Comment by torstenvl
1 month ago
> Lockout is a real risk, but there is nothing insecure about passkeys.
secure - adjective
se· cure si-ˈkyu̇r -ˈkyər
securer; securest
1
a: free from danger
b: affording safety (a secure hideaway)
c: TRUSTWORTHY, DEPENDABLE (a secure foundation)
d: free from risk of loss
Passkeys as a sole/required method of authentication increase the risk of permanent loss. In any other configuration they do not mitigate phishing risk.
It is not possible to say there is nothing insecure about them.
Reliability != security
If a car breaks down every 50 miles we would call it unreliable. If a car’s doors don’t lock we would call it insecure.
Information security has the concept of the CIA triad: Confidentially, Integrity, and Availability.
Being able to access the secured data is an essential element of security, otherwise a safe encased in concrete dropped to the bottom of the ocean would be the most secure storage available.
Pro tip: if your substantive argument requires gaslighting people about the literal definitions of words, maybe you should take a step back.
> gaslighting
That is some serious semantic bleaching!
I’m not disputing the fact that “secure” has different meanings in different contexts. My point is that when we talk about the “security” of authentication methods, we almost always are referring to its resistance to attacks, exploits, social engineering, etc.
If you tell the average non-technical person that “passkeys are insecure,” they’ll think that it’s easier for (WLOG) Russian hackers to phish or bypass their way through some website’s passkey requirement.
And to be clear, I don’t think it’s ridiculous to say that right now, the risk of lockouts outweighs the security benefits of passkeys. But this is a fixable problem. If it gets easier to securely recover or back up passkeys, I think we can reach what is more clearly a “best of both worlds” of security and reliability.
3 replies →