4 ms·

this entire comment section is so full of BS! People ranting about stuff they don't understand and coming up with random conspiracy theories that have no basis

this entire comment section is so full of BS! People ranting about stuff they don't understand and coming up with random conspiracy theories that have no basis in reality PassKeys are NOT proprietary. They're a standard. You can implement it yourself if you want or use several other implementations not run by FAMG. Here's a video on how it works https://www.youtube.com/watch?v=SWocv4BhCNg https://www.youtube.com/watch?v=SWocv4BhCNg * Can I share the keys between chrome, firefox, and safari? You don't need to. That's not how it works. Chrome, Firefox, and Safari and every device will have a different key for the same service (see video) * How do I share keys between different types of devices? (mac, ios, android, windows) You don't. You authenticate and a new key is created on each device, possibly on each piece of software (Firefox, Chrome, Safari, App). To be more clear, when and if you decide to use a service from a new device or new browser you'll be asked if you want to login via passkey. If you have a passkey on another device you can (see video) use that to login from the other device (similar to how google asks viat the gmail app of you were trying to log into some other device or Apple asks across your device). After you authenticate you can then create a new passkey for this device/software you're using. This new passkey is separate from the previous passkey. You effectively have 2 passkeys now, one to login with one device/software, one to with a different device/software. (See video) * What happens if my devices are gone? You follow whatever recovery procedures the service has, just like if you forgot your password. * What happens if I want to change my login (email to a new email for example)? Unrelated. Your email is not shared with passkey. So login and set a new email * What's the difference between a password and passkey? A password can be use by any one from anywhere. A passkey can only be used with the piece of software/device it was associated with when created. A passkey is useless if stolen/leaked

shortcake27 4y ago
> What happens if my devices are gone? You follow whatever recovery procedures the service has, just like if you forgot your password Are you sure? If so, why? Passkeys are advertised as a replacement for username + password + 2FA. Current practices generally allow for a password to be reset via email, but not MFA, as half the point of MFA is to protect against password resets. So the reset process for a passkey can’t be the same as a password otherwise you don’t have “real” MFA. I feel that account recovery is either going to get a lot harder (eg KYC for what would have been previously been an email), or services will enforce additional data collection (eg phone number) to aid recovery. Neither of these are good.
knaik94 4y ago
I don't see what benefits a passkey has over using a password+TOPT/HOTP 2 factor. It seems like this is trying to solve a problem that has been becoming less significant over the years as more and more people use 2 factor properly and websites properly salt passwords. The current marketing doesn't properly show the need for this. I am not worried about a single password compromise because I don't reuse passwords and there is no risk my non-sms 2FA being compromised. It seem more like how I have to enroll my device to Duo if I want to use it for 2 factor to log in and Duo using a proprietary implementation locking me into their software. As it stands, despite this being an open standard, Google has made it clear it has no plans to add support to linux for "Local user verification" or "Passkey sync". The idea that Google will one day push users to only use passkeys and phase out passwords isn't unfounded. It's clear that Google would be motivated to make such a push. The reason people are concerned is because using Google ties the passkey to your Google login. From what I recall, Google also used a proprietary method to generator TOTP/HOTP making it impossible to use third party authenticators to log in to Google. Google Authenticator is open sourced but hasn't been updated in over 2 years. I believe Aegis supports Google Accounts so it can be used instead of Authenticator. I understand this from the more basic SSH authentication using a generated public/private key. I am also aware of Yubikeys, which are also open, but I have chosen to continue using passwords because I want complete control over my private keys. This is informed and healthy concern for a new implementation of security protocols.
- shortcake27 4y ago
  I can see a benefit for users who don’t use password managers / 2FA, but I can’t see a benefit over a strong random password + TOTP. Only difference is that with a password + TOTP you’re in full control of both the password + recovery codes. So you can get your accounts back even if you lose access to your password manager. With passkeys you have no control over anything, so if you lose access to your password manager you’re finished. Seems worse.
- codedokode 4y ago
  > what benefits a passkey has over using a password+TOPT/HOTP 2 factor The benefit is that you don't need to remember different password for each site. However, it seems that passkeys are not secure, can be stolen by an attacker with root access or silently decrypted by Google. The better solution is hardware keys independent from Google.
codedokode 4y ago
> They're a standard. You can implement it yourself You can make your DIY authenticator, but websites might choose not to trust your self-signed attestation as it is not "secure". Also, as I understand, passkeys stored on an Android phone can be stolen by an attacker with root access or by Google if you use biometric lock or PIN or lock pattern.
tomjen3 4y ago
If you have to create a new passkey for each new login, sooner or later that will not be possible.

shortcake27 4y ago

> What happens if my devices are gone? You follow whatever recovery procedures the service has, just like if you forgot your password Are you sure? If so, why? Passkeys are advertised as a replacement for username + password + 2FA. Current practices generally allow for a password to be reset via email, but not MFA, as half the point of MFA is to protect against password resets. So the reset process for a passkey can’t be the same as a password otherwise you don’t have “real” MFA. I feel that account recovery is either going to get a lot harder (eg KYC for what would have been previously been an email), or services will enforce additional data collection (eg phone number) to aid recovery. Neither of these are good.

knaik94 4y ago

I don't see what benefits a passkey has over using a password+TOPT/HOTP 2 factor. It seems like this is trying to solve a problem that has been becoming less significant over the years as more and more people use 2 factor properly and websites properly salt passwords. The current marketing doesn't properly show the need for this. I am not worried about a single password compromise because I don't reuse passwords and there is no risk my non-sms 2FA being compromised. It seem more like how I have to enroll my device to Duo if I want to use it for 2 factor to log in and Duo using a proprietary implementation locking me into their software. As it stands, despite this being an open standard, Google has made it clear it has no plans to add support to linux for "Local user verification" or "Passkey sync". The idea that Google will one day push users to only use passkeys and phase out passwords isn't unfounded. It's clear that Google would be motivated to make such a push. The reason people are concerned is because using Google ties the passkey to your Google login. From what I recall, Google also used a proprietary method to generator TOTP/HOTP making it impossible to use third party authenticators to log in to Google. Google Authenticator is open sourced but hasn't been updated in over 2 years. I believe Aegis supports Google Accounts so it can be used instead of Authenticator. I understand this from the more basic SSH authentication using a generated public/private key. I am also aware of Yubikeys, which are also open, but I have chosen to continue using passwords because I want complete control over my private keys. This is informed and healthy concern for a new implementation of security protocols.

shortcake27 4y ago
I can see a benefit for users who don’t use password managers / 2FA, but I can’t see a benefit over a strong random password + TOTP. Only difference is that with a password + TOTP you’re in full control of both the password + recovery codes. So you can get your accounts back even if you lose access to your password manager. With passkeys you have no control over anything, so if you lose access to your password manager you’re finished. Seems worse.
codedokode 4y ago
> what benefits a passkey has over using a password+TOPT/HOTP 2 factor The benefit is that you don't need to remember different password for each site. However, it seems that passkeys are not secure, can be stolen by an attacker with root access or silently decrypted by Google. The better solution is hardware keys independent from Google.

codedokode 4y ago

> They're a standard. You can implement it yourself You can make your DIY authenticator, but websites might choose not to trust your self-signed attestation as it is not "secure". Also, as I understand, passkeys stored on an Android phone can be stolen by an attacker with root access or by Google if you use biometric lock or PIN or lock pattern.

tomjen3 4y ago

If you have to create a new passkey for each new login, sooner or later that will not be possible.