4 ms·

Honest question since I'm not in the loop: what is the problem with passwords that passkeys are trying to solve?

• Hamcha 4y ago
  Passwords can be reused and stored on remote servers, if one is compromised, those password are now out there. Passkeys are asymmetric so the actual key is only stored in your keychain and the UX basically prevents reuse
  • kleiba 4y ago
    Thanks. I'm still not following 100%, though. Is the problem that some providers foolishly store users' passwords in clear text, or that some providers allow passwords whose hashes are easy to reverse?
    • harperlee 4y ago
      Both, plus people reuse passwords for random websites that might be malignant, plus they share them through social attacks, plus they put them in Post-its, plus they use easily guessable or brute-forceable passwords…
• hayst4ck 4y ago
  The idea of authenticating is the presentation of your id, something only you know (a password), and potentially something only you have (2fac). Passwords have a significant number of problems, the largest one is password re-use, so if your LinkedIn password gets stolen, it might be tried on your e-mail or bank account. The second is that they are hard to generate and then remember or store. This results in short passwords, easy to remember and therefore non random passwords, or written down passwords. Passwords can often be guessed. Passwords are easily forgotten, requiring complex, vulnerable password reset flows or interactions with fallible customer service reps. There are often policies that require inconvenient password resets where the old one is no longer valid. Passwords do not have attached metadata, so you might enter in a password on a website that looks like paypal, but isn't paypal. It's much easier to phish a password. Passwords can also sit on your clipboard after ctrl+c, which might be vulnerable. Passwords less than 9 characters can be brute forced and even passwords less than 12 characters might be vulnerable to state actors, especially if they aren't completely random. There is an additional nuance between signing something compared to copying something that results in where data that can compromise you exists in memory. Sending a string to a root owned process and getting a signed string back is a bit different than asking a root owned process for a privileged piece of information (a password) and having that copied into your processes memory. Pass keys mainly attempt to remove a significant amount of the human factor above (remembering, re-use, reset flows, etc.) while increasing overall convenience without sacrificing security. Rather than providing the current tuple(id, something only you know, something only you have), the idea is you provide (id, something only you are or something only you know, something only you have). Something you are is face or finger id, and the fallback is something you know, which is your pin. Because keys are more or less universally unique and they can be stored in apples secure enclave or in privileged memory they can also work as something you have. If you run something that turns a QR code into raw text, you will find that 2 factor codes are more or less a private key that is saved into an authentication app on a particular device (iirc).