Comment on How do passkeys work across devices?

Everythingispenguins@lemmy.world ⁨3⁩ ⁨weeks⁩ ago

• adespoton@lemmy.ca ⁨3⁩ ⁨weeks⁩ ago

  I’ve got a pair of YubiKeys that I use to back my passkeys. Works great; I’ve got passkeys that work within the Apple, Microsoft and Google ecosystems and don’t have to worry about password prompts for the most part — but I DO need a YubiKey handy to validate that it’s actually me at the device.

  My keys use both NFC and USB-C and work across all my passkeys supported devices when I add in a USB adapter.

  source

  • Everythingispenguins@lemmy.world ⁨3⁩ ⁨weeks⁩ ago

    Sounds much safer than biometrics.

    source

    • adespoton@lemmy.ca ⁨3⁩ ⁨weeks⁩ ago

      Definitely. Costs extra, has an extra step to set up, and has an extra step to use, but is so much more secure.

      That said, biometrics are better than “1234”. I have no issues with people who have bad password hygiene moving to biometrics, which at least add an extra barrier for account compromise.

      But for the rest of us, physical security tokens are definitely the way to go.

      source
• hedgehog@ttrpg.network ⁨3⁩ ⁨weeks⁩ ago

  Unless you’re using a random 10+ alphanumeric passcode and are fine entering it every time you log into your phone, with a short auto-lock period, you’re much better off enabling biometrics (assuming it’s implemented competently) in combination with a longer passcode and understanding how to disable it when appropriate.

  I recently replied with this comment to a Gizmodo article recommending the same thing you did for similar reasons, if you’d like to better understand my rationale: ttrpg.network/comment/6620188

  source

  • Everythingispenguins@lemmy.world ⁨3⁩ ⁨weeks⁩ ago

    Read your other comment and I don’t disagree. There are two things that I feel could though have a hiccup. First there is a real possibility that you will not be able to lock your phones. I have never set up face ID on any android I have had, but I don’t see any reference to an auto time out on Android on my phone or any of the setup walkthroughs online. Every manufacturer uses a slightly different build of android so it is hard to say that not Androids has it.

    Second it you have a ten digit password as a backup but use face id often the you could forget it. Which would lead many people to use an easy to guess password. Defeating much of the security with a long password has.

    source

    • hedgehog@ttrpg.network ⁨3⁩ ⁨weeks⁩ ago

      I can’t speak to Android as a whole, but here’s how often Samsung Face Unlock will require you to re-auth with your phone’s passcode:

      • after 4 hours of not using the phone
      • after restarting
      • at least once every 24 hours

      iPhones do something similar, but it’s after 48 hours of non-use (instead of 4) and at least weekly instead of daily. Having to enter your password daily should help most people keep it memorized pretty well, but weekly - maybe not. So you definitely have a good point there.

      One thing that can make it easier to remember - and just as secure - is to use a longer pass phrase instead of random characters.

      If you using the diceware approach (“correct horse battery staple”), then 5 words has 32 times / 5 bits more entropy than a 10 character mixed-case alphanumeric password (64 vs 59 bits of entropy) (4 word passphrases aren’t random enough to be recommended - they have fewer bits of entropy (51) than even 9 character mixed-case alphanumeric passwords (53), though notably 10 same-case alphanumeric characters also have only 51 bits of entropy).

      The EFF has a word list that’s been improved for usability. They also have a short list, comprised of words with at most 5 characters each, where you roll 4 dice instead of 5. With 6 words from that list you get 62 bits of entropy, which is good enough to be able to recommend.

      source