Post #2238403

2026-04-15 23:02 UTC

@JensHannemann@mastodon.online Well, they might not have been intended to be 2FA, but most people talk of them this way, and I hear very zero about passkeys need a 2FA token in addition to them. But the whole 2FA thing failed once the token was merged to the phone and 2FA codes were saved to the same password manager that has all the passwords and allowed to access both from either the computer or your phone. I pointed this out years ago, but most people just shrugged and accepted the risk of not actually having 2FA anymore.

Replies (2)

@JensHannemann@mastodon.online 2026-04-15 23:17

@encthenet@flyovercountry.social I get your point. That’s why I definitely prefer physical tokens like YubiKeys. The one with USB-C and NFC really works nicely even on phones. And you can protect them with a PIN so a physical loss is also manageable as long as you have a second one in a secure location.

Open ##2238404
@bob_zim@infosec.exchange 2026-04-17 19:32

@encthenet@flyovercountry.social @JensHannemann@mastodon.online That’s ultimately why “2FA” is a bad concept, as is know/have/are. The only real distinction in authentication is symmetric versus asymmetric. Symmetric authentication ultimately always involves a shared secret. Passwords. RSA tokens. Yubikeys. It’s all shared between you and the service. Someone pops the service, they can impersonate you later. If a combination of two passwords doesn’t count as “2FA”, then neither does a combination of any two symmetric tokens. Asymmetric authentication for users is pretty much just SSH keys, x509 client certs, and passkeys. Pop the site and you don’t get the ability to impersonate the user.

Open ##2238405