I was mentioning DNSSEC as a "full disclosure". Any attack enabled by non-validated DNSSEC on passkey applies to any other form of verification too. I just wanted to make sure I'm not overselling the technology, it's not a silver bullet, but it's orders of magnitude better than anything else.

I think this sort of argument misses the point of my comment. I really don't want to write serious software with Perl, I want something more powerfull than AWK, but not as cumbersome as a more "structured" language. I literally use AWK daily for random stuff I'm most likely gonna throw away or put it in a script which I'm gonna throw away happily the moment it breaks. Sometimes, AWK is not enough, and for these usecases, in my short expirience, Perl is unmached.

Thank you everyone in this thread for suggestions.

I personally learn by practice. Writing stuff. I've read good things about the "Modern Perl" but I'll check out Conway if people here are vouching for it. Also, Perl's manpages actually teach you the language - another advantage of an older language from a time when people knew what manpages were and how to write them. They're not OpenBSD quality, but they're pretty good from my experience.

The author released another "follow-up" article today: https://www.hezmatt.org/~mpalmer/blog/2023/06/12/private-key...

Can confirm, recently written scripts require modification pretty much every minor version. Take the limit on the default size of BigInts now. Why? Just... why? I had to look into every script add the override line at the top (or check the entire script it ever assumes unlimited BigInt anywhere). No wonder there are still Python 2 scripts in use.

I discovered Perl basically by accident. For scripting/systems administration its simply unmatched. It's been clearly designed for speed and utility which is what I always wanted and I'm a bit disappointed nobody ever mentioned it to me. I'm 20-something btw, so it's not just ravings of an old man. I think the catastrophe happened when people mistook this it for a backend development language... and it somehow worked. Not well, but it did, which is it's own quality. I slowly started learning it half a year ago and it's been really useful for scripts. It's indeed more robust than POSIX shell which tends to have baked in assumptions about the system which may not transfer well onto different platforms. No regrets - the grey beards were right!

>Aren't the keys device specific so you need to generate new keys on a new device? It's being touted as a security feature

Yes, the keys are device specific. This is a feature and the reason why it's more secure. If it could be backed up (exfiltrated), it would not protect you in case your device is compromised, which is one of the design goals. You could probably work around this by using an emulated key (which is what Apple does I think?), but that would obviously eliminate this key security feature.

> I'm guesstimating that at 1 hour of the user clicking through various interfaces.

I see, sorry, I missunderstood.

Again, it's just like changing a password or a TOTP secret. Unfortunatelly, no standard can fix bad UX design, but I sympathize. Silver lining is that even cheaper hardware keys are built like a tank, and software is... well... software.

> my concern is passkeys are adding too many dependencies on devices/providers.

Which is reasonable. The question is, is the dependency worth the security benefit? It seems many major device makers/service providers think so.

> Giving me a list of possible devices/providers does not address my concern.

Well, I can't do anything about that, can I? Nor can anyone else.

I think this is, again, a question of priority. TLS is now essentially a dependency for using the web at large, but it wasn't in the 90s. I'm sure that is of concearn to some people, but most agree it's a net benefit.

>What will work driverlessly?

WebAuthn. So, registration and authentization. I'm not exactly sure if which standard deals with changing PIN, but it worked everywhere I tried it out of the box.

>OMG did you say CHROME??!!!

Yes, how dare I... It was an example. I don't use Chrome either, but not many people do use other stuff, so that's why I mentioned Chrome specifically.

Currently, the support is best in Chrome and some other Chromium-based browsers. I personally tried Brave, which worked flawlessly everywhere. Firefox (which I personally use) works with standard WebAuthn, but some big players (Google) seem to have older implementations predating the standard, so it doesn't work with some clients (Firefox) yet. I've watched a conference some time ago where they said they're working on it™.

If you want to know how exactly it stuff works, Mozilla has a nice and easy to comprehend description on their developer site. It's one search away (in your preffered search engine).

>The generating of new keys that still will take an hour?

Are you trolling? No. Also, only nonces are generated for each new _credential_, so you don't need to store so much data on the key. You should be more worried about how long it will take to do the authentization exchange, which takes under a second from my experience.

Please just read the Mozilla website.

I understand. In that case I still think it's a bit of an understatement to call it a password, since especially inexpirienced users are more vulnerable to phishing, and this does protect against it, unlike a long password (even paired with other MFA methods!) Also there's nothing to remember or to install, so again, more normie-friendly. Sorry if I came of as too agressive, maybe I should've put in some smiley faceses too :)

I knew I should've explained myself in more detail. Sorry.

>Basically you need to trust more vendors of security solutions than before

Yes and no. You may have to trust the vendor of your hardware key, or you can get one that has open source firmware, like NitroKey.

Regarding the number of trusted parties - it depends. To have a account that use passwords, you must trust them to handle your password well. You can mitigate this trust need somewhat by using a password manager and strictly using unique passwords (and ideally usernames and emails too!), but this now requires trust in your password manager. Again, OSS solutions like BitWarden, KeePass and pass make this less of an issue. My point is, if you are handleing your passwords well (ie you are using a password manager), you are not really required to trust more parties, only change which ones. Furthermore, WebAuthn is stabdardized, so unlike with password managers, there's less room for "creative" programmers to make mistakes (like lastpass did).

Regarding DNS security,

I meant that highjacking a company's domain, be it trough compromising their account with their registrar or by non-validated or even non-existant DNSSEC can enable attacks. This is true of other forms of identifocatin though. I just want to be fair and not oversell this tech as a silver bullet. If all things are done right however (like they must be with other forms of id.), this does significantly increase security.

>borrow your friend's laptop for 5 min to check your email any more

In general, no. Assuming they run a reasonably recent version of Chrome and Windows/Linux/Android* (I don't have apple so idk), it will work driverlessly.

You may be surprised to know this, but it's fundamentally a fairly old technology at this point. Hardware keys have been supported in some capacity by systems for over 10 years now, and WebAuthn essentially just standardised what was already there. It was a fairly easy adjustment. At this point in time, I don't know of any hardware key being sold that does not support this nor any common OS (again, besides Apple stuff, they should supported but I cannot test it.)

*Ah, yes, Android is a wierd one. Technically it's not yet in android, but it's been in the Google Play services for years now. But thechnically, there are android devices without those (like mine).

No, it's not "just a long password". Here are the main benefits not mentioned, which a password cannot offer, regardless of how securely it is stored: - Phishing protection - passkey credential will be uniquely bound to a domain, so you cannot be phished - Keys cannot be exfiltrated from the hardware, so even if your password manager is compromised, your key would still protect you - Duplication protection - synced counters are stored on both the key and the server, so even if somebody does clone your key (very difficult), you'll know about it (unlike passwords)

Obviously, there are some necessary assumptions made, about security of the passkey implementation, DNS security and so on.

>if you are not already doing this, then it requires adaptation What doesn't?

>ironing out account recovery for the account the vault is associated with Agreed. This is currently the weakest point in web security in general.

I'd also like to mention (for everyone else reading this) that a unique set of credentials is generated per account, so this cannot be used to track you. Also, it's an open standard and open imolementations exist. It is bot reliant on google/yubico/"big tech". They're pushing it because it works.

There are other options though Couldn't a health insurence company make an app? Or do SSO trough google and such? Webauthn is really easy!

Controversial opinion: If you are given all these options and you cannot/refuse to use them, you shouldn't manage your insurrance trough the web. Either you are wholly computer-illiterate, deeply misinformed or you are not educated enough to use it safely.

Of course, the main issue is that companies only give SMS 2FA as an option, or only one other, like the App method, which forces users without phones to fall back to SMS. Worst part is that especially financial institutions are guilty of this.

This. This is the only thing that actually solves all warts of authentication nowadays. Companies really should switch to a webauthn-first mindset. The technology has been here for over a decade, it's not new. There is a standrad and a library for every language, it's not hard. FIDO2 keys start at 20 bucks and every android phone can act as one, it's not expensive. They are literally the only thing that can actually protect you from phishing and they generate new login creds per domain, protecting your privacy. Companies, support webauthn!

This. It's so valuable just to know how exposed you may be. I know a guy who missed a data leak and later got one of his accounts stolen. I think his Steam? It was way back in the day... For him, it was a cheap reminder to take passwords hygiene seriously. For someone else, it could have been a someone-took-out-a-line-of-credit-in-my-name reminder.

My BW stands at 52 logins right now, but it's not yet quite complete. I think I'm missing a couple banks. Over the last year or so however, I cancelled almost 100 accounts, ranging from obscure forums, trough hosting providers, to facebook. It was a herculian effort, as companies put up emmense barriers (especially the hosting companies), but I somehow got it to the minimum I can realistically have - which is roughly 60 I think.

I try to avoid SSO, only exceptions are a single forum, which had broken registration, and my uni. Why? 1. SSO is a single point of failure, which you (unlike BW) cannot audit yourself; 2. You have to trust it's not gonna sell your data - perfect graph of services one person has is of course very juicy information; 3. They the make management of one's accounts slightly harder, as you cannot easily know how many you have by looking into your BW; 4. You are locked into your SSO service.

For MFA, I use fido keys (yubikeys), which I have to highly, highly recommend. Not only are they miles ahead of anything else, but they are also so easy and quick to use. I have a little one permanently in my usb port and to log in you just touch it. I'd recommend this if you are MFA-fatigued. Obviously, I always take the best form of 2FA available regardless.

All passwords in BW are long random alphanumeric and I have a XKCD-style password for that and something similar for FDE/logins into computers.

BTW, getting BW was the best decision I could have made, not really for security (although that's obviously the point) but fkr convinience. No more silly variants on passwords and no more guessing emails for reset.

Mainly familiarity I'd say. Realise that as early as ENIAC we've used accumulator-based ALU architecture, whereas the first Forth chips started coming out in the eighties. It's hard to overcome such momentum, even if the alternatives have some advantages.

Vaguely related: https://users.ece.cmu.edu/~koopman/stack_computers/index.htm...