My fingerprint dongle says "cross-platform" but no, I don't see a penguin on the product page
I started by buying one for my home PC, thinking that if it worked I'd soon buy another for the work PC, well it does work, but I haven't felt like shelling out for the second one yet ...
Maybe they can, but I do not 'sign in ' to my linux device 'with a PIN'. Nor my android phone. Since it fundamentally a security hole bigger than Trumps arsehole, I see no point in making it more complicated to use than it already is. It just does secure things, like receive boring texts and whatsapp messages, that have no value to anyone but me. And disposable one time
2FA codes. The nearest thing to personal information it has is the list of people in its contacts and the list of places in TomTom Go.It does have my mail passwords but if I lose it it would take 15 seconds here to change those from any desktop anywhere.
As this thread has demonstrated, people are wary of passkeys, either because they haven't heard of them, don't understand them, or are suspicious why they are being 'forced' onto them ...
There's probably no chance of Joe Public understanding the tech, but then Joe Public probably thinks websites store passwords "as entered" and compare the value when logging-on, rather than comparing hashes ...
In general, Joe Public does not think.
?? Are Google and MS not mega-corporations? Together with Amazon, they are the first names that come to mind if that category is mentioned.
One major issue is the tendency for Big Tech who don't do customer support to wash their hands of you if you lose your passkey. 'Oh, you wrote down the 6 digit recovery codes but we changed them to 9 digits, sorry you're out of luck. That account cannot be recovered now'. (this actually happened to me this week)
For banks there's always a backup route by sending you a letter or going into a branch with your passport, but that costs money and trillion dollar online companies are tightwads.
Theo
If I'm not on my computer which has the fingerprint reader, i can just login to amazon with password instead, and if I forgot the password I could request a reset email. I did have MFA enabled, but found that negated the convenience of fingerprint logon.
To slightly change topic, has anyone noticed a new trend for requiring an email address without password, then emailing a single-use login link?
So far STwater and Rightmove seem to be doing this, seems more of a faff than letting users store the password in a password manager, any other sites part of this trend?
All sorts of crap are appearing.
Usual one for me is a name/password and THEN an SMS message with a one-time key
NHS sends me one time links, but they are almost useless since I cant transfer them from phone to computer except by typing
Fortunately I can log in to the various NHS apps and navigate to the 'new documents' section anyway.
thats not much different to what PayPal do
and not much different from using a PinSentry to get access to an online bank account
Maybe it's been a long time since I used paypal, I have a password and MFA by my phone authenticator set.
But it's hassle if the email link arrives on a different device than the one you were trying to login from.
They sent me a text message when I used it yestaerday
The bank doesnt send an email - it asks you to use the PinSentry and you then enter the number
But I will admit that just having the PinSentry is also a bit of a faff (although I have 2 of them)
I don't mind the hassle of a pinsentry (I have the app on my phone and the backup option of a physical pinsentry) it does provide security.
But rightmove and the water board don't need extra levels of security, just a password (with email reset facility) would suffice.
As the meme (approximately) goes: "Why do I have to prove who I am to pay a bill? I don't mind if someone else fraudulently pays it."
and that goes straight to the heart of the https "problem"
It's phishing protection. You might be using a password manager, but other people could be tricked into entering their details into a fake site. The law requires that some kind of 2FA is involved, and they have decided that since you're going to have to do an email 2FA anyway you might as well skip the password step.
Slack does it too, and I'm sure I've seen it on other sites as well. At least with Slack they email you a login code. It gets annoying when they require you to click a link in the email, when you may be logging in on a computer that doesn't have access to your email.
Theo
Have something to add? Share your thoughts — no account required.
Ask the community — no account required