Adversary-in-the-middle attacks can strip out the passkey option from login pages that users see, leaving targets with only authentication choices that force them to give up credentials.

  • TheButtonJustSpins
    link
    fedilink
    English
    arrow-up
    2
    ·
    5 months ago

    Okay, so it’s just like Yubikey-type stuff? I’ve thought about that before but it seems very risky - they recommend you get two and set both of them up so you have a backup, but that would require all websites to support that, right?

    I’m down for using BitWarden, though, if I can substitute it for physical keys.

    • trevor@lemmy.blahaj.zone
      link
      fedilink
      English
      arrow-up
      3
      ·
      5 months ago

      Okay, so it’s just like Yubikey-type stuff? I’ve thought about that before but it seems very risky - they recommend you get two and set both of them up so you have a backup, but that would require all websites to support that, right?

      Pretty much. I suppose that’s a very real disadvantage to using physical passkeys. If you lose it, unless you have multiple passkeys configured, or have access to an account recovery method, you lose that account.

      But, like you mentioned, using Bitwarden would sidestep that issue, and they do support passkey emulation.