Comment on MFA
suzune@ani.social 6 months agoPasskeys are an open standard. You need to install a Webauthn-compliant supplicant that talks to the browser. The supplicant can be anything, as long as it does the required protocol. The browser doesn’t care.
At the moment the browsers are the main problem. They need to open their APIs properly.
Problem is part of the standard allows the server to require attestation. So congratulations, they only bless their app, or maybe they only bless iphones.
If the service ignores that, then yes, it’s great. It’s as yet unpopular so it’s hard to know, but in adjacent industries I have seen them lock down the to the point it’s as asinine as “open your app to continue”
Not necessarily. I found out that bitwarden can generate a QR code that you just scan with your phone that allows your phone to act as a passkey, no browser support required. I was surprised when I discovered that. I had set up my phone as a passkey in Windows, and Windows can use phones as a passkey directly; on Linux that’s not supported so it just gave me a QR code that worked seamlessly. It’s not like a browser URL, but actually triggers the phone’s passkey authentication, kinda like QR codes for WiFi authentication. Pretty neat.
LodeMike@lemmy.today 6 months ago
TOTP is an open standard but look at how bad companies have fucked that up.