@0xF21D Any more reason to switch to FIDO2 with hardware tokens or #Passkeys.
The latter only if you trust the service providers and if you don't need protection against phishing. With Passkeys and their optional delegation feature you can be tricked into transferring to a hacker. 
With a #FIDO2 hardware token, you're really safe.
@zak @zenbrowser : a still unfixed vulnerability: if NOT using Touch ID, on some websites you may be able to sign in using a passkey WITHOUT authenticating locally - using biometrics or your passcode (screen unlock code).
This vulnerability also exists WITH Touch ID set up, provided that "Password Autofill" is disabled.
BTW this vulnerability also permits access to:
• https://icloud.com
• https://account.apple.com
(When asked to provide your fingerprint, tap the X at the top right and tap in the "Email" field one more time).
This is a HUGE risk for people who do not want to use biometrics: if a thief grabs their iPhone when unlocked, or watches them enter their passcode and later steals their iPhone, the thief can use ALL of the owner's passwords and some of their passkeys stored in the "Passwords" app (formerly known as iCloud Keychain).
This increases the risks of theft as shown by WSJ's Joanna Stern in https://youtube.com/watch?v=QUYODQB_2wQ.
In addition, a (grand) child or anyone else who (shortly) borrows your iPhone/iPad may have access to more of your cloud-accounts than you're aware of.
Workaround if you don't want to use biometrics to unlock your iPhone/iPad (this does not fix any problem if a thief learns (or successfully guesses) your passcode (screen unlock PIN or password):
• Set up a Touch ID anyway, for example for your left pinky finger (if you're righthanded)
• Disable "iPhone Unlock" in "Touch ID and Passcode" (visible in the first screenshot).
• Use a safer password manager (such as KeePassium) than the Apple "Passwords" app (iCloud KeyChain).
In any case:
• Make sure that "Password Autofill" (in settings -> "Touch ID and Passcode") is set to ENABLED;
• When you enter your passcode in a public place (such as a bar, bus or train), make very sure that nobody gets to see you enter it.
Enterprises understand the value of passkeys for workforce sign-ins. 87% of decision makers report deploying passkeys at their companies. Of these, 47% report rolling out a mix of device-bound passkeys and synced passkeys.
#enterprise #passkeys #security
https://www.helpnetsecurity.com/2025/03/12/enterprise-passkey-adoption/
#Passkeys and the evolution of authentication: A secure, seamless future
https://bitwarden.com/blog/passkeys-and-the-evolution-of-authentication-a-secure-seamless-future/
This cybersecurity startup aims to fix some of the headaches with passkeys by using its new passwordless authentication technology, which takes the best of passkeys but without their limitations.
#passwords #passkeys #security #cybersecurity
https://techcrunch.com/2025/03/11/some-say-passkeys-are-clunky-this-startup-wants-to-change-that/
Passwords are annoying, vulnerable to attack, and prone to human error. Our latest article explains how passkeys can lead to more secure and private online accounts
https://www.privacyguides.org/articles/2025/03/08/toward-a-passwordless-future/
Discover PasskeyIndex.io: Your Community Hub for #Passkeys
https://bitwarden.com/blog/discover-passkeyindex-io-your-community-hub-for-passkeys/
Any #passkeys experts around here? My government’s IT service maintains that they are correct when they use the term “passkey” to mean “hardware security device” (YubiKey and stuff,) and that I’m wrong for (1) saying those have never been called “passkeys” before the real passkeys were introduced and (2) expecting passkey support to mean the software passkeys provided by Safari or 1Password. #passkey
I am not a fan of #Passkeys but maybe they are the solution for the 20 different 2FA apps people keep on their phones.
Passkeys just mean that sites using one can track you down to the device level.
"[JoeUser] just connected to our site on his computer at home."
"[JoeUser] just connected to our site on his phone."
Is it just coincidence that the dominant spy-on-users vendor invented passkeys? I don't think so.
#passkeys #tracking #users #GooleIsSpyware
#security
Well this is quite the surprise! Passkeys in epic-stack, brought to you by SimpleWebAuthn 
https://github.com/epicweb-dev/epic-stack/discussions/937
I can consider this a feather in my cap, no?
New post: Basic Internet Security for Authors – Strong Passwords
What are good passwords (spoiler: long ones) and how can i use them so that they don't annoy me?
https://www.viennawriter.net/blog/basic-internet-security-for-authors-strong-passwords/
It’s been four years since Google and Apple began supporting passkeys, a new password-free authentication method. Here's a look at the current status of passkeys and whether this is really the end of passwords.
#apple #google #passkeys #passwords
https://www.digitaltrends.com/computing/passkeys-in-2025-do-i-still-need-a-password-manager/
Better late than never... It published instantly to YouTube, but now you can check out our Episode 338 "AI Security Concerns" from October 23, 2024 on both edtechSR.com and Substack!
https://edtechsr.com/2025/02/14/edtechsr-ep-338-ai-security-concerns/
The Substack version contains BOTH links we discussed during the episode AND those we found but didn't have time to talk about:
https://edtechsr.substack.com/p/edtechsr-ep-338-ai-security-concerns
Passkey/password bug: iOS 18.3.1
Ook in iOS versie 18.3.1 is de eerder door mij gemelde iCloud KeyChain (*) kwetsbaarheid nog niet gerepareerd (eerder schreef ik hierover, Engelstalig: https://infosec.exchange/@ErikvanStraten/113821443334366419).
(*) Tegenwoordig is dat de app genaamd "Wachtwoorden" (of "Passwords").
De kwetsbaarheid bestaat indien:
• De eigenaar een "passcode" (pincode of wachtwoord) gebruikt om de iPhone of iPad te ontgrendelen - en er GÉÉN biometrie is geconfigureerd;
ofwel:
• De gebruiker wel biometrie kan gebruiken om het scherm te ontgrendelen, doch in 'Instellingen' > 'Touch ID en toegangscode' de instelling "Autom. invullen wachtw." is UITgezet.
Zie onderstaande screenshots (Engelstalig in https://infosec.exchange/@ErikvanStraten/113821443334366419). Meer info ziet u door op "Alt" in de plaatjes te drukken.
Probleem: iedereen met toegang tot de ontgrendelde iPhone of iPad kan dan, *zonder* opnieuw lokaal te hoeven authenticeren:
1) Op elke website inloggen waarvan het user-ID en wachtwoord in iCloud Keychain zijn opgeslagen;
2) Met passkeys op enkele specifieke websites inloggen (waaronder https://account.apple.com en https://icloud.com), namelijk als volgt:
a) Open de website;
b) Druk op "Inloggen";
c) Druk op de "x" rechts bovenaan de pop-up die verschijnt (in de onderste schermhelft);
d) Druk kort in het veld waar om het e-mailadres gevraagd wordt;
e) Druk op de knop "gebruik passkey".
Risico: uitlenen van een unlocked iDevice (o.a. aan kinderen) maar ook diefstal nadat de passcode is afgekeken. Of als de dief geen passcode heeft, als deze wacht tot de eerstvolgende iOS/iPadOS kwetsbaarheid bekend wordt waarbij de schermontgrendeling omzeild kan worden.
Als u ze nog niet gezien heeft, bekijk in elk geval de eerste van de volgende twee video's van Joanna Stern (van de Wall Street Journal):
https://youtube.com/watch?v=QUYODQB_2wQ
https://youtube.com/watch?v=tCfb9Wizq9Q
Killing all my #PassKeys with fire. What an awful user experience, especially the fact that you can't use a device with a passkey for a site as a second factor for that same site, just one or the other, meaning if you're on a device that doesn't support passkeys, you have to fall back to MITM-able TOTP or have a second device for U2F.
@vPurple : because I'm a security guy who wants to help others make the best of things (even if it regularly feels like pulling my hair out).
Most people will *not* install an alternative OS on their phone.
And I use main stream stuff to be able to tell big tech when things suck (unfortunately they're mostly deaf).
iCloud Keychain passkeys and passwords vulnerability: https://infosec.exchange/@ErikvanStraten/113947265572224222
Android passkeys vulns: https://infosec.exchange/@ErikvanStraten/113820358011090612 (after publishing https://seclists.org/fulldisclosure/2024/Feb/15).
OTOH Mozilla eventually fixed a bug in Firefox for iOS/iPadOS that I reported (under specific, non-exceptional, circumstances a padlock was shown while http was being used: https://infosec.exchange/@ErikvanStraten/113316652669640932).
![A screenshot of the dreaded Android error message which may appear when trying to use an Android based passkey:
"
Your encrypted data is locked on
this device
For security, you can no longer access your encrypted data on this device. Try again using a device you've recently used to sign in to your Google Account. Visit g.co/OnDeviceEncryption to learn more.
[Button: Try again]
"
Of course "Try again" is pointless. No more access to any of your passkeys. Brilliant.](https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/970/187/099/162/958/original/fdd9bf088415d887.jpg "A screenshot of the dreaded Android error message which may appear when trying to use an Android based passkey:
\"
Your encrypted data is locked on
this device
For security, you can no longer access your encrypted data on this device. Try again using a device you've recently used to sign in to your Google Account. Visit g.co/OnDeviceEncryption to learn more.
[Button: Try again]
\"
Of course \"Try again\" is pointless. No more access to any of your passkeys. Brilliant.")
@eelcoa : jazeker, maar heel veel wachtwoordmanagers doen dat standaard niet.
Bovendien moeten internetters zich niet laten misleiden om, als de wachtwoordmanager nergens mee komt, zoals voor iets als:
https://UBN-identiteits-verificatie·com
(UBN = UwBankNaam)
dan maar zelf de inloggegevens voor hun bank in de wachtwoordmanager op te zoeken.
Ten slotte checken wachtwoordmanagers zelden of een website van https gebruik maakt.
Passkeys hebben geen van de drie bovengenoemde nadelen, maar wel weer een heel stel andere.
Waarom 2FA/MFA niet tegen phishing beschermen, Engelstalig (het zóvéélste voorbeeld, deze van afgelopen week: https://www.bleepingcomputer.com/news/security/hackers-spoof-microsoft-adfs-login-pages-to-steal-credentials/). Iets eerder, meer uitleg: https://www.securityweek.com/mfa-isnt-failing-but-its-not-succeeding-why-a-trusted-security-tool-still-falls-short/.
Veilig inloggen: https://security.nl/posting/840236/.
Beknopt (Engelstalig) tips voor wachtwoordmanagers onder Android, iOS en iPadOS: https://infosec.exchange/@ErikvanStraten/113022180851761038.
Android screenshot bij gebruik van KeePassDX: https://infosec.exchange/@ErikvanStraten/113549056619471557.
Safari onder iOS/iPadOS laten waarschuwen als (ook heel eventjes tussendoor) http gebruikt wordt: https://infosec.exchange/@ErikvanStraten/113951865706764140.
Passkeys voor leken (NL): https://security.nl/posting/798699
Ptoblemen met passkeys: https://infosec.exchange/@ErikvanStraten/113947086575210603.
@thomasbosboom : I reported the passkkey (and password) bug privately to Apple in the summer of 2023. Even after providing a near endless amount of screenshots and other proof, Apple said it's a wontfix.
The basic issue is that, if the user does not use biometrics to unlock their iPhone or iPad, they are NOT asked to enter their (screen unlock) passcode to use passwords from iCloud keychain.
IMO that on itself is already insane (considering [1]). Many people do not use biometrics.
If no bio is used (and even if it is) there are specific circumstances where someone with access to an unlocked iDevice (think of children) can use passkeys without any local authentication.
Just tested using iOS v18.3: with my iPhone unlocked, I can log in to https://icloud.com and (fixed URL 20:48 UTC) https://account.apple.com using the passkey on my iPhone WITHOUT providing any credentials.
If @rmondello reads this: thank you for adding the Safari "Not Secure Connection Warning"!
Even if it not enabled by default, this http warning should help protect against EvilTwin attacks (such as described in https://www.bleepingcomputer.com/news/security/australian-charged-for-evil-twin-wifi-attack-on-plane/).
[1] See WSJ's Joanna Stern in https://youtube.com/watch?v=QUYODQB_2wQ and https://youtube.com/watch?v=tCfb9Wizq9Q. And no, I do not believe that Stolen Device Protection is a good idea. Most people will not use it.
