Light

Episode #972 Quiz

Passkeys: A Shattered Dream?
Date: 2024-04-30 | Length: 2 hrs | Episode page at twit.tv

About this episode

The UK’s PSTI law now mandates secure consumer IoT baselines: no universal default passwords, vulnerability-reporting contacts, disclosed update support periods, authenticated update channels, anti-rollback, secure storage, minimized attack surfaces, integrity checks, telemetry review, data deletion, and resilience. Passkeys are criticized for vendor lock-in, broken attestation, storage limits, and fragile, opaque portability.

Your name and email are stored only in your browser local storage for convenience. They are not retained server-side.

NameEmail

Question 1: According to the episode, what did the UK PSTI law require manufacturers to state for consumer smart devices at the point of sale or sale-facing materials?

Question 1

According to the episode, what did the UK PSTI law require manufacturers to state for consumer smart devices at the point of sale or sale-facing materials?

The maximum number of local accounts the device can support securely The minimum length of time the device will receive important security updates The minimum number of passwords the device will accept before locking out The exact cryptographic suite used by the device for all network sessions

Question 2: In Steve's summary of the baseline requirements document, what did the law say about brute-force resistance for devices that are not constrained devices?

Question 2

In Steve's summary of the baseline requirements document, what did the law say about brute-force resistance for devices that are not constrained devices?

They shall encrypt every failed login attempt before forwarding it to a server They shall require a second administrator approval before each login attempt They shall make network-based brute-force attacks impractical They shall disable all password authentication after the first failed attempt

Question 3: What did the episode say about how pre-installed unique-per-device passwords must be generated?

Question 3

What did the episode say about how pre-installed unique-per-device passwords must be generated?

They shall be derived from the device's MAC address for traceability They shall be sufficiently randomized to resist automated attacks They shall be sequentially incremented for factory bookkeeping They shall be identical within each product family to simplify support

Question 4: Why did William Brown say Chrome's failure to implement the Authenticator Selection Extension mattered for WebAuthn deployments?

Question 4

Why did William Brown say Chrome's failure to implement the Authenticator Selection Extension mattered for WebAuthn deployments?

It prevented browsers from generating any WebAuthn challenges at all It forced all logins to use QR-code based phone scanning It removed a way to filter acceptable authenticators by make and model It broke attestation by requiring RSA-SHA1 on every authenticator

Question 5: According to William Brown's critique as summarized in the episode, what is one practical effect of treating Passkeys as resident keys?

Question 5

According to William Brown's critique as summarized in the episode, what is one practical effect of treating Passkeys as resident keys?

Resident keys eliminate the need for attestation in enterprise deployments Users are forced to store every credential only in a server-side HSM Browsers can no longer verify the authenticity of any credential response Hardware security keys can run out of storage for resident credentials

Cancel

My Data//Security & Privacy//Clear Local Data

© 2026 Ken ArmstrongSecurity Now™ is a trademark of TWiT LLC. All trademarks and copyrights of the Security Now podcast are respected and reserved to their respective holders.
This is a hobby project made with love and admiration for what Steve Gibson and Leo Laporte have built over 20 years.