• Big Tech has implemented passkeys in a way that locks users into their platforms rather than providing universal security
  • Passkeys were developed to replace passwords for better account security, but their rollout by Apple and Google has limited their potential
  • Proton Pass offers passkeys that are universal, easy to use, and available to everyone for improved online security and privacy.
  • plz1@lemmy.world
    link
    fedilink
    English
    arrow-up
    39
    arrow-down
    5
    ·
    7 months ago

    Yeah, Apple 2FA is infuriating, especially since you can do all factors from the same device. Kind of defeats the purpose of traditional 2FA/MFA. Also, companies that decide you 2FA experience has to use their app, instead of a standards-compliant TOTP app of your choosing…ugh.

    • WolfLink@lemmy.ml
      link
      fedilink
      English
      arrow-up
      32
      ·
      7 months ago

      Traditional 2FA (assuming you mean apps with codes) can be done from the same device (if you have the app with the codes installed on that device).

      It doesn’t defeat the purpose of 2FA. The 2 factors are 1. The password and 2. You are in possession of a device with the 2FA codes. The website doesn’t know about the device until you enter the code.

      • plz1@lemmy.world
        link
        fedilink
        English
        arrow-up
        3
        ·
        7 months ago

        Yeah my point is it does not protect the local device well. It does protect well from remote compromise though.

    • paraphrand@lemmy.world
      link
      fedilink
      English
      arrow-up
      18
      arrow-down
      2
      ·
      edit-2
      7 months ago

      If you think forcing everyone to carry an object other than their phone around so they can use 2factor on their phone is a good idea… Or if you said I need to go to my laptop when I’m logging in on my phone and vise versa… that’s nonsense too. Sure maybe some companies require this. But that’s different.

      Authy on my phone is just as “dumb” as Keychain on my phone.

      How else are you imagining this should work? Keep in mind normal people need to do it too.

      • plz1@lemmy.world
        link
        fedilink
        English
        arrow-up
        3
        ·
        7 months ago

        If I’m on my laptop, and the 2fa code shows on that same laptop, it defeats the purpose of it. The point is sortation of security privileges, ask this just adds more work while providing no less security to the device. It does protect you from remote compromise, though.

        • jkrtn@lemmy.ml
          link
          fedilink
          English
          arrow-up
          2
          arrow-down
          1
          ·
          7 months ago

          It doesn’t defeat the purpose of it, as you indicate, it can protect from remote attacks.

          • AA5B@lemmy.world
            link
            fedilink
            English
            arrow-up
            2
            ·
            7 months ago

            Also most or all of these should require some for of local authentication.

            For example I have 2fa apps on my phone, where I need to use them, so yes, that’s less than ideal. However

            • it protects against remote attacks
            • it protects against SIM attacks
            • and even if someone stole my phone and unlocked it, they’d still need my face id for every use
      • sudneo@lemm.ee
        link
        fedilink
        English
        arrow-up
        4
        arrow-down
        2
        ·
        7 months ago

        I bring my yubikey with me, it’s in my keychain. This is not only more secure against phone theft/access, which probably is not very relevant for most people, but it spreads the risk of locking yourself out.

        For example, I was in Iceland with my girlfriend and she “lost” her phone. We wanted to locate it, so I logged to Google for her, which asked 2FA. If she used her phone, she would have been toast. Instead I made her use yubikeys too, and she just logged in and found her phone.

        Obviously you can lose your hardware tokens too, but it’s generally less likely (you take out your home keys way less than your phone, for example). You can also backup your TOTP on multiple devices etc., of course.

      • AA5B@lemmy.world
        link
        fedilink
        English
        arrow-up
        1
        ·
        7 months ago

        For Apple, it’s your iCloud account that everything depends on, and it’s the weakest point. Not by itself maybe, but in practice there needs to be a way to reset your iCloud password, even without your phone. Currently I believe that’s just an Apple representative asking life questions, but that information is mostly publicly available. There needs to be a better way.

        A physical 2fa device may be just what we need to securely rest our iCloud passwords, keeping everything else more secure

    • 9point6@lemmy.world
      link
      fedilink
      English
      arrow-up
      5
      ·
      edit-2
      7 months ago

      The factors are:

      • Something you have
      • Something you are
      • Something you know

      Here the password is something you know and the device is something you have (typically also protected by something you are, like your fingerprint or face)

      Someone with your phone but no password or fingerprint is SOL. Someone with your password but not your phone also SOL