[threeseed]

What an awful and counterproductive experience.

If you require someone to enter their credit card number every time they make a purchase they end up doing dumb, insecure things like storing it as a text file on their desktop.

And having external hardware just means more cables, batteries, updates to keep it secure etc.

Initiatives like PassKey, ApplePay, TouchID etc. have been a huge win for security and privacy.

[madsbuch]

Hey, this is completely up to you. nobody is trying to steal your apple pay.

this is merely the parent commenter's belief that they would should use different apps to reduce the risk vector when secrets are stolen.

no reason to completely ballistic.

[dalke]

Thanks, though I would say "different physical devices" not "different apps".

This also gets into e-waste issues. I really don't want multiple phones, and in any case, consumer phones are expected to be replaced every few years. A friend has an old iPhone which still works, but the local transit system's app no longer supports it. My bank's mobile app requires Android 7, etc.

[dalke]

I don't want to require everyone to do that. I'm fine if others are willing to accept the risks of centralization of identify, payment, and apps into a single device. I understand the benefits you say are true for many people.

I don't want to be forced into that model because I think it's too risky. I think YubiKeys and other devices which require physical device attachment to use to be too risky when I know other solutions exist (see a parallel comment, or below).

I want to teach my kids that if a phone is asking for permission, asking to verify id, asking to read complex terms of services, then you must be careful, and preferably not trust them. The current model is "identify yourself whenever the computer asks" and "click I Agree", which seems open to all sorts of abuse of power and trust.

How many people know they are giving up their rights to a trial in favor of forced arbitration? How many read the license which says to email '[e-mail]' to not waive that right? How many are able to understand the relevant issue? Effectively zero. Are high schools going to start teaching contract law so students are able to understand what they are expected to sign? No.

I also think switching to 2FA and passkeys empowers the Google and Apple duopoly. What happens if you lose your phone? How do you reestablish your passkeys?

"Simple. In your new phone, log back in to your Google or Apple account", right?

And if Google or Apple shuts down your account for some reason?

"Umm, make backups? Also have a YubiKey?"

That's a huge lock-in for the sort of people who would otherwise store their passwords in a cleartext file. At the very least everyone should be able to let their bank or other trust third-party store a copy of the end-to-end encrypted database, and that bank or third-party should have an enforceable legal obligation to store, maintain, and provide that encrypted database, and that new phones can restore from this database without needing Apple or Google authorization, after the person has physically visited the bank or police station and identified themselves sufficiently.

And if I say I want something more secure and more portable than a YubiKey to log in?

My bank login device has had one change of AAA batteries in about 7 years. It has had zero updates, because it is not programmable. It uses a camera to read something like a QR code, a screen to read the requested task, a number pad to enter a PIN, and I can read the response code on the screen, to enter into the computer. It can work with any device, even ones without available plugs.

(And my bank is legally responsible for ensuring the security level is enough, and updating if it is not. Apple is not. Google is not.)

While I love it for bank login (it's the orange one at https://www.sparbankenskane.se/privat/digitala-tjanster/sake... ) I also don't want that for all my services!

If I need to pull it out, I know that I'm doing something that requires extra attention and care. The rituals needed for different levels of authorization should be very different, to make it hard to get confused about what you are doing. I also have the ability to physically leave my higher authentication devices at home while I'm out for the day.

(UPDATE: acdha correctly pointed out the phishing attack possible in this approach. I do not know what the bank does to protect against phishing. But since this is a low-use service, which is unlikely to be targeted, and I am fastidious about double-checking, it seems like a low risk issue. Security through diversity.)

Why should I trust ApplePay's privacy more than I do my bank's? Is ApplePay required to follow the same Swedish privacy restrictions that my bank does? Is ApplyPay equally liable in case of errors? Can the Swedish government audit how ApplePay works and confirm it complies to the same level of privacy as my bank?

Every time I look into it, it seems the answers are always "no." Maybe it's changed?

Basically, I trust international companies who have abused their monopoly position with my security and privacy far less than I trust the Swedish government.