#passkeys
#passkeys
[ follow ]
#cybersecurity #authentication #passwordless-authentication #fido-alliance #user-experience #security #phishing
fromZDNET
1 week agoApple, Microsoft, or Google: Whose platform authenticator rules our passkey future?
Due to its roots in public key cryptography (see ZDNET's primer on the role of public key cryptography in making passkeys work), the passkey standard makes it possible to login to a website or app (collectively referred to as the "relying party") without the need to input your secret (your password) in order to complete the login process. In fact, the passkey standard enables relying parties to eliminate passwords altogether.
Information security
fromZDNET
1 week agoWhat is a passkey authenticator? Only the key to our passwordless tomorrow
The first of these entities is the authenticator -- not Google's Authenticator or Microsoft's Authenticator, necessarily; rather, it's usually an integral component of your password manager. In fact, given the degree to which authenticators are typically built into password managers, the phrase "authenticator" is often omitted from discussions about credential management. However, since authenticators can also exist as stand-alone components (separate from any password management capabilities), it's helpful to consider their unique role as independent actors in any passkey workflow.
Information security
fromTheregister
3 weeks agoX assures passkey reset is nothing to worry about
X (formerly Twitter) sparked security concerns over the weekend when it announced users must re-enroll their security keys by November 10 or face account lockouts - without initially explaining why. The cryptic mandate from X Safety on Friday led many to suspect a security breach was behind it. When a platform forcibly rotate security keys, it's often a sign it is working through incident response protocols - eradicating adversaries from a network and keeping them out.
Information security
Information security
fromZDNET
2 months agoYour passkeys could be vulnerable to attack, and everyone - including you - must act
An exploit can trick password managers into revealing traditional credentials or passkey-like artifacts under specific preconditions, though passkeys and the protocol were not proven vulnerable.
Information security
fromDataBreaches.Net
2 months agoGmail's protections are strong and effective, and claims of a major Gmail security warning are false. - DataBreaches.Net
Gmail protections remain strong and effective, blocking over 99.9% of phishing and malware attempts and no broad warning was issued to all users.
Information security
fromArs Technica
2 months agoUnpacking Passkeys Pwned: Possibly the most specious research in decades
Malicious browser extensions can create attacker-controlled passkeys bound to legitimate domains, allowing account takeover and undermining the perceived theft immunity of passkeys.
Privacy technologies
fromZDNET
6 months agoWhy the road from passwords to passkeys is long, bumpy, and worth it - probably
Passkeys are being adopted to replace passwords but face barriers to user understanding and seamless implementation.
Transitioning to passkeys necessitates a strategic approach due to existing complications.
[ Load more ]