Comment by kccqzy
7 days ago
I follow this person on Mastodon. They are a known advocate of passkeys. Working on the same thing for many years can certainly cloud one’s judgement. Here are their three points and my opinion:
> 1. Intentionally presenting things that are complicated as inherently suspicious. (Delivering security by design can be complicated, yes!)
This is a matter of opinion. Personally I think making a technology understandable is more important than incomprehensible but secure.
> 2. Describing TOTP as a “great solution” for adding security to a password-based account. When the most common threat model on the web is phishing (a word the post never mentions!), TOTP hardly buys you _anything_. TOTP is phishable.
Phishing isn’t a big threat to regular consumers. It’s a bigger threat to workers at corporations and government agencies. These places have IT departments. They have better solutions than passkeys, including using a Yubikey as a second factor. It may be based on WebAuthn but it’s not a passkey.
> 3. Seeming to be unbothered by how many logical leaps are being taken without actually understanding the topic being discussed.
Why are the logical leaps? I don’t see any. What I see is clearly delineated hypotheses for future scenarios. We can’t predict the future but the original author is predicting a particularly dire future, whereas rmondello is predicting a better future.
> Phishing isn’t a big threat to regular consumers.
Can you back that up with data? Anecdotally regular people get phished all the time, why do you think banks are sending out frequent reminders, show banners on their websites and apps about phishing attempts in the wild and mail providers explicitly showing if something is an official Google / Fastmail communication and when it's not.
When I see phishing mail they are always for banking, Google / iCloud accounts and not specifically targeted at "corporate" or government agencies.
You are describing a wider phenomenon better known as scams or social engineering, of which phishing is a subset. Phishing is defined as tricking the users into giving up their passwords. Passkeys by definition make phishing disappear because there is nothing to give up.
Banks are sending out frequent reminders because scammers are still out there. They pretend to be banks. But they don’t ask for your password anymore. They scare you into action to buy them a gift card. They tell you the IRS is coming after you or the bank is going to wire out all your money unless you listen to them. They tell you your computer is infected with a virus that will steal money unless you copy-paste a special command to kill the virus inside Windows Run. That’s not phishing. That’s not a problem solvable by passkeys.
> But they don’t ask for your password anymore.
Just because you haven't seen it, doesn't mean it's not happening. I'm getting a monthly email from my brokerage (IKBR) that literally says phishing:
> Our clients have seen a wave of “phishing” attempts in which scammers are impersonating Interactive Brokers. They send requests—sometimes by text, sometimes by email—for urgent updates of client information (often tax or other key information) and include login links pointing to websites that appear legitimate but are actually fake websites. If you click those links, you may inadvertently give bad actors access to your account.