If you skip the password then you’re back down to just 1FA, it just happens to be the factor that used to be second.
Technically the truth, but an argument can be made that 2FA was mostly more secure by virtue of how bad password security is, and selling a switch to passkey as a convenience is a big security win.
Also with passkey, you’ll be commonly be forced to do some sort of device unlock making it generally the “thing you have” require either “thing you are” or “thing you know” so it becomes effectively 2fa.
Yeah, password on its own is weak. Any factor + password will always be a lot more secure than password alone OR the other factor alone, but pairing stronger factors of course results in stronger pairings.
Passkey is a device check (the key lives on your device and nowhere else), so it relies on your device security, even if it’s just a PIN…and there has to be a backup option in case you lose access to that device, in which case the account only ends up as secure as that authentication method…which hopefully isn’t password alone.
Though passkeys are now commonly shared across devices. That was one of the changes they made. For example, chrome will gladly do all the passkey management in the Google password manager. Under Linux at least there’s isn’t even a whiff of trying to integrate with a hardware security device. First pass they demanded either a USB device or Bluetooth connection to a phone doing it credibly, or windows hello under windows, but now they decided to open it up.
FreedomAdvocate@lemmy.net.au 3 weeks ago
Yeh but with 2FA the password is essentially irrelevant because no one other than you can get in even if they have your password, so why not just skip it?
What downsides are there to passwordless authentication in your mind?
lovely_reader@lemmy.world 3 weeks ago
I’m not defending passwords specifically. You could do better 2FA with email + biometrics, although of course device authentication is only as secure as the device itself—but that’s entirely beside the point, which is that there must be two factors if you’re going to call something two factor authentication.
FreedomAdvocate@lemmy.net.au 3 weeks ago
Passwordless isn’t 2FA……it’s passwordless.
lovely_reader@lemmy.world 3 weeks ago
I see that the comment I initially replied to has been edited, but it still reads as though the second factor of 2FA is itself 2FA:
2FA stands for two-factor authentication. The typical case you’re describing:
Factor 1: password Factor 2: device check, usually
That second step of device verification itself isn’t 2FA, it’s only the second factor of that particular 2FA, and the reason your account is more secure behind it isn’t because it’s a device check but because it’s a second factor. There’s not really a “main” security check in 2FA because having two is the whole point.
I do have thoughts about passwordless as a standalone security measure, but that’s not at all what I’m addressing here. I will add, however, that since passwordless can only ever be as strong as the security on your email account…it might seem like enough if your email is protected by 2FA—but not if you mistakenly leave your email logged in on a device someone else has access to, which may sound stupid but it definitely happens.
fox2263@lemmy.world 3 weeks ago
Because the password still needs to be correct. What if the thief has your phone but no password
FreedomAdvocate@lemmy.net.au 3 weeks ago
If a thief already has your phone unlocked then nothing else matters.
fox2263@lemmy.world 3 weeks ago
There’s lots of factors for everything isn’t there. If a thief has your phone unlocked then yes you’re pretty much knackered
NewDark@lemmings.world 3 weeks ago
Password reset?
fox2263@lemmy.world 3 weeks ago
But they don’t have access to your email in this instance.
If the thief has your email and password and phone then you’re SOL