CandidDevOps @CandidDevOps

@invoodoo @_hammersi @jjacky Nope, I've consistently specified 2FA based on a once shared secret, that can never be sent by email or SMS by a server..

0 0 0 2 0

View Details

CandidDevOps @CandidDevOps

3 hours ago

@invoodoo @_hammersi @jjacky

0 0 0 3 0

View Details

@invoodoo @_hammersi @jjacky Passkeys in providers that allow the keys to be shared defeat every single purpose of passkeys. Fuck you are dumb. Intelligent devs block those providers, demand biometric on device, or don't even bother with passkeys.

2 0 0 8 0

View Details

CandidDevOps @CandidDevOps

3 hours ago

@invoodoo @_hammersi @jjacky phone/email is not confirmation "it is you".

1 0 0 5 0

View Details

CandidDevOps @CandidDevOps

3 hours ago

@invoodoo @_hammersi @jjacky You can not access shit on my stolen device. You won't log into it.

1 0 0 6 0

View Details

CandidDevOps @CandidDevOps

3 hours ago

@invoodoo @_hammersi @jjacky You keep magically getting to "after passkey".... you must AUTHENTICATE to configure the passkey.... Do you even understand how any of this works? Serious question at this point.

1 0 0 7 0

View Details

CandidDevOps @CandidDevOps

3 hours ago

@invoodoo @_hammersi @jjacky Only clowns send 2FA via SMS or email.

0 0 0 5 0

View Details

CandidDevOps @CandidDevOps

3 hours ago

@invoodoo @_hammersi @jjacky What gate must they pass to configure passkey?

1 0 0 6 0

View Details

CandidDevOps @CandidDevOps

3 hours ago

@invoodoo @_hammersi @jjacky No. email and phone are weak. passkeys don't need "restored".... if you loose it you .. rekey the device... after proving you have authority to .. with ... user+password + 2FA...

1 0 0 11 0

View Details

CandidDevOps @CandidDevOps

3 hours ago

@invoodoo @_hammersi @jjacky If a service allows you to configure passkeys without 2FA gating that action... They are fucking retarded. The hacker will gladly login with your password (stolen), no 2FA, and configure their devices for passkey auth. They now own your account.