posted in Technology
I don't like passkeys | Ethan Hawksley
hawksley.dev/blog/i-dont-like-passkeysReplying to @lemmydividebyzero@reddthat.com
One complaint I have is browser insistence that a site must have a proper certificate to work at all.
I provide self hosted software with passkey support and probably over 90 percent of my users never set up property certificates due their private networks. So the passkey function is impossible for them.
Which means they must use passwords. Which are far worse in this scenario. The practical risk either way is arguably low for them, but to take a more mitm/phishing resistant technique and then force it to not work because mitm or phishing might be in play…
Replying to @jj4211@lemmy.world
I literally just completed a Secure Code Warrior formation mandated by work, and one of the videos states “websites with expired certificates transit your information unencrypted, leaving you exposed to hackers” 🤦 like bruh you’re supposed to know better, you teach cybersecurity for fuck’s sake.
Replying to @isVeryLoud@lemmy.ca
Computing and by extension cybersecurity has a lot of mouth-breather idiots because it’s so new.
Replying to @LodeMike@lemmy.today
It’s not so new anymore, however, it is widely known as an “easy” way to a strong six-figure salary, so we have a lot of gold-rush mouth-breather idiots that never would have gotten into this in the first place if not for the dollar signs. Really started to turn south around the time dot-com inspired early career people to get in on the bubble.