Going Passwordless Without Going Passwordless

[@askleonotenboom]

✅ Watch next ▶ How Do Websites Keep Passwords Secure? ▶ kzbin.info/www/bejne/qYumk4Gip6pjorM

[@kersi-sandiego6036]

Nice haircut. I tried cutting corners and had my wife cut my hair. She gave me the Larry Fein. Looks terrible. Nice succinct video.

[@RVideoR]

Congratulations 🎉🎉🎉 100K subscribers 😊 ..

[@himanshuchhabra1942]

Twitter still does not offer passkey option. If its so secure and easy to setup and use, why every major website is not prompting its customers to setup passkey yet ??

[@askleonotenboom]

It's going to take time. It's not a trivial implementation. I will say that I am seeing more sites begin to offer it. I would expect Twitter to be one of the last TBH. They have enough problems as is.

[@philuribe7863]

And if someone steals your phone.... suddenly they have access to your account(s)? Some kind of 2fa is needed.

[@askleonotenboom]

They do not, unless they can convince the phone they are you (PIN/biometrics) every time a passkey is attempted.

[@philuribe7863]

@@askleonotenboom So if it then comes down to a PIN - usually 4 to 6 numbers. - how is that safer than a password?

[@askleonotenboom]

@@philuribe7863 It's unique to the device, and requires you have access to the device. Remember, no solution is perfect. If you have a password manager on your device you're often in nearly the same boat.

[@D.von.N]

@@askleonotenboom have seen pin hacked by a software in seconds on a locked phone.

[@philuribe7863]

@@askleonotenboom Hmm.. I still prefer passwords. I can't bring myself to trust password managers. Besides, it's just more faff to deal with. .. I have all mine written down in plain text... but it won't do anyone any good to find them, because in fact they're only half the password. The other half is a random string that is appended to all of them that is kept only in my head. So all I have to remember is that one string - as I say, it's nothing obvious, but it's ingrained in my memory. Meh - I've managed to stay safe for 35 years. (He says, looking frantically around for some wood to knock!)

[@Melker63]

I have tried to go passwordless on my M-account, but I have 2FAS authenticator - not Microsoft authenticator. Also I have 2FA for Microsoft already configured on 2FAS. Must I configure a second entry just to go passwordless? Also I get a QR-code with no manual option. Should I log in windows my PC and scan the QR with my 2FAS app? I say - instructions could be improved upon.

[@Michelvan]

How does this work with Outlook or other email readers on a phone or a computer? I guess the pw will be needed as it is now.

[@askleonotenboom]

It depends on the email service you're connecting to. You can go passwordless in your Microsoft account and access it just fine on your phone using the Outlook app.

[@Michelvan]

@@askleonotenboom MS account only. You may have to explain this in another video. Google services are also going passwordless. Thanks

[@gjoseph1628]

Does this discussion mean, if someone can setup a passkey to use instead of a password, user can still use the password and not deal with the also-setup passkey?

[@askleonotenboom]

Yes. But the whole point of this exercise is not to do so.

[@Douglas_Blake_579]

Good day Leo. Passkeys are not all they're made out to be. Take the example of fingerprints ... they have you using a password that you leave copies of everywhere you go and cannot change... Not my idea of tight security. Facial recognition... same story, you leave copies on every camera you cross and changing it is excruciatingly painful. The good old password is still king in my book. As you pointed out the only thing sent to a server is the hash, your text password never leaves your system... sometimes not even your keyboard. Hashes are monumentally difficult (bordering on impossible) to reverse engineer and the odds of successfully guessing one are astronomical. And... you can change it at whim and will ...

[@Dienes]

Passwords are not hashed locally. They get sent as clear text to the server, where they then get hashed. But the communication channel is encrypted.

[@roncaruso931]

Kerfuffle?

[@askleonotenboom]

Kerfuffle! www.dictionary.com/browse/kerfuffle

[@WireSniffer]

I'm laughing in British here 😅