@deepthoughts10@infosec.exchangeBecause FIDO-based authentication (Passkeys, YubiKeys, etc.) is so good the only way around it is to trick someone into not using it. That's essentially what a downgrade attack is. As a Microsoft #EntraID administrator you can prevent successful downgrade attack from affecting your users. Here's a few ways to mitigate the risk of downgrade attacks:
1) Have your users delete all MF…
@publicvoit@graz.social#Authentifizierung mit #FIDO2 und #Passkeys https://ka…
@macandi@social.heise.de
@luana@wetdry.world(also, any resources on supporting passkeys?)
@Techmeme@techhub.socialMeta is adding support for passkeys on Facebook's iOS and Android apps "soon", and will begin rolling out passkeys to Messenger "in the coming months" (Emma Roth/The Verge)
https://www.theverge.com/news/689410/facebook-passkey…
@seeingwithsound@mas.toTo ChatGPT: I'd like to see neuroscientists nudge the human brain toward brain states that blend lucid dreaming and visual-to-auditory sensory substitution, for veridical and vivid mental imagery for the totally blind, making sensory substitution functionally and perceptually equivalent to low vision. https://
@nohillside@smnn.ch
@cdarwin@c.imPassword compromise is no joke;
it leads to account compromise and that leads to, well, the compromise of most everything you hold dear in this technological-centric world.
It’s why Google is telling billions of users to replace their passwords with more secure passkeys.
It’s why the FBI is warning people not to click on links in SMS messages.
It’s why stolen passwords are up for sale, in their millions, on the dark web to anyone with the very little amount of cas…
@stefan@gardenstate.socialI guess passkeys are the new tech I don't feel 100% shitty about. They have some gaps but are mostly good. maybe i should use them more.
@nelson@tech.lgbtI managed to get passkeys working with 1Password on Windows and Android! That's better than last year when I gave up entirely.
@hey@social.nowicki.io@… and no passkeys support. This is the one with ready to merge branch and the developer busy with something else.
inb4: a FOSS developer CAN be busy with something else, it is none of our business, it's fine
@hey@social.nowicki.io@… @… tl;dr: something that replaces login password 2FA credentials
http…
@hey@social.nowicki.ioIs Keepass on Android really dead? On Apple devices there's Strongbox that is up to date and native UI/UX. On Linux, KeepassXC does the job well.
And Android has two apps, both of them are unmaintained. One of them, the maintainer can't even merge the Passkeys support and release.
Someone™ should make a commercial version of it.
#keepass
@joergi@chaos.socialWow, what a surprise today! Finally Android 15 for my Fairphone 5!
#fairphone #Fairphone5 #android #android15
