Hacker News Reader

Comment by Gigachad | Hacker News Reader

The main benefit you get is that you don't have to type in 2FA codes anymore since 2FA was built to solve credential stuffing / password reuse which isn't a problem on Passkeys.

It is nice to just have a one click login for things.

View on HN

First-generation 2FA solved basic credential compromise issues using code-based methods (e.g. TOTP/HOTP). Modern 2FA (e.g. push notifications) adds authentication integrity, phishing resistance, and user validation through real-time, context-aware approvals.

Passkeys replace passwords and also render basic TOTP/HOTP-based 2FA unnecessary. However, they do not replace modern, push-based 2FA, which may still be needed in higher-assurance or enterprise scenarios.

Regardless personally I am waiting for full FIDO Alliance interoperability/sync, so I'm not locked into a single password manager. I've already had to migrate password managers after my choice was taken over by Private Equity.

Pushed based is also insecure, why would you want that if you have a passkey unlocked by a pin+touch? That's context aware, requires something you have and something you know.

Push notifications don't protect against realtime phishing attacks

The main benefit of FIDO2 is origin verification: it is literally impossible to authenticate on a phishing website, as on a phishing website the browser won't send valid origin data to your token.

Push notification based 2FA can never obtain that level of security.

What happens if the origin changes? Suppose I have a passkey for Twitter.com, and now the site is named X.com? Is there some way to migrate the passkey?

Push notifications are vulnerable to MFA fatigue/"bombing" attacks, that are used in the real world, cf. this breach on Uber:

https://www.darkreading.com/cyberattacks-data-breaches/uber-...

> I've already had to migrate password managers after my choice was taken over by Private Equity.

do you remember which one? hope it wasn't bitwarden :/

I have one-click login with 2FA codes stored in 1Password.

And 1Password will still let me export my crazy-long password and TOTP code to a plain text file if I want to switch to a different password manager (of course, I’ll have to do some planning beforehand to make sure that the export destination doesn’t get picked up by my backup software).

Yes but also depends on how the end system is configured.

You can require Google IDP to still have 2FA with passkeys.

Reply on news.ycombinator.com