@Technus@lemmy.zip
member since 11 Sep 2023 23:07
comments
- on I don't like passkeys | Ethan Hawksley in c/technology@lemmy.world · 10h ago
-
on I don't like passkeys | Ethan Hawksley in c/technology@lemmy.world · 10h ago
Bitwarden lets you store passkeys in its vault, which I think is what you’re asking for? It’s mentioned in the post too.
No. I’m talking about using the password to directly derive the passkey. This would eliminate the need to store them in something like BitWarden.
-
on I don't like passkeys | Ethan Hawksley in c/technology@lemmy.world · 11h ago
In the scheme I’m proposing, the password never gets sent to the server.
The issue of password reuse is the password getting sent to the site, because the prevailing approach is to hash the password server-side. Passwords leak because they get stored in plaintext, or hashed using outdated algorithms, or get logged with request metadata–bottom line, they end up stored somewhere that an attacker can get their grubby little paws on them, or in a way they can reasonably recover them.
Using a master password to derive a passkey client-side isn’t any different than using a master password to unlock a password manager. It just cuts out the middle step.
-
on I don't like passkeys | Ethan Hawksley in c/technology@lemmy.world · 12h ago
I feel like there’s some potential in password-derived passkeys, which would get around the storage and hardware lock-in issues. It’d essentially be a master password like for BitWarden, but instead of needing an app to store a bunch of generated passwords, the master password could be all you need to authenticate.
Most of the sources of compromise for regular users would be eliminated because the password never leaves the client.
-
on C:/users/website/file.html in c/programmer_humor@programming.dev · 1d ago
The next gen of Claude will just steal your CC info from Chrome and sign you up for an AWS free trial without your consent.
But hey, at least it’ll work, right?
-
on Nobody Will Say Why Every Major AI Chatbot Suddenly Went Down Yesterday in c/technology@lemmy.world · 7 Sep 2026
Really? No one’s posted this yet?
Relevant XKCD: xkcd.com/908/
That’s what CSRF mitigations are for.
Do you actually understand how any of the modern web works or does your knowledge stop at W3Schools tutorials from the mid-2000s?