近期出现的关于Passkeys安全风险的论断遭到驳斥。1大多数用户采用的同步型Passkeys（存储于iCloud Keychain、Google Password Manager等服务中）并不提供证明信息，网站因此无法以缺乏证明为由锁定用户账户。1WebAuthn证明信息的作用仅限于识别认证器的型号，与操作系统、浏览器、扩展程序或设备是否获得root权限无关。1
一键通行码（TOTP）容易被Evilginx等钓鱼工具进行中继攻击，而Passkeys因绑定特定域名而天然具备抗中间人和钓鱼攻击的能力。1YubiKey等硬件密钥本身即支持证明功能。1此外，大型服务商并不支持消费者网站的证明要求，行业指导意见多年来都不建议网站请求证明信息。1基于这些事实，业界建议继续将Passkeys作为当前最佳的账户保护方案。1
A recent defense of passkey technology challenges misconceptions about their security and implementation. The author rebuts claims that passkeys pose risks, arguing that synced passkeys—the type most users employ through services like iCloud Keychain and Google Password Manager—do not provide attestation information, meaning websites cannot lock users out based on such data 1. Furthermore, WebAuthn attestation only identifies the authenticator model via AAGUID and contains no information about the operating system, browser, extensions, or device jailbreak status 1.
The author emphasizes that passkeys offer superior protection against phishing compared to existing alternatives. TOTP codes are vulnerable to relay attacks through tools like Evilginx, whereas passkeys resist both man-in-the-middle and phishing attacks due to their binding to specific domains 1. Notably, the YubiKey hardware security key itself supports attestation, contradicting suggestions that it should be recommended as an alternative 1. Industry guidance from major service providers has consistently advised against requiring attestation for consumer-facing websites, a position maintained over many years 1. Based on this analysis, the author recommends continued use of passkeys as the strongest available account protection method.
评论
还没有评论，欢迎留下第一条。