Hearted Youtube comments on IBM Technology (@IBMTechnology) channel.
-
1300
-
312
-
298
-
291
-
241
-
200
-
190
-
133
-
124
-
114
-
110
-
104
-
84
-
72
-
71
-
69
-
62
-
I’ve seen a lot of the same questions repeated so here’s a list of FAQs that I hope will help:
1) What do I do if I lose the device containing the private key?
What do you do when you lose your password? You recover your account on the web site with a “forgot password” or similar procedure. Nothing prevents a similar account recovery with FIDO. Also, see #2 …
2) What if I have multiple devices?
While not specifically part of the FIDO spec, private keys can be synced across devices the same way that password managers like 1Password and iCloud Keychain can, for example. These tools encrypt passwords and sync them to multiple devices that have been authenticated and authorized by the user. Same for the private keys with FIDO.
3) Isn’t this just SSH? PGP? SSL/TLS?
Similar but different. All of these leverage PKI (e.g., private/public keys, certificates, etc.) but apply them in different ways. SSH, for instance, is focused on securing the user’s session and typically does not run over HTTP (i.e., web sites). TLS (formerly SSL) also secures the session but is specifically for web sites. FIDO is not focused on data confidentiality/privacy but rather on authentication (i.e., proving the user is who they claim to be) and provides a means for integration with many common security hardware tokens, mobile phones, etc. which can control access to the private key.
4) What’s wrong with just continuing to use passwords?
Passwords can be phished. Passwords can be cracked if they aren’t chosen well. Passwords can be discovered if the web site experiences a breach. Once compromised, passwords can be used again and again by an attacker. Passkeys essentially avoid all these problems. They have a specified lifetime, which is relatively short, preventing reuse and can’t be phished or discovered easily because the private key that creates them never leaves the device (except in case #2 above, of course). Passwords are the secret and that is sent over a vulnerable Internet and stored in a potentially vulnerable web server. The private key used to generate a passkey stays on the device, thereby, reducing the attack surface greatly.
5) Why not just keep using a pw manager instead of switching to passkeys?
First of all, see #4 above. Secondly, the good pw managers actually support both passwords and passkeys these days so it’s really not and either/or. If you like your password manager, you can probably continue using it.
6) What if I want to login from a public terminal or my friend’s laptop?
I recommend that you don’t. If you don’t control the security on the system, you should consider everything you type on it to be public information — including passwords. Why? Because the device might be infected with a key logger.
Finally, here’s a link to the FIDO Alliance explanation of how it works:
https://fidoalliance.org/how-fido-works/
59
-
57
-
54
-
53
-
52
-
49
-
46
-
44
-
43
-
43
-
41
-
39
-
38
-
38
-
37
-
35
-
I just landed my first role as an SRE. I was a professional Chef back in 2021 and decided to chase what I wanted to do in life. I immersed myself in the world. Got two AWS certs, took comp sci classes at college, learned Linux, python, html/css, JS, bash scripting, cloud IaC technologies, Jenkins and other cicd tools.... Everything I could get my hands on. To me, I love the idea that the stack is one giant living and breathing monster that you can access and tame and just seeing it all work together is awe inspiring to me. I am so excited about my new position, it encompasses my love for problem solving, infrastructure and automation. Really looking forward to it, but also very nervous because I know I still have a lot of learning to do!!
35
-
35
-
33
-
33
-
33
-
32
-
31
-
31
-
31
-
30
-
30
-
29
-
29
-
29
-
28
-
26
-
26