Jump in the discussion.

No email address required.

if your password is stored as plaintext, then you may as well have just messaged it to a hacker

:marseygi#garetard:

Jump in the discussion.

No email address required.

Davey Winder is a veteran cybersecurity writer, hacker and analyst.

Jump in the discussion.

No email address required.

I know. He saved his resume in plaintext. He may as well have emailed it to me.

Jump in the discussion.

No email address required.

The safest place to keep your passwords are on post it notes around your monitor in a home office. You are not being targeted and no one is sneaking into your house for your passwords.

Jump in the discussion.

No email address required.

Sounds like copy you'd hear read on a podcast sponsorship slot

Jump in the discussion.

No email address required.

I don't know what this is, I'm not reading it, I just know that I just plain don't like it!

https://media.tenor.com/DGVx4gZzXsQAAAAx/ren-and-stimpy-horse.webp

Jump in the discussion.

No email address required.

Tl; dr: passkeys are a public-private key cryptographic way to authenticate a user, rather than shared secret (the password).

Everyone gets so caught up pushing the "just use a PIN, it's more secure!" line that it sounds like bullshit with an ulterior motive. But, it's a good idea if done right.

Jump in the discussion.

No email address required.

So today Chrome is using encrypted sqlite databases to store session and separately passwords. These are encrypted with keys provided by the Windows system itself and in some of the things I've done I've needed to decrypt them. It's not hard to get the information you need from Windows to do so. At least keeping the passkey in your mind is fairly secure

Jump in the discussion.

No email address required.

Does their implementation just rely on windows, and not have some kind of master password you remember? Because if so, that's r-slurred.

Authentication relying on 2 or more of "something you know", "something you have", and "something you are" is considered good. If you reduce it to just one, and pick "something you have", that's terrible.

Jump in the discussion.

No email address required.

https://i.rdrama.net/images/17270383725592525.webp

Here's how you would decrypt it with .net and no user involvement have fun

!codecels

Jump in the discussion.

No email address required.

is there an equivalent for macos?

Jump in the discussion.

No email address required.

Mebbe, idk how chrome encrypts stuff on mac they might not bother

Jump in the discussion.

No email address required.

looks like macos is yet again a little more secure:

https://medium.com/@stevemarkperry/how-chrome-stores-your-passwords-windows-macos-and-why-you-still-shouldnt-let-it-de3774886733

i kind of hate apple, but the computers are just better.

Jump in the discussion.

No email address required.

hope ur granny doesn't reuse that super secure master password anywhere else

Jump in the discussion.

No email address required.

That's why you pair it with "something you have" and "something you are"

Jump in the discussion.

No email address required.

99% of people find whatever 5 stage auth thing u have in mind tedious and will ignore or abuse it

Jump in the discussion.

No email address required.

Step 1: sign into password manager

Jump in the discussion.

No email address required.

becomes step 1: enter password123 that u use everywhere else

Jump in the discussion.

No email address required.

I have: this password

I am: the person who has this password

Jump in the discussion.

No email address required.

>that's terrible

for some things it's perfectly adequate. You wouldn't save your cookies or sessions on an untrusted computer anyways.

Remembering passwords is a real hassle and should only be demanded when it's worth it.

Jump in the discussion.

No email address required.

Passkeys are simply a token signed by a hardware key (TPM in Windows). There is nothing to decrypt and nothing to exfiltrate.

It's effectively federated authentication. You authenticate to your machine and that is trusted for authentication with the sites you visit, they just need the PK.

If you want a more secure version then you get a yubikey. You are not using a key, even if encoded in a readable format like PEM, the private key is ~450 characters of b64.

Jump in the discussion.

No email address required.

These are encrypted with keys provided by the Windows system itself

I'm assuming you mean in the default state and not when using the sync passphrase setting

Jump in the discussion.

No email address required.

Im willing to bet its crappy enough i can grab it.

Jump in the discussion.

No email address required.

they want to use no passwords a passkey like ur face

Jump in the discussion.

No email address required.

Your face isn't the passkey itself, your face unlocks access to a private key, and that is the passkey.

Jump in the discussion.

No email address required.

no it's not ur face it's this other thing that you unlock by usin only ur face

:marseyshitforbrain#s:

Jump in the discussion.

No email address required.

My face!?!?!?!??!?!?

:#marseyragingtalking:

Jump in the discussion.

No email address required.

The final answer is The Mark

Jump in the discussion.

No email address required.

*CALL THE POLIIIICCCCEEEE!!!"

Jump in the discussion.

No email address required.

Hello, police? Hi, yes, it's Marsey again...

:#marseygossipsmugtalking:

Jump in the discussion.

No email address required.

Passkeys are way more difficult to export than passwords, if you can at all. It's great for Google and Apple, because it locks you in (no site in their right mind allows you to switch back to passwords). Coal.

Jump in the discussion.

No email address required.

Don't forget that Google has the right to terminate your account at any time for any reason, hope you have an alternate way to login if that happens :pepehackergenocide#:

Jump in the discussion.

No email address required.

I lost access to a site because I used twitter to login to it and I tweeted learn2code at a journo

Jump in the discussion.

No email address required.

if google decided to ruin my life, the amount of fricked i would be is indescribable.

Jump in the discussion.

No email address required.

Are sites able to certify the origin of a passkey? This is mostly not a problem if you can use your own software to manage passkeys, but if banks will reject my (exportable) keepass passkeys, I'll be pissed.

That said, even pro-consumer software gets BIPOClicious sometimes. Firefox conforms to the spec of HSTS and doesn't allow you to skip malformed certificates, not even via about config.

Jump in the discussion.

No email address required.

Are sites able to certify the origin of a passkey?

how would they? it's just basic public/private key crypto, unless there was a massive effort to distribute hardware universally that stored keys baked from the manufacturer, and that hardware was known to be tied to you?... then the signing can be done anywhere by whoever has the private key. so no.

these algos certify the key itself, nothing more than that.

Jump in the discussion.

No email address required.

I see, I remember some person who seems to be involved with passkeys in some form vaguely threatening that this will get keepassxc blocked

https://github.com/keepassxreboot/keepassxc/issues/10407

https://github.com/keepassxreboot/keepassxc/issues/10406

But I've doublechecked and the devs concluded that the current spec doesn't allow blocking since they can just spoof the self-reported id. The passkey-guy then threatened that the spec can be changed...

Jump in the discussion.

No email address required.

well it's not an algo limitation, that would be an implementation choice.

at the end of the day, the algos can only inherently verify a key cause it's the key that's mathematically used to prove identity.

the things aren't really more "secure" in proving identity than a good password. the remove a bunch of human stupidity from the process, like picking a weak password, or manually entering it in the wrong place, or a weak password transport mechanism, and things of that nature. so the protocol details itself are inherently more secure, and that is a clear and significant improvement... but it's still proving the key not necessarily the person who at present has the key, so the quality of proof is roughly the same.

to build some kind of better quality identity proof u would need to be able to run some kind of algorithm based on a person's biological property. and this would need to be done without translating this data to binary before running the proof, as that could considered a key that could be stolen. it would need to somehow physically operate off the biological property itself. i'm not sure that's really possible.

Jump in the discussion.

No email address required.

I use 1password and various browsers refuse to look there for my passkeys so I stopped trying to use them

Jump in the discussion.

No email address required.

the tech is still very young, in 10 years this will "just work".

Jump in the discussion.

No email address required.

The six months between that moment and quantum computers making all cryptography obsolete is gonna be so cozy

Jump in the discussion.

No email address required.

yeah but you can approve self-signed certs

Jump in the discussion.

No email address required.

i mean it's just public/private key crypto. if they can sync it between computers, which google does, then it can be exported. the key itself is just a byte string...

Jump in the discussion.

No email address required.

"All you have to do is scan in your fingerprint!"

No, I don't think I'm interested in handing over my biometric data to a megacorporation that would happily sell me for parts if it got the chance, thanks all the same.

Jump in the discussion.

No email address required.

Dont worry they already have it

Jump in the discussion.

No email address required.

govt required me giving it multiple times. govt probably leaked it. probably even intentionally.

Jump in the discussion.

No email address required.

>Once a passkey has been saved, no matter which device you used to do so, it will then automatically sync across your other devices so as to make signing in to any account or service just a matter of scanning your fingerprint, Desai announced.

https://media.tenor.com/GJcxtV5-NdsAAAAx/what-tate.webp

https://media.tenor.com/QjY8jOBlx98AAAAx/tom-hanks-snl.webp

Jump in the discussion.

No email address required.

I keep some passwords in Notepad on my desktop cuz I'm too lazy to get it from my password vault every day. Me when the hackers come to get me.

https://media.tenor.com/7l3MmoXeZN4AAAAx/thrusting-humping.webp


Krayon sexually assaulted his sister. https://i.rdrama.net/images/17118241526738973.webp https://i.rdrama.net/images/17118241426254768.webp https://i.rdrama.net/images/17156480765435808.webp

Jump in the discussion.

No email address required.

Good luck finding it amongst my porn! :killherkillher: :marseyfuckyou:

Jump in the discussion.

No email address required.

Hmm

It's in the fatties folder

Isn't it

Jump in the discussion.

No email address required.

>chrome

Skill issue :tayshrug:

Jump in the discussion.

No email address required.

Swapped to brave then arc because of mv3, but having adblock on my iphone (rather than relying on a dns blocker) is really nice

Jump in the discussion.

No email address required.

>then arc

did you see the news where they have a massive vulnerabilty because they just did not implement any sort of authentication? Why would you ever use this

Jump in the discussion.

No email address required.

I like the fullscreen user experience, but that seems pretty bad, might go back to brave then

Jump in the discussion.

No email address required.

Chrome only browser worth using CUTE TWINK

Arc, Firefox, every other blows peepee

Jump in the discussion.

No email address required.

Enjoy ur ads :marseysmug2:

Jump in the discussion.

No email address required.

Jump in the discussion.

No email address required.

Passphrases. Something like "This is the password I use to login to company intranet 12" including the spaces. Un crackable.

Jump in the discussion.

No email address required.

Correct horse battery staple

Jump in the discussion.

No email address required.

Link copied to clipboard
Action successful!
Error, please refresh the page and try again.