coffe2mug
Joined 3 years ago
Karma
35
Submissions
45
Member since
Aug 18
Recent submissions
Comment · 2 months ago
Comment · 2 months ago
article poorly written (may be by AI).
> generate a key that’s stored in this fortress.
It refers to the private key that is resident inside SecureEnclave. (During manufacturing)
See further. Dont just read one or two lines.
“The attacker can’t steal the private key from the device because the TPM / Secure Enclave will not release it. That is the core protection here,” Scott Helme, a researcher and founder of Report URI who blogged about the new protections on Tuesday, told Ars. “The attacker can steal the cookie, but they can’t answer a DBSC challenge by signing it with the private key, which is still safe on your device.”
Read https://support.apple.com/en-gb/guide/security/sec59b0b31ff/...
Comment · 2 months ago
> If Chrome can write into TPM/Secure Enclave it's like the best fingerprinting ever?
Please. Hatred for tech is stupid.
Read the specs before commenting. Even any free AI would have told you better.
Chrome is not writing into TPM or secure enclave.
Comment · 3 months ago
Yes. If you are such a person then do it.
Comment · 3 months ago
With your logic nothing is unstealable. Go and watch film inception.
The main point is the average Joe it works seamless. And average Joe won't have to remember things.
Yes, it does. Not everyone wants to maintain password database.
Comment · 3 months ago
Incorrect. They break but they fix it.
People break their phones less often compared to telling them keep their keepassdatabase in sync across devices.
Even recently my friend fixed his iPhone XR (10 year old) 3rd party. Everything including passkeys work fine.
Comment · 3 months ago
Downloading and keeping safe local data is a bug for others
Comment · 3 months ago
Buy a new iPhone. Sign into it. Everything is now available.
That is the reason: for the average Joe not having exportable passkeys is good.
Average Joe doesn't have to do backup. It is all automatic.
Comment · 3 months ago
https://f-droid.org/packages/de.noisruker.openPasskeyAuth
Use this then totally offline
Comment · 3 months ago
No one is convincing you need to use it. If it makes it makes other people's lives easy then ok
Comment · 3 months ago
A random app cannot eat your passkey. Platform authentication ensures more safety. I am not an expert but definitely it does use secure enclave in some ways(maybe decryption).
UX usability is far better. With password and 2FA you have at least 2 steps. Here
Open the app: device like phone or laptop just asks your fingerprint or facial and done.
That is a great benefit for average Joe. Some one trying to scam remotely cannot access the account. The 89 year old grandma will say - I just give fingerprint. Done.
Yes, it won't cover all situations. Like if there is sim swap or bank employee does fraud.
Comment · 3 months ago
No one is forcing you. You can continue to use passwordmanager.
We are talking about the rest the people that want convenience.
In a way that is the reason passkeys synced with Google or Apple just work. No need of hardware keys.
Comment · 3 months ago
Passkeys cannot be stolen. Yes, don't say that what if someone steals my iPhone, PIN, and adds their fingerprint.
Let's say eBay asks user to login. With passkey. Press and hold fingerprint etc. login done. Even with laptop.
And average Joe doesn't want to maintain a keepassdatabse sync it. Yes, you can always use your own server etc but others have life.
You are not forced to use DSBC. You are not even forced to use Chrome.
Lots of people - lose accounts by installing malware. They don't care about giving info to Google. at the end, many already store passport data in Google Photos or drive.
You can still buy coreboot/libreboot based laptops.