You must log in or # to comment.
I don’t know anything about passkeys but if Microsoft is pushing for them I am immediately suspicious. I am admittedly paranoid but if you have been an adult using a computer over the past ~15 years and aren’t paranoid you haven’t been paying enough attention
I kinda hate the push towards passkeys. If you have two factor Auth, going to passkeys makes you go back to 1 factor, aka less secured.
There’s also more and more 2FA fatigue attacks going on, and they can affect passkeys too, and if you don’t have a 2FA that involves the user writing a code on the 2FA device, passkeys could be quite possibly worse than passwords
That sort of thing is the push I need to get entirely off of Github
I think this post is about git CLI, not www.github.com.
SSH keys are very secure and you can still encrypt them with a password if you wish.
encrypt them with a password if you wish.
SSH keys without passphrases are just fancy credential files sitting in your
.ssh/directory, basically like writing your passwords on paper and leaving it in your desk drawer.TIL some people store SSH keys unencrypted
Yeah, but who wants to type in a password everytime they push/pull?
I do it.
Every time.And I keep a wired keyboard for it.
I had mine on paper for years before i learned about Keepass. I trusted it more than a cloud based manager because someone would have to physically be in my room.
I am a lot more careful these days but that is not beyond the pale for a lot of folks haha
It’s not about encryption/security it’s about creating something that can’t be phished.
We know that 2fa is secure. But if an attacker can trick you into giving them the code, or typing it in a fake box. Then they own you.
Passkeys are made so that there’s nothing to give, nothing to type. You must control the device.
SSH keys are more like passkeys than passwords.
I’d love to see the state of online banking if everyone were to manage their own ssh keys
In all seriousness, they are similar, but not quite in this context.
There’s a good project on how to make ssh key infra more scalable and innately secure. Then you can use passkeys on top if you’d like.
https://github.com/openpubkey/openpubkey
https://github.com/openpubkey/opkssh
I personally use this on all my servers.
Passkeys use public key authentication. This makes them very resistent to phishing attacks. It’s also not possible for a phishing site to request authentication via a passkey created on a the original website.
In practice, they use Face ID, which has privacy implications.
In practice, they either use system authentication if you use the implementation bundled with iOS/Android - and sure, that can be Face ID if setup, or other forms of biometric authentication. Both operating systems have APIs that allow password managers to provide their own implementation of passkeys, and in that case you have to authenticate with your password manager - sure most of them support using system authentication (biometrics) as well, but this could also be a master password or hardware key (which work very similar to passkeys by the way).
I’d argue if you don’t assume that whatever system you’re using is reasonably secure/private, you probably shouldn’t enter any passwords on that system either. This isn’t a passkeys vs. passwords problem.
It’s different. It’s still two factors if implemented correctly: 1. Possession of the passkey (better if you have a physical token, but passkey on your phone is passable). 2. Knowledge of your password (or bio authentication if you use face id or w/e).
Note you are not giving your password to the website, and if a hacker gets hold of your password they still can’t do anything without your passkey device.
Knowledge of your passwords
Uh… What password?
Passkey should ask for a password for unlocking. If it doesn’t then it’s not implemented correctly.
It’s client specific and my phone requires whatever can unlock the phone and chrome requires either windows hello or a pin if under linux.
Certain implementations do whatever, and as far as the backend is concerned, there’s no way of knowing, unless you want to get into the business of locking down specific vendor keys…
But I say MFA is overrated versus just getting away from generally crappy password factors. Also passkeys are less phish-able than OTP type solutions.
Yes, it’s implementation specific, in this case your phone, or your browser is the passkey “device”. And as long as it’s protected by some form of authentication it’s OK (though I would recommend a hardware token over phones/browsers). If it doesn’t then you shouldn’t be using that “passkey”. Yes, there is no way for the website you are authenticating with to know whether your passkey is safe or not, choosing a secure passkey implementation is (unfortunately) the user’s job. But it’s the same with more traditional 2FAs, e.g. you can store your TOTP secret securely or insecurely, and the website will have no way to know.
If this isn’t referring to the Git CLI that prompts the user for username and password for a GitHub remote repository and GitHub rejecting password auth, then disregard this rant.
Git and GitHub are two seperate pieces of software. Git is the local client that does all the work and can optionally sync with a remote repository that can be stored in GitHub or GitLab or any other compatible remote. When Git asks for a password to authenticate, it has nothing to do with GitHub. GitHub then rejects that authentication method that Git provided because it believes that the method is insecure.
Wait until we tell them that Java and JavaScript are also different languages that are completely different things.
Both terrible in their own special way.
I mean, that’s just the Git behavior.
not sure why you’re getting downvoted for actually knowing the default behavior for git when interacting with an http remote
Still using Github, the American company owned by Micro$oft, known for deleting repos? I’d consider switching away from them, If you’re able to.
They offer free build time on windows and mac. There are also specific integration for GitHub not available for other platforms. I don’t rely on it for storing my code, just for building. I could spend a month and migrate to a different platform but so far there was no point.
Huh?
GitHub hasn’t allowed http pushes with password auth for a while. you need either to do an ssh push or use an api token. yet, anythime you do an http push for the first time, you are prompted for a password. the real reason for this is git, not github
You can with PATs though
that’s the api token i mentioned
Oh, I’m skimming through comments too fast lol
