Comment by dewey

7 days ago

Opinion from someone who's working on Passkeys at Apple and is very open and transparent about his work there (For many years already), which is rare for someone working at Apple. This makes me appreciate this much more.

https://mastodon.social/@rmondello@hachyderm.io/117428259125...

7 comments

dewey

Reply
kccqzy  7 days ago

I follow this person on Mastodon. They are a known advocate of passkeys. Working on the same thing for many years can certainly cloud one’s judgement. Here are their three points and my opinion:

> 1. Intentionally presenting things that are complicated as inherently suspicious. (Delivering security by design can be complicated, yes!)

This is a matter of opinion. Personally I think making a technology understandable is more important than incomprehensible but secure.

> 2. Describing TOTP as a “great solution” for adding security to a password-based account. When the most common threat model on the web is phishing (a word the post never mentions!), TOTP hardly buys you _anything_. TOTP is phishable.

Phishing isn’t a big threat to regular consumers. It’s a bigger threat to workers at corporations and government agencies. These places have IT departments. They have better solutions than passkeys, including using a Yubikey as a second factor. It may be based on WebAuthn but it’s not a passkey.

> 3. Seeming to be unbothered by how many logical leaps are being taken without actually understanding the topic being discussed.

Why are the logical leaps? I don’t see any. What I see is clearly delineated hypotheses for future scenarios. We can’t predict the future but the original author is predicting a particularly dire future, whereas rmondello is predicting a better future.

  • dewey  7 days ago

    > Phishing isn’t a big threat to regular consumers.

    Can you back that up with data? Anecdotally regular people get phished all the time, why do you think banks are sending out frequent reminders, show banners on their websites and apps about phishing attempts in the wild and mail providers explicitly showing if something is an official Google / Fastmail communication and when it's not.

    When I see phishing mail they are always for banking, Google / iCloud accounts and not specifically targeted at "corporate" or government agencies.

    • kccqzy  7 days ago

      You are describing a wider phenomenon better known as scams or social engineering, of which phishing is a subset. Phishing is defined as tricking the users into giving up their passwords. Passkeys by definition make phishing disappear because there is nothing to give up.

      Banks are sending out frequent reminders because scammers are still out there. They pretend to be banks. But they don’t ask for your password anymore. They scare you into action to buy them a gift card. They tell you the IRS is coming after you or the bank is going to wire out all your money unless you listen to them. They tell you your computer is infected with a virus that will steal money unless you copy-paste a special command to kill the virus inside Windows Run. That’s not phishing. That’s not a problem solvable by passkeys.

      1 reply →

coldpie  7 days ago

This is a pretty unconvincing argument. It's just one guy saying "trust me, no one will abuse this." It's especially unconvincing when you've got this other Passkey dev directly contradicting it:

> To be very honest here, you risk having KeePassXC blocked by relying parties. ... I've already heard rumblings that KeepassXC is likely to be featured in a few industry presentations that highlight security challenges with passkey providers, the need for functional and security certification, and the lack of identifying passkey provider attestation (which would allow RPs to block you, and something that I have previously rallied against but rethinking as of late because of these situations).

https://github.com/keepassxreboot/keepassxc/issues/10407#iss...

They need to remove attestation from the spec. Instead of promising no one will ever use it, just get rid of it and solve the problem.

Melatonic  7 days ago

What about Apple implementing TOTP codes sent via Apple Business messages (basically iMessage) but open the protocol to more devices ? Don't need to give everyone blue bubbles - just do it for TOTP codes only.

You could make it purple