4 ms·

Annoying points with passkey is that one way or another, your creds (ie the passkey) has to stay on your device/app or you are fucked. Good thing with password

Annoying points with passkey is that one way or another, your creds (ie the passkey) has to stay on your device/app or you are fucked. Good thing with password is that you can have it not stored on any device and just used when you need. Gives you plausible deniability. Also, now your chrome passkey/password manager has all your creds. Protected only with a single thing (password/biometry). Imagine your are at the Chinese or US border, and tsa is overreaching: with just your finger they can access to all your accounts: Facebook, twitter, Google, Dropbox, ... You can't temporary delete from a device and readd without redoing the whole setup with the website. To create a passkey on Chrome for Android, you need the Google Play services beta. Otherwise the call to navigator.credentials.create() below will fail. You see it the moment where apps and websites will not work without the Google play ecosystem just before they added a new lock in? Also, I can see in advance that most website will only accept a single passkey public key per account. So you can't have one on each of your devices or even easily randomly connect from different web browser to the same site.

yencabulator 4y ago
> Annoying points with passkey is that one way or another, your creds (ie the passkey) has to stay on your device/app or you are fucked. Good thing with password is that you can have it not stored on any device and just used when you need. The key is just a bunch of random data used as a cryptographic private key. You could make an authenticator that argon2id's a passphrase to generate the private key, to go back to the world of passwords. Meanwhile, the average person using passkeys will become immune to phishing.
stetrain 4y ago
Or use a third party password manager where you can export the keys to some other storage if you wish, or apply other security measures to access those keys?
greatgib 4y ago
Last but not least, now, even in private browsing the public key used could easily tell which device you are using.
- stetrain 4y ago
  How so?
  - greatgib 4y ago
    You will probably have one public/private key set per device or browser to be able to connect to the website. At the opposite, if you share your private keys on all your devices with probably automatic sync. It might defeat it's purpose in term of security. Imagine if you were to copy your ssh private key on all your machines instead of having one per device. Now, if I'm trying to connect with public key 1234 to Facebook, it will be that I'm connecting from my home computer Firefox. If I try to connect with public key 6754, then I'm definitely on my work computer chrome.
    - stetrain 4y ago
      Well yes, the site you are signing into would know which key pair you are using. But that isn’t shared across websites so I’m not sure that’s any violation of privacy.
      - greatgib 4y ago
        Facebook will know that you for sure that you connected from a new computer/ phone. Facebook will know that you are on your iphone A. Facebook will know for sure that you are on the computer (work) were you look at funky business pages... Even if less dangerous, your employer will know for sure that you connected from your personal computer to download X from Google workspace or specific work site even if nothing was explicitly setup for you like a VPN.
        stetrain 4y ago
        Facebook will know that you are on Device 1 or Device 2. They can already probably determine that via a combo of user agent, IP, and other fingerprinting. And if you want to use different accounts on the same device, Facebook wouldn’t know that it’s the same device. Google already tracks which devices you are signed in on, and alerts you if you sign in from one that isn’t already trusted. I’m not sure what the issue is here. It’s not like there is a device identifier that can correlate your device logins across different sites or services.
rektide 4y ago
It's just jaw-dropping how naive passkey has been in trying to pretend browser implementers can do the right thing for users, when the vast epic & total security threats you describe are so readily & obviously apparent. The unwillingness to support real security keys as is the case with linux is just further fuel on the pyre of what a shit not-actually-pro-user attempt this new regime really is. It's all so mediated, so centralized, in big cloud shit. There's this anti-user mania that users will fuck everything up so we absolutely cannot let them do things like export keys. But this chicken-little sky-is-falling pretense just keeps being an excuse for bad tradeoffs that in no way favor real actual people at all.
- jackson1442 4y ago
  Maybe we're having different experiences on the web, but I've found that there is _significantly_ better support for security keys on the web than there is for Passkeys. Many sites will give the option to use either but only registering security keys actually works.
greatgib 4y ago
Another terrible thing coming to my mind, by definition you will probably not have 2fa when you connect with passkey. So, now think about Google chrome feature of "backup user passwords" that they always try to have user enable automatically without noticing. And that is not e2e encrypted so they can access any of them along with your wifi passwords. Will they not save the passkey there for sync with other chromes? Because otherwise it will be directly game over for the normal user. Any google employee or gov or hacker will be able to connect to your accounts even without 2fa. A lot better for them that the current situation with passwords and 2fa.
- mynameisvlad 4y ago
  You still have 2 factors: - Something you own, your device with a passkey on it AND - Something you are, your biometrics OR - Something you know, your PIN Either of which you need, at least in every single implementation of passkeys I've used.
  - greatgib 4y ago
    The pin or biometrics is just in the client side, let's say to decipher the private key before usage. No? Probably even not an encrypted key but just to protect your local passkey holder. I don't think that any of this is sent to the website.
    - mynameisvlad 4y ago
      It’s still required to complete authentication. If you don’t present one of them, your authenticator will not function. It’s used to unlock the private key. It’s not the website confirming your second factor, but the Authenticator. And that’s on purpose; I don’t think I’d want a website being able to store a copy of my biometrics.
      - greatgib 4y ago
        Yes, but so it goes back to my point. If Google cloud is storing your private key, probably not cyphered with your biometric because they would have also to backup your biometric data to backport on the other device. So they have everything they need to use it pretending to be you with your device.

yencabulator 4y ago

> Annoying points with passkey is that one way or another, your creds (ie the passkey) has to stay on your device/app or you are fucked. Good thing with password is that you can have it not stored on any device and just used when you need. The key is just a bunch of random data used as a cryptographic private key. You could make an authenticator that argon2id's a passphrase to generate the private key, to go back to the world of passwords. Meanwhile, the average person using passkeys will become immune to phishing.

stetrain 4y ago

Or use a third party password manager where you can export the keys to some other storage if you wish, or apply other security measures to access those keys?

greatgib 4y ago

Last but not least, now, even in private browsing the public key used could easily tell which device you are using.

stetrain 4y ago
How so?
- greatgib 4y ago
  You will probably have one public/private key set per device or browser to be able to connect to the website. At the opposite, if you share your private keys on all your devices with probably automatic sync. It might defeat it's purpose in term of security. Imagine if you were to copy your ssh private key on all your machines instead of having one per device. Now, if I'm trying to connect with public key 1234 to Facebook, it will be that I'm connecting from my home computer Firefox. If I try to connect with public key 6754, then I'm definitely on my work computer chrome.
  - stetrain 4y ago
    Well yes, the site you are signing into would know which key pair you are using. But that isn’t shared across websites so I’m not sure that’s any violation of privacy.
    - greatgib 4y ago
      Facebook will know that you for sure that you connected from a new computer/ phone. Facebook will know that you are on your iphone A. Facebook will know for sure that you are on the computer (work) were you look at funky business pages... Even if less dangerous, your employer will know for sure that you connected from your personal computer to download X from Google workspace or specific work site even if nothing was explicitly setup for you like a VPN.
      - stetrain 4y ago
        Facebook will know that you are on Device 1 or Device 2. They can already probably determine that via a combo of user agent, IP, and other fingerprinting. And if you want to use different accounts on the same device, Facebook wouldn’t know that it’s the same device. Google already tracks which devices you are signed in on, and alerts you if you sign in from one that isn’t already trusted. I’m not sure what the issue is here. It’s not like there is a device identifier that can correlate your device logins across different sites or services.

rektide 4y ago

It's just jaw-dropping how naive passkey has been in trying to pretend browser implementers can do the right thing for users, when the vast epic & total security threats you describe are so readily & obviously apparent. The unwillingness to support real security keys as is the case with linux is just further fuel on the pyre of what a shit not-actually-pro-user attempt this new regime really is. It's all so mediated, so centralized, in big cloud shit. There's this anti-user mania that users will fuck everything up so we absolutely cannot let them do things like export keys. But this chicken-little sky-is-falling pretense just keeps being an excuse for bad tradeoffs that in no way favor real actual people at all.

jackson1442 4y ago
Maybe we're having different experiences on the web, but I've found that there is _significantly_ better support for security keys on the web than there is for Passkeys. Many sites will give the option to use either but only registering security keys actually works.

greatgib 4y ago

Another terrible thing coming to my mind, by definition you will probably not have 2fa when you connect with passkey. So, now think about Google chrome feature of "backup user passwords" that they always try to have user enable automatically without noticing. And that is not e2e encrypted so they can access any of them along with your wifi passwords. Will they not save the passkey there for sync with other chromes? Because otherwise it will be directly game over for the normal user. Any google employee or gov or hacker will be able to connect to your accounts even without 2fa. A lot better for them that the current situation with passwords and 2fa.

mynameisvlad 4y ago
You still have 2 factors: - Something you own, your device with a passkey on it AND - Something you are, your biometrics OR - Something you know, your PIN Either of which you need, at least in every single implementation of passkeys I've used.
- greatgib 4y ago
  The pin or biometrics is just in the client side, let's say to decipher the private key before usage. No? Probably even not an encrypted key but just to protect your local passkey holder. I don't think that any of this is sent to the website.
  - mynameisvlad 4y ago
    It’s still required to complete authentication. If you don’t present one of them, your authenticator will not function. It’s used to unlock the private key. It’s not the website confirming your second factor, but the Authenticator. And that’s on purpose; I don’t think I’d want a website being able to store a copy of my biometrics.
    - greatgib 4y ago
      Yes, but so it goes back to my point. If Google cloud is storing your private key, probably not cyphered with your biometric because they would have also to backup your biometric data to backport on the other device. So they have everything they need to use it pretending to be you with your device.