3 ms·

I don't see what benefits a passkey has over using a password+TOPT/HOTP 2 factor. It seems like this is trying to solve a problem that has been becoming less si

I don't see what benefits a passkey has over using a password+TOPT/HOTP 2 factor. It seems like this is trying to solve a problem that has been becoming less significant over the years as more and more people use 2 factor properly and websites properly salt passwords. The current marketing doesn't properly show the need for this. I am not worried about a single password compromise because I don't reuse passwords and there is no risk my non-sms 2FA being compromised. It seem more like how I have to enroll my device to Duo if I want to use it for 2 factor to log in and Duo using a proprietary implementation locking me into their software. As it stands, despite this being an open standard, Google has made it clear it has no plans to add support to linux for "Local user verification" or "Passkey sync". The idea that Google will one day push users to only use passkeys and phase out passwords isn't unfounded. It's clear that Google would be motivated to make such a push. The reason people are concerned is because using Google ties the passkey to your Google login. From what I recall, Google also used a proprietary method to generator TOTP/HOTP making it impossible to use third party authenticators to log in to Google. Google Authenticator is open sourced but hasn't been updated in over 2 years. I believe Aegis supports Google Accounts so it can be used instead of Authenticator. I understand this from the more basic SSH authentication using a generated public/private key. I am also aware of Yubikeys, which are also open, but I have chosen to continue using passwords because I want complete control over my private keys. This is informed and healthy concern for a new implementation of security protocols.

shortcake27 4y ago
I can see a benefit for users who don’t use password managers / 2FA, but I can’t see a benefit over a strong random password + TOTP. Only difference is that with a password + TOTP you’re in full control of both the password + recovery codes. So you can get your accounts back even if you lose access to your password manager. With passkeys you have no control over anything, so if you lose access to your password manager you’re finished. Seems worse.
codedokode 4y ago
> what benefits a passkey has over using a password+TOPT/HOTP 2 factor The benefit is that you don't need to remember different password for each site. However, it seems that passkeys are not secure, can be stolen by an attacker with root access or silently decrypted by Google. The better solution is hardware keys independent from Google.
- knaik94 4y ago
  I think passkeys can not be stolen for the same reason jailbreak a phone doesn't allow a user to access to extract touch-id data. For the same reason Google also can't access that information. But I don't see how the current concerns regarding pass+TOTP are mitigated without completely removing the ability to use a password+totp as a fallback. And if it is kept as a fallback, what do passkeys accomplish other than making your phone a bigger point of failure?
  - codedokode 4y ago
    > I think passkeys can not be stolen for the same reason jailbreak a phone doesn't allow a user to access to extract touch-id data. For the same reason Google also can't access that information. Google allows exporting keys to Google cloud and importing them onto another device. This means that keys can be exported from secure storage, and if Google can do that then an attacker also can. Google claims, that PIN code or unlock pattern might be required to recover keys from cloud backup, but those are easy to bruteforce. This is not real hardware key that doesn't allow exporting private keys.

shortcake27 4y ago

I can see a benefit for users who don’t use password managers / 2FA, but I can’t see a benefit over a strong random password + TOTP. Only difference is that with a password + TOTP you’re in full control of both the password + recovery codes. So you can get your accounts back even if you lose access to your password manager. With passkeys you have no control over anything, so if you lose access to your password manager you’re finished. Seems worse.

codedokode 4y ago

> what benefits a passkey has over using a password+TOPT/HOTP 2 factor The benefit is that you don't need to remember different password for each site. However, it seems that passkeys are not secure, can be stolen by an attacker with root access or silently decrypted by Google. The better solution is hardware keys independent from Google.

knaik94 4y ago
I think passkeys can not be stolen for the same reason jailbreak a phone doesn't allow a user to access to extract touch-id data. For the same reason Google also can't access that information. But I don't see how the current concerns regarding pass+TOTP are mitigated without completely removing the ability to use a password+totp as a fallback. And if it is kept as a fallback, what do passkeys accomplish other than making your phone a bigger point of failure?
- codedokode 4y ago
  > I think passkeys can not be stolen for the same reason jailbreak a phone doesn't allow a user to access to extract touch-id data. For the same reason Google also can't access that information. Google allows exporting keys to Google cloud and importing them onto another device. This means that keys can be exported from secure storage, and if Google can do that then an attacker also can. Google claims, that PIN code or unlock pattern might be required to recover keys from cloud backup, but those are easy to bruteforce. This is not real hardware key that doesn't allow exporting private keys.