top | item 47191920

(no title)

cedws | 1 day ago

There’s another foot gun I wrote about recently:

https://cedwards.xyz/passkeys-are-not-2fa/

discuss

order

dwedge|1 day ago

I was reading your other blog post about storing them in bitwarden I have to disagree with this point:

> Unless you were forced to by some organisational policy, there’s no point setting up 2FA only to reduce the effective security to 1FA because of convenience features.

2FA both stored in your password manager is less secure than storing than separately, but it still offers security compared to a single factor. The attack methods you mentioned (RAT, keylogger) require your device to be compromised, and if your device is not compromised 2fa will help you.

To slip into opinion mode, I consider my password manager being compromised to be mostly total compromise anyway.

Also I really like the style and font of your blog.

TacticalCoder|1 day ago

> To slip into opinion mode, I consider my password manager being compromised to be mostly total compromise anyway.

But how is that no the entire point? If your 2FA is a proper device, like a Yubikey, the attack surface is tinier than tiny and the device ensures that your secret never leaves the device.

We did see cases of passwords managers getting compromised. We haven't seen yet a secret being extracted from a Yubikey.

So where you say you consider that your software (password manager) getting compromised is total compromise, we're saying: "as long as the HSM on a Yubikey does its job, we have actual 2FA and there cannot be a total compromise".

JasonADrury|1 day ago

This isn't a footgun, you just have absurd security requirements.

>It should be pretty obvious that using a passkey, which lives in the same password manager as your main sign-in password/passkey is not two factors. Setting it up like this would be pointless.

You simply do not need two factors with passkeys. Using passkeys is not pointless, they are vastly more secure than most combined password+2fa solutions.

There are extremely few contexts where an yubikey would be meaningfully safer than the secure element in your macbook.

gregoriol|1 day ago

2FA is more secure than 1FA even if that one has a high security level

YmiYugy|1 day ago

How is it not 2FA? It's MacBook + Fingerprint.

cedws|19 hours ago

You missed this:

>which lives in the same password manager

I'm not talking about Apple passkeys here, which are NOT stored in the Secure Element to my knowledge anyway.

I don't see passkeys as a 2FA replacement. If they're only secured in software and live in memory, as is often the case with password managers, they're too easy to compromise.

lxgr|1 day ago

> It should be pretty obvious that using a passkey, which lives in the same password manager as your main sign-in password/passkey is not two factors. Setting it up like this would be pointless.

If your password manager is itself protected by two factors, I'd still call this two-factor authentication.

FreakLegion|1 day ago

Passkeys are meant to replace passwords. Not being second factors is the point.

lxgr|1 day ago

Passkeys can absolutely constitute two factors. At least the iOS and Android default implementations back user verification (which the website/relying party can explicitly request) with biometric authentication, which together with device possession makes them two factor.

embedding-shape|1 day ago

Someone gotta tell all these SaaS about that if so, because currently everyone is treating Passkeys as an alternative to 2FA. Take a look at how GitHub handles it for example when you use TOTP, they'll ask you to replace TOTP with passkeys.