On this episode of The Vergecast, we figure out passkeys once and for all.

Passkeys: how do they work? No, like, seriously. It’s clear that the industry is increasingly betting on passkeys as a replacement for passwords, a way to use the internet that is both more secure and more user-friendly. But for all that upside, it’s not always clear how we, the normal human users, are supposed to use passkeys. You’re telling me it’s just a thing… that lives on my phone? What if I lose my phone? What if you steal my phone?

  • @[email protected]English
    1•10 months ago

    Is it possible to use some kind of fingerprinting to identify people? It works for marketers, could that idea be used for security?

    I am a total noob who is interested, if I come across as uninformed it is because I am.

    • @[email protected]English
      3•10 months ago

      Totally! Browser and device fingerprinting are commonly used as first-line defenses against ATOs (account takeovers). There are other kinds of fingerprinting, like those that can learn about your installed hardware and drivers. Really, I’m learning about more fingerprinting methods all the time. That said, decisions are usually made based on several different information sources. These include variables like:

      • GPS geolocation
      • IP address/location
      • Time of day
      • Device ID, OS version, browser version, etc.
      • Hardware profiles, including CPU and GPU architecture/drivers
      • User behavior like mouse movement, typing patterns, and scrolling
      • Whether the user is connecting via a known VPN IP address
      • Cookies and extensions installed on the browser

      There’s even some buzz around “behavioral biometrics” to identify individuals by how they type, but this is still not the sole method of identification. It’s mainly about flagging bots who don’t type like humans. However, learning how an individual types can help you determine if a subsequent visitor is the actual account owner or a bad actor.

      In my experience, fingerprinting and adjacent identity proofs are rarely used in isolation. They’re often employed for step-up authentication. That means if something doesn’t match up, you get hit with a 2FA/MFA prompt.

      Step-up can be pretty complex if you want it to be, though, with tons of cogs and gears in the background making real-time adjustments. Like you might not even realize you’ve been restricted during a session when you log in to your bank account, but once you try to make a transfer, you’ll get an MFA prompt. That’s the UX people in action, trying to minimize friction while maintaining security.