dmv.community is one of the many independent Mastodon servers you can use to participate in the fediverse.
A small regional Mastodon instance for those in the DC, Maryland, and Virginia areas. Local news, commentary, and conversation.

Administered by:

Server stats:

166
active users

#passkey

0 posts0 participants0 posts today

#TroyHunt fell for a #phishing attack on his mailinglist members: troyhunt.com/a-sneaky-phish-ju

Some of the ingredients: #Outlook and its habit of hiding important information from the user and missing #2FA which is phishing-resistant.

Use #FIDO2 with hardware tokens if possible (#Passkeys without FIDO2 HW tokens are NOT phishing-resistant due to the possibility of being able to trick users with credential transfers: arxiv.org/abs/2501.07380) and avoid Outlook (or #Microsoft) whenever possible.

Further learning: it could happen to the best of us! Don't be ashamed, try to minimize risks and be open about your mistakes.

Note: any 2FA is better than no 2FA at all.

Troy Hunt · A Sneaky Phish Just Grabbed my Mailchimp Mailing ListYou know when you're really jet lagged and really tired and the cogs in your head are just moving that little bit too slow? That's me right now, and the penny has just dropped that a Mailchimp phish has grabbed my credentials, logged into my account and exported the mailing

Tried to create a #Passkey for the first time. Created it in an iOS app. Immediately went to the website, didn’t work. Guess I will wait another couple years to try them again.

I’m also unnerved by the idea that if my passkey provider (Apple) decides to deactivate my iCloud account for any reason, I will loose my passkeys. This is a failure mode that no one talks about.

Replied in thread

@sarahjamielewis I would like to hear answers to that question as well. I have not tried it myself, but I'm considering #Keycloak for something like that.

I would also suggest the hashtags #passkey #webauthn and #fido to gather the attention of the right people?

If you're ready to learn the technical details, then there is a Tour of WebAuthN here: imperialviolet.org/tourofwebau

www.imperialviolet.orgA Tour of WebAuthn
Continued thread

Today’s adventures in recovering that account with #PlayStation after their passkey fail from last weekend

Support person sent me a recovery link that reset my password differently from the online process I can do by myself, got my account back

A minute or two later, the person from support changed my login email from under me, probably confusing me with another chat session and temporarily gifting my account to a stranger

At my request, they changed it back

But as it turns out, I’m locked out again and I have to wait until Monday for another attendant in my region to come online

Advice for companies on their login process

Test it thoroughly. Hire beta groups.