Security key that's new to me: Thetis Nano-C!

https://thetis.io/products/thetis-nano-c-fido2-security-key-device-passkey-usb-c

Also news to me, I'm clearly behind: FIDO2 has levels:

https://fidoalliance.org/certification/authenticator-certification-levels/

This key is FIDO2 L1, and different applications may require different levels. Notably here, L1 is the minimum to get any certification at all, and you can't get L2 unless you have an actual secure hardware element. So with the device at this level, you get the independence of a separate physical object with a dramatically simpler software surface, but I suspect it might be easier to get secrets right off the key with physical possession.

(Note that this is an organic post, not sponsored in any way. Happened upon it in an eBay listing. I never do solicited or compensated endorsements)

#SecurityKeys

OK, that's a quote.

https://www.youtube.com/watch?v=UrgucAPeqIs&list=PL7D89754A5DAD1E8E

#CriterionCloset

I'm basically dead in the water for anything that wants to [Google] reauthenticate occasionally (Google Finance, etc.) on this device (which is my daily driver). The issue is that the device-bound passkey isn't validating and it won't let me use anything else (like a security key).

Either the passkey on my Pixel 7 is corrupted, or the process of verifying it has a bug / wedge. Anything Google that wants to prompt for a passkey fails with the "2-Step Verification" flow's "Try another way" step. And even worse, the "other ways" (like the other passkeys I have on other devices, or the FIDO2 security keys that I have that predate passkeys) appear to succeed ... but then I'm redirected back to the same "try another way" as if presenting the key is being ignored even though it worked.

This was happening before the June update, and is still happening afterwards.

There also appears to be no way to delete a passkey from the Google Account side.

Edit: screenshot added (Sorry for the photo, had to take it from another device because you can't screenshot the auth flow)

Edit: this is only happening on one device. Other Google devices with automatically generated passkeys are working fine.

Edit: clearing all data for Chrome - not just cache, but all storage - fixed the issue for me!

#Android #Pixel #passkeys

Well, this cracking attack is going to take 5.5 days on 2x 4090s.

#PasswordCracking #hashcat

Just found out about this SPAM can variant. Kinda cool tie-in with the new CGI Lilo & Stitch movie.

Couple of SPAM+movie commercials, too:

https://www.youtube.com/watch?v=UTXR3ym-J-0
https://www.youtube.com/shorts/WCTsteRHe2I

#SPAM #LiloAndStitch