Comment by grebc
8 days ago
Why is your grandpa or fictional billions users being MITM’d?
Passkeys are an end run on general purpose hardware largely under your own control, which is a much bigger issue in scale than dealing with customers who can’t access the services they pay for because of some byzantine security or know your customer laws/procedures.
There is a reason that banks send increasingly strident text messages that they will never ask for this code.
And then undermine that effort by actually asking for that code anyway.
And then undermine that effort by then sending you an official survey or marketing link to secure.bigbank.my.app
1 reply →
For their bank accounts, search tech support scam on youtube to see how that goes. Btw passkeys do nothing to stop this, they probably make it easier since grandpa doesn't have to search for a password or unlock a password manager to send his money to the scammers.
Convincing someone to log in to their bank and send you money is strictly harder than convincing someone to log in to their bank.
There is a middle ground where people are convinced to download a trojan and click ok once.
8 replies →
Why are they being MITM'd? Because some people want money and don't mind breaking laws.
Seems to me that the institutions of the FIDO alliance would have better luck chasing these people that break laws.
Instead we’re increasingly locked out of devices we buy and told/mandated this is how you’ll use them.
You want corporations to get more into law enforcement? These things are already crimes, law enforcement agencies already go after them. Would I like more public funding for that? Absolutely. When we've solved crime then let's go back to using passwords, or even just usernames at that point, after all no one will hack them.
1 reply →
"Just solve crime, bro" is certainly one approach to computer security.