|
This surely would have been better as a comment on a passkey story? Re: MFA Password risk: low quality, reuse, malware, leak, phishing, social eng Password+MFA risk: malware, leak, phishing, time-limited social eng Passkey risk: malware The benefit of MFA with a shared secret (aka password) is to defend against a party that has learned or guessed the secret (low quality password, password reuse, user hack/malware, system hack/leak, phishing). By requiring something you have (access to email, SMS, an authenticator app), and can prove you have access to in a small window - you can significantly reduce the risk of a successful login from someone other than the user. Reduce - if it's user hack/malware, or social engineering the other factor may also be obtainable. Passkeys use public key crypto, rather than shared secrets. Your password never leaves your device(s), so system hack/leak can only lead to a public key becoming.. public. Passkeys are also machine generated, which eliminates the low quality password and password reuse problems. The negotiation is automated, rather than requiring typing from the user - so the ability to socially engineer is greatly reduced. Finally because the negotiation includes a challenge/response, you still make a time-limited proof you known (like MFA). |