Conversation

Notices

1. Embed this notice
   Michael W Lucas :flan_on_fire: (mwl@io.mwl.io)'s status on Thursday, 17-Oct-2024 23:45:23 JST Michael W Lucas :flan_on_fire:

   Hacker friends:

   Am I correct in thinking passkeys replace "something you know" with something you have," or am I missing something here?

   • silverwizard likes this.
   • Embed this notice
     silverwizard (silverwizard@convenient.email)'s status on Thursday, 17-Oct-2024 23:45:22 JST silverwizard

     in reply to
     @mwl As I understand it - they replace "something you know" with "something in your password manager" or "something you store on a USB device" which they are hoping is the same as "something you have", and I really don't think it counts.
   • Embed this notice
     silverwizard (silverwizard@convenient.email)'s status on Friday, 18-Oct-2024 02:00:24 JST silverwizard

     in reply to

     • Kitty Wife Milkshake (migrating from corteximplant.com)
     @marta @mwl So there's no keys stored on the USB? They just appear out of the aether?
   • Embed this notice
     Kitty Wife Milkshake (migrating from corteximplant.com) (marta@corteximplant.net)'s status on Friday, 18-Oct-2024 02:00:25 JST Kitty Wife Milkshake (migrating from corteximplant.com)

     in reply to

     • silverwizard
     @silverwizard @mwl its not something you store on a USB device, the USB device does a cryptographic computation every time it's used so the device is actually something you have. It's not a file.
   • Embed this notice
     silverwizard (silverwizard@convenient.email)'s status on Friday, 18-Oct-2024 02:10:11 JST silverwizard

     in reply to

     • Kitty Wife Milkshake (migrating from corteximplant.com)
     @marta @mwl yeah - something you have is just a weird concept because it's all keys
   • Embed this notice
     Kitty Wife Milkshake (migrating from corteximplant.com) (marta@corteximplant.net)'s status on Friday, 18-Oct-2024 02:10:12 JST Kitty Wife Milkshake (migrating from corteximplant.com)

     in reply to

     • silverwizard
     @silverwizard @mwl well yes there are keys but they never leave the device, and they are supposed to be inaccessible even when you have access the physical key (there was a vulnerability discovered in older yubikeys that made them copiable recently, but if someone has access to the usb key physically they could just steal it at this point as with any "something you own")
     
     But sure, there are keys in it. But following this logic everything in our universe is information so everything you own could technically be copied, but that's not a good way to think about it is it
   • Embed this notice
     silverwizard (silverwizard@convenient.email)'s status on Friday, 18-Oct-2024 02:58:10 JST silverwizard

     in reply to

     • Kitty Wife Milkshake (migrating from corteximplant.com)
     @mwl @marta Also, sorry for being so confrontational - I'm sick and it's making me snippy