CIRCLE WITH A DOT

@thenewoil and yet, passkeys are still single-source authenticators. As a result, they are not as secure as proper 2FA systems, simply better than passwords alone.#security #sysadmin #fud

Microsoft ergänzt Passkey-Option in Entra-ID-RegistrierungskampagnenAb April dieses Jahres will Microsoft Passkey-Unterstützung zu Entra-ID-Registrierungskampagnen hinzufügen.https://www.heise.de/news/Microsoft-ergaenzt-Passkey-Option-in-Entra-ID-Registrierungskampagnen-11215078.html?wt_mc=sm.red.ho.mastodon.mastodon.md_beitraege.md_beitraege&utm_source=mastodon#EntraID #IT #Microsoft #Passkey #Security #news

Yahoo has pulled some shady shit with how you sign in to email from Apple devicesSo my mom tells me she can't get email from any of her devices. Turns out Yahoo had signed her out everywhere: Mac, iPhone, iPad. I had to help tet her signed back in on everythingIt turns out they've broken the sign-in process in the following ways. Note this is *entirely* in the native account sign-in flow in Settings:- They've somehow broken password managers in the webview so 1Password won't fill username/password. You have to switch back & forth copying/pasting- They've broken #passkey support here as well, I'm guessing due to whatever they did to break password managers. So you get downgraded to a less secure 2FA mechanism like SMS- And here’s the kicker: they're injecting a super aggressive interstitial in the sign-in WebView that tries to trick you into downloading the Yahoo Mail app instead of signing in to Mail.appThere's literally no way my mom could have navigated this. She 100% would have ended up installing an app she doesn't need because Yahoo told her to and because Apple Mail was "broken." I obviously don't *know* what's behind the forced sign-outs and the breaking of password managers and passkeys, but given the aggressive upselling of the Yahoo app, it really seems intentionalcc @rmondello because passkeys

One site I use fully turned off the ability to sign in without setting up a #Passkey. That's great for them (I guess), but I don't want my phone to hold the passkey, that right belongs to KeePassXC. Turns out, there is no competent flow they made that allows for this, oh and they still force you to verify via an SMS code (very, very insecure). Then it asked me to do a biometric authentication with a biometric device (no such thing on this desktop). Amateur. Can't log in via the old method, and can't set up the new method. This is not how you deploy a passkey future