5 results for “scotthelme”
If passkeys have people this upset, wait until they hear about DBSC 🤣
Your session is hardware bound to your device...
Somewhere, a cookie just found out it can be device-bound 🍪🔐
https://scotthelme.co.uk/device-bound-session-credentials-making-stolen-cookies-useless/
RE: https://infosec.exchange/@ScottHelme/117438540873635533
This seems credible 😀 at least as far as I can tell without digging into the technical details linked in the post (though I will need to do some more work to convince myself a gradual shift towards attestation is as unlikely as is implied here)
That being said... I still wind up not using passkeys on most websites that claim to support them simply because they usually do not work for me.
Passkeys Are Not a Trap #devopsish https://scotthelme.co.uk/passkeys-are-not-a-trap/?utm_source=tldrdev
"Passkeys Are Not a Trap"? Nice Try Scott Helme, founder and CEO of a company that markets a "Passkeys Protection" offering.
https://scotthelme.co.uk/passkeys-are-not-a-trap/
Sorry, your article is patronizing me about what attestation is, then explaining that passkeys today don't give websites an attestation at all - though a site can ask. And in so doing, it completely fails to address the main criticism of the "Passkeys are a trap" blog post, i.e. that passkeys are the boiling frog of BigTech control on authentication.
https://nonfunctional.substack.com/p/passkeys-are-a-trap-do-not-use-them
The only point I concede is that TOTP are vulnerable to phishing. And yet, if I really have to choose, I prefer that risk rather than handing over control to Google, Apple, and co. In any case, hardware authenticators like Yubikey / NitroKey are the preferred solution.
Sorry, not convinced. Passkeys are a trap. Do not use them.
#passkeys #security #cybersecurity #bigtech #google #apple #enshittification #bigtech #digitalsovereignty #opensource #infosec #passwords #phishing #totp
Passkeys don't work the way that viral post claims. Synced passkeys don't attest. Attestation doesn't check your OS. And TOTP codes still fall for phishing. The post recommends YubiKeys, which literally do attest. The logic is backwards.