TechHub

Marcel SIneM(S)US<a href="https://social.tchncs.de/tags/Apple" class="mention hashtag" rel="nofollow noopener" target="_blank">#Apple</a> :apple_inc: erweitert Passwörter-App-Unterstützung für Windows | Mac & i <a href="https://www.heise.de/news/Apple-erweitert-Passwoerter-App-Unterstuetzung-fuer-Windows-10483159.html" rel="nofollow noopener" translate="no" target="_blank">https://www.heise.de/news/Apple-erweitert-Passwoerter-App-Unterstuetzung-fuer-Windows-10483159.html</a> <a href="https://social.tchncs.de/tags/password" class="mention hashtag" rel="nofollow noopener" target="_blank">#password</a> <a href="https://social.tchncs.de/tags/passwords" class="mention hashtag" rel="nofollow noopener" target="_blank">#passwords</a> <a href="https://social.tchncs.de/tags/Passwortmanager" class="mention hashtag" rel="nofollow noopener" target="_blank">#Passwortmanager</a> <a href="https://social.tchncs.de/tags/PasswordManager" class="mention hashtag" rel="nofollow noopener" target="_blank">#PasswordManager</a> <a href="https://social.tchncs.de/tags/Passkey" class="mention hashtag" rel="nofollow noopener" target="_blank">#Passkey</a> <a href="https://social.tchncs.de/tags/Passkeys" class="mention hashtag" rel="nofollow noopener" target="_blank">#Passkeys</a>

Seth G.<a href="https://mastodon.online/@cryptomator" class="u-url mention" rel="nofollow noopener" target="_blank">@cryptomator</a> Credential management was a particularly fun one to figure out: the best way to secure those.I am using Proton Pass, since they have cloud-synced <a href="https://chaos.social/tags/passkey" class="mention hashtag" rel="nofollow noopener" target="_blank">#passkey</a> support, but their export only supports .json. To make it easy, I import the .json into <a href="https://fosstodon.org/@keepassxc" class="u-url mention" rel="nofollow noopener" target="_blank">@keepassxc</a> to make a <a href="https://chaos.social/tags/KeePass" class="mention hashtag" rel="nofollow noopener" target="_blank">#KeePass</a> vault, so even if the service goes down, I can still open my creds on desktop or <a href="https://chaos.social/tags/KeePassDX" class="mention hashtag" rel="nofollow noopener" target="_blank">#KeePassDX</a>. KeePass vaults are also widely-supported for import into other cloud credential managers.<a href="https://chaos.social/tags/passkeys" class="mention hashtag" rel="nofollow noopener" target="_blank">#passkeys</a>

Alex JimenezHow <a href="https://mas.to/tags/PassKeys" class="mention hashtag" rel="nofollow noopener" target="_blank">#PassKeys</a> work: The complete guide to your inevitable passwordless future Why are passkeys so much safer than passwords? And how exactly does this sorcery work? We go behind the scenes of this still-evolving authentication process.<a href="https://www.zdnet.com/article/how-passkeys-work-the-complete-guide-to-your-inevitable-passwordless-future/" rel="nofollow noopener" translate="no" target="_blank">https://www.zdnet.com/article/how-passkeys-work-the-complete-guide-to-your-inevitable-passwordless-future/</a><a href="https://mas.to/tags/CyberSecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#CyberSecurity</a>

Steve Dustcircle 🌹How <a href="https://masto.ai/tags/passkeys" class="mention hashtag" rel="nofollow noopener" target="_blank">#passkeys</a> work: Let's start the <a href="https://masto.ai/tags/passkey" class="mention hashtag" rel="nofollow noopener" target="_blank">#passkey</a> registration process <a href="https://www.zdnet.com/article/how-passkeys-work-lets-start-the-passkey-registration-process/" rel="nofollow noopener" translate="no" target="_blank">https://www.zdnet.com/article/how-passkeys-work-lets-start-the-passkey-registration-process/</a>

holzdiebimeinsatz2 neue Tutorials auf meiner Seite … Hurra :)Wie und warum sollte man WhatsApp mit einem Proxy verwenden?<a href="https://www.christiansblog.eu/tutorials/whatsappproxy/" rel="nofollow noopener" translate="no" target="_blank">https://www.christiansblog.eu/tutorials/whatsappproxy/</a>Was sind Passkeys und wie funktionieren sie?<a href="https://www.christiansblog.eu/tutorials/passkeys/" rel="nofollow noopener" translate="no" target="_blank">https://www.christiansblog.eu/tutorials/passkeys/</a><a href="https://mastodon.social/tags/holzdiebimeinsatz" class="mention hashtag" rel="nofollow noopener" target="_blank">#holzdiebimeinsatz</a> <a href="https://mastodon.social/tags/tutorials" class="mention hashtag" rel="nofollow noopener" target="_blank">#tutorials</a> <a href="https://mastodon.social/tags/Passkeys" class="mention hashtag" rel="nofollow noopener" target="_blank">#Passkeys</a> <a href="https://mastodon.social/tags/WhatsApp" class="mention hashtag" rel="nofollow noopener" target="_blank">#WhatsApp</a> <a href="https://mastodon.social/tags/Anleitungen" class="mention hashtag" rel="nofollow noopener" target="_blank">#Anleitungen</a>

Steve Dustcircle 🌹How <a href="https://mastodon.social/tags/passkeys" class="mention hashtag" rel="nofollow noopener" target="_blank">#passkeys</a> work: Your <a href="https://mastodon.social/tags/passwordless" class="mention hashtag" rel="nofollow noopener" target="_blank">#passwordless</a> journey begins here <a href="https://www.zdnet.com/article/how-passkeys-work-your-passwordless-journey-begins-here/" rel="nofollow noopener" translate="no" target="_blank">https://www.zdnet.com/article/how-passkeys-work-your-passwordless-journey-begins-here/</a>

StanceOfMindMicrosoft has said that it's ending support for passwords in its Authenticator app starting August 1, 2025.<a href="https://thehackernews.com/2025/07/microsoft-removes-password-management.html" rel="nofollow noopener" translate="no" target="_blank">https://thehackernews.com/2025/07/microsoft-removes-password-management.html</a> <a href="https://tech.lgbt/tags/Microsoft" class="mention hashtag" rel="nofollow noopener" target="_blank">#Microsoft</a> <a href="https://tech.lgbt/tags/Authenticator" class="mention hashtag" rel="nofollow noopener" target="_blank">#Authenticator</a> <a href="https://tech.lgbt/tags/Passcodes" class="mention hashtag" rel="nofollow noopener" target="_blank">#Passcodes</a> <a href="https://tech.lgbt/tags/Passkeys" class="mention hashtag" rel="nofollow noopener" target="_blank">#Passkeys</a> <a href="https://tech.lgbt/tags/Security" class="mention hashtag" rel="nofollow noopener" target="_blank">#Security</a> <a href="https://tech.lgbt/tags/Tech" class="mention hashtag" rel="nofollow noopener" target="_blank">#Tech</a>

Stefan :veritrek:This is great! Waiting for <a href="https://social.stefanberger.net/tags/strongbox" class="mention hashtag" rel="nofollow noopener" target="_blank">#strongbox</a> to adapt the new <a href="https://social.stefanberger.net/tags/passkeys" class="mention hashtag" rel="nofollow noopener" target="_blank">#passkeys</a> APIs. <a href="https://hachyderm.io/@rmondello/114813337794341023" rel="nofollow noopener" translate="no" target="_blank">https://hachyderm.io/@rmondello/114813337794341023</a>

Leonardo<a href="https://www.zdnet.com/article/how-passkeys-work-the-complete-guide-to-your-inevitable-passwordless-future/" rel="nofollow noopener" translate="no" target="_blank">https://www.zdnet.com/article/how-passkeys-work-the-complete-guide-to-your-inevitable-passwordless-future/</a> <a href="https://mastodon.social/tags/passkeys" class="mention hashtag" rel="nofollow noopener" target="_blank">#passkeys</a> <a href="https://mastodon.social/tags/security" class="mention hashtag" rel="nofollow noopener" target="_blank">#security</a>

gtbarryMicrosoft Will Delete Your Passwords in One Month: Do This ASAPStarting in August, Microsoft will require you to use passkeys instead of keeping all of your Microsoft passwords on its mobile app, and your old passwords will vanish. <a href="https://mastodon.social/tags/microsft" class="mention hashtag" rel="nofollow noopener" target="_blank">#microsft</a> <a href="https://mastodon.social/tags/passwords" class="mention hashtag" rel="nofollow noopener" target="_blank">#passwords</a> <a href="https://mastodon.social/tags/password" class="mention hashtag" rel="nofollow noopener" target="_blank">#password</a> <a href="https://mastodon.social/tags/authenticator" class="mention hashtag" rel="nofollow noopener" target="_blank">#authenticator</a> <a href="https://mastodon.social/tags/passkeys" class="mention hashtag" rel="nofollow noopener" target="_blank">#passkeys</a> <a href="https://mastodon.social/tags/security" class="mention hashtag" rel="nofollow noopener" target="_blank">#security</a> <a href="https://mastodon.social/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#cybersecurity</a><a href="https://www.cnet.com/tech/microsoft-will-delete-your-passwords-in-one-month-do-this-asap/" rel="nofollow noopener" translate="no" target="_blank">https://www.cnet.com/tech/microsoft-will-delete-your-passwords-in-one-month-do-this-asap/</a>

CliffNot really surprised to see this. Microsoft Authenticator is ending support for passwords.<a href="https://www.theverge.com/news/695288/microsoft-authenticator-autofill-store-passwords" rel="nofollow noopener" translate="no" target="_blank">https://www.theverge.com/news/695288/microsoft-authenticator-autofill-store-passwords</a><a href="https://infosec.exchange/tags/MS" class="mention hashtag" rel="nofollow noopener" target="_blank">#MS</a> <a href="https://infosec.exchange/tags/Microsoft" class="mention hashtag" rel="nofollow noopener" target="_blank">#Microsoft</a> <a href="https://infosec.exchange/tags/Authenticator" class="mention hashtag" rel="nofollow noopener" target="_blank">#Authenticator</a> <a href="https://infosec.exchange/tags/Password" class="mention hashtag" rel="nofollow noopener" target="_blank">#Password</a> <a href="https://infosec.exchange/tags/Passkeys" class="mention hashtag" rel="nofollow noopener" target="_blank">#Passkeys</a> <a href="https://infosec.exchange/tags/Apps" class="mention hashtag" rel="nofollow noopener" target="_blank">#Apps</a> <a href="https://infosec.exchange/tags/News" class="mention hashtag" rel="nofollow noopener" target="_blank">#News</a> <a href="https://infosec.exchange/tags/Tech" class="mention hashtag" rel="nofollow noopener" target="_blank">#Tech</a> <a href="https://infosec.exchange/tags/TechNews" class="mention hashtag" rel="nofollow noopener" target="_blank">#TechNews</a>

⁉️For the first time today, I tried to save a Passkey to KeePassium. But I get an error message on iOS.<a href="https://mastodon.social/@KeePassium" class="u-url mention" rel="nofollow noopener" target="_blank">@KeePassium</a> <a href="https://mastodon.social/tags/KeePassium" class="mention hashtag" rel="nofollow noopener" target="_blank">#KeePassium</a> <a href="https://mastodon.social/tags/iOS" class="mention hashtag" rel="nofollow noopener" target="_blank">#iOS</a> <a href="https://mastodon.social/tags/Autofill" class="mention hashtag" rel="nofollow noopener" target="_blank">#Autofill</a> <a href="https://mastodon.social/tags/Passkey" class="mention hashtag" rel="nofollow noopener" target="_blank">#Passkey</a> <a href="https://mastodon.social/tags/Passkeys" class="mention hashtag" rel="nofollow noopener" target="_blank">#Passkeys</a>

WinbuzzerMicrosoft Sunsets Password Autofill in Authenticator, Pushing Users to Edge<a href="https://mastodon.social/tags/Microsoft" class="mention hashtag" rel="nofollow noopener" target="_blank">#Microsoft</a> <a href="https://mastodon.social/tags/Authenticator" class="mention hashtag" rel="nofollow noopener" target="_blank">#Authenticator</a> <a href="https://mastodon.social/tags/MicrosoftEdge" class="mention hashtag" rel="nofollow noopener" target="_blank">#MicrosoftEdge</a> <a href="https://mastodon.social/tags/Cybersecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#Cybersecurity</a> <a href="https://mastodon.social/tags/Passwordless" class="mention hashtag" rel="nofollow noopener" target="_blank">#Passwordless</a> <a href="https://mastodon.social/tags/Passkeys" class="mention hashtag" rel="nofollow noopener" target="_blank">#Passkeys</a><a href="https://winbuzzer.com/2025/07/04/microsoft-sunsets-password-autofill-in-authenticator-pushing-users-to-edge-xcxwbn/" rel="nofollow noopener" translate="no" target="_blank">https://winbuzzer.com/2025/07/04/microsoft-sunsets-password-autofill-in-authenticator-pushing-users-to-edge-xcxwbn/</a>

Ian Brown 👨🏻‍💻As requested from several directions, I tried to update my expert profile on the EU's experts website, since <a href="https://social.ngi.eu/@ngi" class="u-url mention" rel="nofollow noopener" target="_blank">@ngi</a> is looking for more reviewers. But as usual, the horror of the EC's own login system (WHY!) struck again (<a href="https://eupolicy.social/tags/ECAS" class="mention hashtag" rel="nofollow noopener" target="_blank">#ECAS</a>).WHY DOESN'T IT USE STANDARD WEB TECHNOLOGIES LIKE <a href="https://eupolicy.social/tags/PASSKEYS" class="mention hashtag" rel="nofollow noopener" target="_blank">#PASSKEYS</a>!!I STILL CAN'T ACTIVATE 2FA AND I HAVE THE EU LOGIN APP SET UP ON MY IPHONE!GAAAAAAAAAAAAAH! 🤯

Erik van Straten<a href="https://infosec.exchange/@relishthecracker" class="u-url mention" rel="nofollow noopener" target="_blank">@relishthecracker</a> : that's make belief."Wow, asymmetric encryption, even quantum-computer-proof", "military-grade", etcetera.Right after logging in using a passkey with an unbreakably protected private key, the website sends a session cookie (or similar) to the browser - which is NOT protected like private keys. If a website (like most of them) does not log you out if your IP-address changes, such a cookie is nearly as bad as a password. And fully if the cookie never expires.Therefore:1️⃣ Even if attackers cannot copy private keys: if the user device is sufficiently compromised (i.e. on Android, running an accessibility service), they can take over all of the user's accounts;2️⃣ If the user's browser is compromised, attackers can copy session cookies and use them to obtain access to accounts the user logs in to;3️⃣ An AitM (Attacker in the Middle) using a malicious website can copy/steal authentication cookies. Such AitM-attacks are possible in at least the following cases if either:• A malicious third party website manages to obtain a fraudulently issued certificate (examples: <a href="https://infosec.exchange/@ErikvanStraten/112914050216821746" rel="nofollow noopener" translate="no" target="_blank">https://infosec.exchange/@ErikvanStraten/112914050216821746</a>);• An attacker obtains unauthorised write access to the website's DNS record;• An attacker manages to obtain access to a server where a "dangling" (forgotten) subdomain name points to, *AND* the real authenticating server (RP) does not carefully check for allowed subdomains (see <a href="https://github.com/w3ctag/design-reviews/issues/97#issuecomment-175766580" rel="nofollow noopener" translate="no" target="_blank">https://github.com/w3ctag/design-reviews/issues/97#issuecomment-175766580</a>);4️⃣ The server is compromised or has a rogue admin: the attacker can add their passkey's public key to your account, or replace your public key with theirs (note that passkey pubkeys are not encapsulated by certificates issued by trusted issuers, stating who owns the public key).Phishing using fake websites is probably the number one problem on the internet. *THE* major advantage of passkeys is that they make phishing attacks VERY HARD.Indeed, if your device is sufficiently compromised, the risk of all of your passwords being stolen if you use a password manager is BIG.However, as I wrote, if your device is sufficiently compromised, an attacker does not need access to your private keys in order to obtain access to your accounts.<a href="https://sigmoid.social/@oliversampson" class="u-url mention" rel="nofollow noopener" target="_blank">@oliversampson</a> <a href="https://cathode.church/@kaye" class="u-url mention" rel="nofollow noopener" target="_blank">@kaye</a> <a href="https://infosec.exchange/tags/Passkeys" class="mention hashtag" rel="nofollow noopener" target="_blank">#Passkeys</a> <a href="https://infosec.exchange/tags/PasswordManagers" class="mention hashtag" rel="nofollow noopener" target="_blank">#PasswordManagers</a> <a href="https://infosec.exchange/tags/DomainNames" class="mention hashtag" rel="nofollow noopener" target="_blank">#DomainNames</a> <a href="https://infosec.exchange/tags/Phishing" class="mention hashtag" rel="nofollow noopener" target="_blank">#Phishing</a> <a href="https://infosec.exchange/tags/AitM" class="mention hashtag" rel="nofollow noopener" target="_blank">#AitM</a> <a href="https://infosec.exchange/tags/MitM" class="mention hashtag" rel="nofollow noopener" target="_blank">#MitM</a> <a href="https://infosec.exchange/tags/Cryptography" class="mention hashtag" rel="nofollow noopener" target="_blank">#Cryptography</a> <a href="https://infosec.exchange/tags/MilitaryGrade" class="mention hashtag" rel="nofollow noopener" target="_blank">#MilitaryGrade</a> <a href="https://infosec.exchange/tags/Authentication" class="mention hashtag" rel="nofollow noopener" target="_blank">#Authentication</a> <a href="https://infosec.exchange/tags/Impersonation" class="mention hashtag" rel="nofollow noopener" target="_blank">#Impersonation</a> <a href="https://infosec.exchange/tags/FakeWebsites" class="mention hashtag" rel="nofollow noopener" target="_blank">#FakeWebsites</a> <a href="https://infosec.exchange/tags/ATO" class="mention hashtag" rel="nofollow noopener" target="_blank">#ATO</a> <a href="https://infosec.exchange/tags/AccountTakeOver" class="mention hashtag" rel="nofollow noopener" target="_blank">#AccountTakeOver</a> <a href="https://infosec.exchange/tags/Passwords" class="mention hashtag" rel="nofollow noopener" target="_blank">#Passwords</a> <a href="https://infosec.exchange/tags/SharedSecrets" class="mention hashtag" rel="nofollow noopener" target="_blank">#SharedSecrets</a> <a href="https://infosec.exchange/tags/AsymmetricCryptography" class="mention hashtag" rel="nofollow noopener" target="_blank">#AsymmetricCryptography</a> <a href="https://infosec.exchange/tags/SubDomains" class="mention hashtag" rel="nofollow noopener" target="_blank">#SubDomains</a> <a href="https://infosec.exchange/tags/DanglingSubDomains" class="mention hashtag" rel="nofollow noopener" target="_blank">#DanglingSubDomains</a>

Peter Steiner 🇨🇭🇺🇦(he/him)Eigentlich müsste ein erneutes Einloggen heutzutage ja schnell und schmerzlos möglich sein, es gibt ja Passkeys. Funktioniert mit Onleihe 2.0 leider nicht: <a href="https://mastodon.green/@pesche/114784018802642590" rel="nofollow noopener" translate="no" target="_blank">https://mastodon.green/@pesche/114784018802642590</a>2/x<a href="https://mastodon.green/tags/onleihe2" class="mention hashtag" rel="nofollow noopener" target="_blank">#onleihe2</a> <a href="https://mastodon.green/tags/passkeys" class="mention hashtag" rel="nofollow noopener" target="_blank">#passkeys</a>

Erik van Straten<a href="https://sigmoid.social/@oliversampson" class="u-url mention" rel="nofollow noopener" target="_blank">@oliversampson</a> <a href="https://cathode.church/@kaye" class="u-url mention" rel="nofollow noopener" target="_blank">@kaye</a> Primary passkeys advantage: • With some uncommon exceptions, you cannot (be persuaded to) log in to a phishing website with a (slightly) different domain name *USING A PASSKEY* (see below) - because software (not you) checks the domain name.Some passkeys disadvantages: • Typically you yourself do not have access to each passkey's private key (*)(usually you can't back them up/export them). Risks: vendor lock-in and losing access to accounts.• Because there's a risk of losing access to passkeys and thus to accounts, usually accounts can also be accessed using a rescue code - which renders them phishable again.• Implementation errors (both Apple and Android suffered from them, and probably still do - I did not check today).(*) For each new passkey, your device generates a unique complementary keypair. The public key is stored in your account on the server and is used to verify that your device has access to the complementary private key, which is kept secret. However, even if attackers do not have access to your private key(s), there are other ways for them to obtain access your account(s).A reasonable alternative to passkeys is using a password manager that "integrates" with the browser to verify the domain name of the site you're logging in to. Android and iOS "Autofill" provide such a bridge between password managers and browsers (without requiring browser plug-ins).<a href="https://infosec.exchange/tags/Passkeys" class="mention hashtag" rel="nofollow noopener" target="_blank">#Passkeys</a> <a href="https://infosec.exchange/tags/PasswordManagers" class="mention hashtag" rel="nofollow noopener" target="_blank">#PasswordManagers</a> <a href="https://infosec.exchange/tags/DomainNames" class="mention hashtag" rel="nofollow noopener" target="_blank">#DomainNames</a> <a href="https://infosec.exchange/tags/Phishing" class="mention hashtag" rel="nofollow noopener" target="_blank">#Phishing</a> <a href="https://infosec.exchange/tags/AitM" class="mention hashtag" rel="nofollow noopener" target="_blank">#AitM</a> <a href="https://infosec.exchange/tags/MitM" class="mention hashtag" rel="nofollow noopener" target="_blank">#MitM</a>

Karl Voit :emacs: :orgmode:<a href="https://social.bund.de/@bsi" class="u-url mention" rel="nofollow noopener" target="_blank">@bsi</a> Nitpicking: gerade bei <a href="https://graz.social/tags/Passkeys" class="mention hashtag" rel="nofollow noopener" target="_blank">#Passkeys</a> besteht die Möglichkeit, über die Cloud auch anderen Personen Zugriff zu geben. Daher muss man mit Passkeys genau aufpassen, wem man hier Rechte eingeräumt hat.Daher sind Passkeys auch in solchen Fällen leider anfällig auf <a href="https://graz.social/tags/Phishing" class="mention hashtag" rel="nofollow noopener" target="_blank">#Phishing</a> (Angreifer gibt vor, Freund zu sein).Aber immer noch besser als fast alle anderen Authentifizierungsmethoden. 👍 Nur HW-Tokens mit <a href="https://graz.social/tags/FIDO2" class="mention hashtag" rel="nofollow noopener" target="_blank">#FIDO2</a> sind besser, da sie die privaten Keys nicht auslesbar speichern.

Oliver Sampson<a href="https://cathode.church/@kaye" class="u-url mention" rel="nofollow noopener" target="_blank">@kaye</a> I completely agree and instinctively refused using <a href="https://sigmoid.social/tags/passkeys" class="mention hashtag" rel="nofollow noopener" target="_blank">#passkeys</a> without even thinking why.

Karsten Schmidt<a href="https://mastodon.gamedev.place/@jonikorpi" class="u-url mention" rel="nofollow noopener" target="_blank">@jonikorpi</a> <a href="https://mastodon.gamedev.place/@aeva" class="u-url mention" rel="nofollow noopener" target="_blank">@aeva</a> There are quite a few well documented usability and vendor/platform lock-in issues with <a href="https://mastodon.thi.ng/tags/passkeys" class="mention hashtag" rel="nofollow noopener" target="_blank">#passkeys</a> though, some not immediately obvious to most users. I too still remain unconvinced they're an improvement over using a x-platform password manager...<a href="https://arstechnica.com/security/2024/12/passkey-technology-is-elegant-but-its-most-definitely-not-usable-security/" rel="nofollow noopener" translate="no" target="_blank">https://arstechnica.com/security/2024/12/passkey-technology-is-elegant-but-its-most-definitely-not-usable-security/</a><a href="https://proton.me/blog/big-tech-passkey" rel="nofollow noopener" translate="no" target="_blank">https://proton.me/blog/big-tech-passkey</a>

Recent searches

Search options

Administered by:

Server stats:

#Passkeys