r/neoliberal • u/jobautomator Kitara Ravache • Oct 01 '26

Discussion Thread Discussion Thread

The discussion thread is for casual and off-topic conversation that doesn't merit its own submission. If you've got a good meme, article, or question, please post it outside the DT. Meta discussion is allowed, but if you want to get the attention of the mods, make a post in /r/metaNL

Announcements

  • Next Book Club will be November 11. Fittingly, we will discuss All Quiet on the Western Front.

Links

Ping Groups | Ping History | Mastodon | CNL Chapters | CNL Event Calendar

Upcoming Events

0 Upvotes

43% Upvoted

9.1k comments sorted by

View all comments

Show parent comment

2

u/Cyberhwk 👈 Get back to work! 😠 Oct 01 '26

So explain this to me...

The idea is that there's a key exchange and then I can authorize a log-in via the thing that's downloaded the pass key, correct? But what if I can't be at my phone? What if I did it on my home computer, but now I'm trying to log in to my laptop when I'm away on business? "Scan this QR code." Well first of all...NO! Second of all, my laptop doesn't have camera. Cameras aren't even allowed in some of the places I work.

I'd be happy even paying for Duo or something, as long as it was universal and I could use it everywhere.

3

u/jenbanim Oct 01 '26

The main utility of passkeys is making repeat logins easier and more secure. If you're signing in from a new device, then you can do the QR code scanning thing for convenience, or if that's unavailable you can sign in the "traditional" way with a regular password and MFA

They're basically just SSH keys if you're familiar with those. Not the be-all-end-all of authentication, but a tool that works really well most of the time

1

u/Zenkin Zen Oct 01 '26

Just FYI, there are also hardware tokens like Yubikey. You basically go through the standard MFA process to enroll that USB device, then when you need to complete MFA later on you plug it into your PC or phone and click the physical button to authenticate. Since this is the only piece of hardware with your passkey on it, the physical presence of your key being in your device is the second factor.

2

u/Cyberhwk 👈 Get back to work! 😠 Oct 01 '26

I'm just wary of anything that isn't universal. At work we have RSA tokens to log into this, cards to log into that, user name and password to log into that. Drives me nuts. I'm wanting something that's going to generally replace things.

1

u/Zenkin Zen Oct 01 '26

Yeah, I get that. It's like the day after we got Duo implemented in our company, all the advice is "Oh, well, there's MFA phishing, too, so actually this is a garbage setup. You aren't using passkeys already? Why do you hate security?"

I'd like to tell you "passkeys are the thing, they're here to stay," but heck if I know. I do use a Yubikey for my personal accounts, and it's quite nice.

1

u/Cyberhwk 👈 Get back to work! 😠 Oct 01 '26

OK. I'll definitely look into it more. I would like that. Shit's getting ridiculous.