Hearted Youtube comments on IBM Technology (@IBMTechnology) channel.

  1. 1300
  2. 312
  3. 298
  4. 291
  5. 241
  6. 200
  7. 190
  8. 133
  9. 124
  10. 114
  11. 110
  12. 104
  13. 84
  14. 72
  15. 71
  16. 69
  17. 62
  18. I’ve seen a lot of the same questions repeated so here’s a list of FAQs that I hope will help: 1) What do I do if I lose the device containing the private key? What do you do when you lose your password? You recover your account on the web site with a “forgot password” or similar procedure. Nothing prevents a similar account recovery with FIDO. Also, see #2 … 2) What if I have multiple devices? While not specifically part of the FIDO spec, private keys can be synced across devices the same way that password managers like 1Password and iCloud Keychain can, for example. These tools encrypt passwords and sync them to multiple devices that have been authenticated and authorized by the user. Same for the private keys with FIDO. 3) Isn’t this just SSH? PGP? SSL/TLS? Similar but different. All of these leverage PKI (e.g., private/public keys, certificates, etc.) but apply them in different ways. SSH, for instance, is focused on securing the user’s session and typically does not run over HTTP (i.e., web sites). TLS (formerly SSL) also secures the session but is specifically for web sites. FIDO is not focused on data confidentiality/privacy but rather on authentication (i.e., proving the user is who they claim to be) and provides a means for integration with many common security hardware tokens, mobile phones, etc. which can control access to the private key. 4) What’s wrong with just continuing to use passwords? Passwords can be phished. Passwords can be cracked if they aren’t chosen well. Passwords can be discovered if the web site experiences a breach. Once compromised, passwords can be used again and again by an attacker. Passkeys essentially avoid all these problems. They have a specified lifetime, which is relatively short, preventing reuse and can’t be phished or discovered easily because the private key that creates them never leaves the device (except in case #2 above, of course). Passwords are the secret and that is sent over a vulnerable Internet and stored in a potentially vulnerable web server. The private key used to generate a passkey stays on the device, thereby, reducing the attack surface greatly. 5) Why not just keep using a pw manager instead of switching to passkeys? First of all, see #4 above. Secondly, the good pw managers actually support both passwords and passkeys these days so it’s really not and either/or. If you like your password manager, you can probably continue using it. 6) What if I want to login from a public terminal or my friend’s laptop? I recommend that you don’t. If you don’t control the security on the system, you should consider everything you type on it to be public information — including passwords. Why? Because the device might be infected with a key logger. Finally, here’s a link to the FIDO Alliance explanation of how it works: https://fidoalliance.org/how-fido-works/
    59
  19. 57
  20. 54
  21. 53
  22. 52
  23. 49
  24. 46
  25. 44
  26. 43
  27. 43
  28. 41
  29. 39
  30. 38
  31. 38
  32. 37
  33. 35
  34. 35
  35. 35
  36. 33
  37. 33
  38. 33
  39. 32
  40. 31
  41. 31
  42. 31
  43. 30
  44. 30
  45. 29
  46. 29
  47. 29
  48. 28
  49. 26
  50. 26