3 ms·

Passwords have had a good run but on the modern internet they are a failure. 99% of the population uses the same bad passwords everywhere. We've tried to get pe

Passwords have had a good run but on the modern internet they are a failure. 99% of the population uses the same bad passwords everywhere. We've tried to get people to behave securely with passwords but it just doesn't work. Its not their fault! Humans did not evolve to remember long distinct random strings. It is unfair to expect humans to never be tricked into typing their password into the wrong website. Its time for something new. I think WebAuthn and passkeys have a real shot to let us finally move onto a better form of authentication than passwords. They have real security benefits and hopefully usability benefits. I know that there's a lot of distrust of Apple and Google here when it comes to passkeys. But seriously this is not a giant ploy to trick you into buying an iPhone/Android. You can use a yubikey on sites that support passkeys. You can use an opensource solokey. You can use a software based fido key. You can use a an opensource tpm-fido authenticator. There will be opensource passkey implementations that support roaming. The standards are all open and there's nothing blocking interoperability. This is not a locked-in ecosystem. We've given passwords a good long try. They served their purpose but now are showing a lot of downsides. We need to be serious about looking for better alternatives that serve our end users. Passkeys is a good attempt at that. Lets give it a shot.

knaik94 4y ago
The current implementation shows that there is already an issue of openness. Requiring Apple or Google's password manager to manage and sync the passkeys is an issue. Google explicitly stating there is no planned support for "Local user verification" or "Passkey sync" shows they don't plan on support interoperability. A company following proper password hashing protocol means that repeat passwords isn't an issue. Pushing for 2FA using TOPT/HOTP protects people who reuse passwords and accidentally has one compromised. Until open source, free roaming, implementations of passkeys exist that expose the private key to the end user, it's effectively a locked-in ecosystem. I still haven't seen a good reason to replace tried and tested pass+2fa with passkeys. A simple push to force non-sms 2FA is an existing solution to the problem passkeys is attempting to solve. A compromised password is much less valuable now than it was even a few years ago. Even if you miss when a password was compromised, companies that care about security have started sending those "a new login was detected" emails that would alert you of any concerning activity.
- psanford 4y ago
  TOTP/HOTP is phishable. Webauthn is not. > Until open source, free roaming, implementations of passkeys exist that expose the private key to the end user, it's effectively a locked-in ecosystem. As I said above, there already are free implementations of FIDO keys that give you control over the keys.
  - knaik94 4y ago
    For Webauthn, Recoverability is still an open issue of ongoing research. From these issues [2], Webauthn having inbuilt recovery is out of scope. In fact a mobile phone becomes a single point of failure and unlike with 2FA, and with the likely requirement of attestation I don't know if free implementations of FIDO keys would be allowed. [3] This limitation was known and was considered out of scope since 2018. Webauthn can only be considered impossible to phish if companies completely remove the ability to log in with a password and TOTP. https://github.com/w3c/webauthn/issues/1640 https://github.com/w3c/webauthn/issues/1640 [2] https://github.com/w3c/webauthn/issues/931 https://github.com/w3c/webauthn/issues/931 [3] https://github.com/w3c/webauthn/issues/865 https://github.com/w3c/webauthn/issues/865
    - psanford 4y ago
      Attestation is not a likely requirement. Apple doesn't support it for their implementation of passkeys so it won't see any mainstream adoption. This matches with how WebAuthn has been rolled out by early adopters. Virtually no public services that support WebAuthn require attestation.

knaik94 4y ago

The current implementation shows that there is already an issue of openness. Requiring Apple or Google's password manager to manage and sync the passkeys is an issue. Google explicitly stating there is no planned support for "Local user verification" or "Passkey sync" shows they don't plan on support interoperability. A company following proper password hashing protocol means that repeat passwords isn't an issue. Pushing for 2FA using TOPT/HOTP protects people who reuse passwords and accidentally has one compromised. Until open source, free roaming, implementations of passkeys exist that expose the private key to the end user, it's effectively a locked-in ecosystem. I still haven't seen a good reason to replace tried and tested pass+2fa with passkeys. A simple push to force non-sms 2FA is an existing solution to the problem passkeys is attempting to solve. A compromised password is much less valuable now than it was even a few years ago. Even if you miss when a password was compromised, companies that care about security have started sending those "a new login was detected" emails that would alert you of any concerning activity.

psanford 4y ago
TOTP/HOTP is phishable. Webauthn is not. > Until open source, free roaming, implementations of passkeys exist that expose the private key to the end user, it's effectively a locked-in ecosystem. As I said above, there already are free implementations of FIDO keys that give you control over the keys.
- knaik94 4y ago
  For Webauthn, Recoverability is still an open issue of ongoing research. From these issues [2], Webauthn having inbuilt recovery is out of scope. In fact a mobile phone becomes a single point of failure and unlike with 2FA, and with the likely requirement of attestation I don't know if free implementations of FIDO keys would be allowed. [3] This limitation was known and was considered out of scope since 2018. Webauthn can only be considered impossible to phish if companies completely remove the ability to log in with a password and TOTP. https://github.com/w3c/webauthn/issues/1640 https://github.com/w3c/webauthn/issues/1640 [2] https://github.com/w3c/webauthn/issues/931 https://github.com/w3c/webauthn/issues/931 [3] https://github.com/w3c/webauthn/issues/865 https://github.com/w3c/webauthn/issues/865
  - psanford 4y ago
    Attestation is not a likely requirement. Apple doesn't support it for their implementation of passkeys so it won't see any mainstream adoption. This matches with how WebAuthn has been rolled out by early adopters. Virtually no public services that support WebAuthn require attestation.