Why passkeys are a step back for personal security: examining account lockout risks, platform lock-in, hardware key limits, and fragile recovery flows.
Microsoft 365 implementation of passkeys is sacrilegious somehow.
It requires only the Authenticator app from Microsoft and can use nothing else to create the passkey. The way this is implemented on iOS means that Authenticator comes up as an autofill option BUT IT ONLY SUPPORTS M365 and is useless for anything else. Leave it to Microsoft to take an open standard and bastardize it to the point of it being MORE CONVENIENT to just type a damn password.
The authenticator requirement was for regular MFA, with passkey you can use others like yubikey. BUT your admin can lock it to certain vendors so they could have selected Microsoft only.
I agree the passkey user experience needs work, but man do I enjoy it over the haphazard ‘passwordless’ website login that just sends you an email.
I get it, they’re just skipping an attack vector and basically relying only on ‘2FA’. But now I have to go to a different app/tab, copy a code, and return to the site instead of letting the password manager fill stuff in for me. Some, like kickstarter, let you still have a 2FA code enabled so you have to grab your code from whichever authenticator and go to your email. Really nice login experience out of nowhere one day. \s
The best implementation of this I’ve seen has to be Ghost, an open source self-hostable newsletter/patreon thing. They detect what email provider you have and when you enter your email, will display a link to open your inbox. It’s super neat, and I haven’t seen it anywhere else, and I’m also not sure how they do it. For something self-hostable, I’ll definitely take one less attack vector.
A DNS lookup on a domain says who runs the email server for email users on that domain (that’s how email senders figures out how to send you messages), and if that host is a known one then you can just pull the link to show. If you’re self hosting email then a few solutions can be recognized and login shown by guessing that the email software’s default URL pattern is used.
Good article.
Currently passkeys are too much of a vendor lock-in to big tech.
Bitwarden support alone does not change that.
Microsoft 365 implementation of passkeys is sacrilegious somehow.
It requires only the Authenticator app from Microsoft and can use nothing else to create the passkey. The way this is implemented on iOS means that Authenticator comes up as an autofill option BUT IT ONLY SUPPORTS M365 and is useless for anything else. Leave it to Microsoft to take an open standard and bastardize it to the point of it being MORE CONVENIENT to just type a damn password.
The authenticator requirement was for regular MFA, with passkey you can use others like yubikey. BUT your admin can lock it to certain vendors so they could have selected Microsoft only.
I’m the admin. Every time I try to open it up, I only get guides for doing it on a regular, personal MS account.
Wait, you type passwords? KeePassXC’s auto-type awaits!
You realize password managers just open up another attack vector right?
Gather round everyone, “ILikeBoobies” is giving tech security advice! 👂
I agree the passkey user experience needs work, but man do I enjoy it over the haphazard ‘passwordless’ website login that just sends you an email.
I get it, they’re just skipping an attack vector and basically relying only on ‘2FA’. But now I have to go to a different app/tab, copy a code, and return to the site instead of letting the password manager fill stuff in for me. Some, like kickstarter, let you still have a 2FA code enabled so you have to grab your code from whichever authenticator and go to your email. Really nice login experience out of nowhere one day. \s
The best implementation of this I’ve seen has to be Ghost, an open source self-hostable newsletter/patreon thing. They detect what email provider you have and when you enter your email, will display a link to open your inbox. It’s super neat, and I haven’t seen it anywhere else, and I’m also not sure how they do it. For something self-hostable, I’ll definitely take one less attack vector.
Doesn’t help if you’re not using a huge provider such as Gmail or Hotmail
It worked with ProtonMail
A DNS lookup on a domain says who runs the email server for email users on that domain (that’s how email senders figures out how to send you messages), and if that host is a known one then you can just pull the link to show. If you’re self hosting email then a few solutions can be recognized and login shown by guessing that the email software’s default URL pattern is used.
I figured it was something like that, thanks for the explanation!
bitwarden went from working great to buggy on browsers. sometimes the browser passes the request to the extension but most times goes to the os
What browser
i have had issues on Firefox, Chrome and Safari between Windows, Linux, and macOS