4 ms·

Passkeys aren't protected when it comes to laws regarding self-incrimination and searches. Information encrypted and locked behind a password, something only yo

Passkeys aren't protected when it comes to laws regarding self-incrimination and searches. Information encrypted and locked behind a password, something only you know, is protected. Until laws surrounding biometrics are changed, I personally won't move to passkeys. There have been cases where biometrics have been protected under the same category as pins and passwords but there have also been cases where it was not. https://www.concordlawschool.edu/blog/constitutional-law/fifth-amendment-biometrics/ https://www.concordlawschool.edu/blog/constitutional-law/fif...

shortcake27 4y ago
Also, haven’t people been going on for years about how biometrics are _not_ passwords? I would personally feel far less secure replacing my master password with a passkey, especially if the biometric is fingerprint. But I guess this increases security for the vast majority of people while decreasing security for a small minority. Which is probably still an overall win. I’ll continue using a strong master password for as long as it’s possible.
- tadfisher 4y ago
  Passkeys are tokens that have nothing to do with your biometric data. When you "unlock" a passkey on a smartphone, you are granting access to decrypt the token using a secure element coprocessor. Your biometric data is not the passkey, is only used for local authentication, and does not leave the device.
  - shortcake27 4y ago
    > Passkeys are tokens that have nothing to do with your biometric data. Did you read the linked article? 1Password is allowing users to avoid having a master password at all, instead allowing them to use only biometrics to access their vaults. So this specific implementation that we're talking about right now very much has something to do with biometrics. > Your biometric data is not the passkey. Never said it was. > is only used for local authentication, and does not leave the device. Not my concern. My concern is that my biometric data is public. The same fingerprint that would unlock my phone/laptop also happens to be plastered all over said devices as well as everything else I touch. Plenty of videos on YouTube where people have lifted fingerprints and unlocked devices. Most facial recognition technologies can be fooled with a photo. I have a serious issue with someone being able to access my 1Password vault without needing a secret such as a password that only I know. FaceID is probably the only technology I'd trust to prevent unauthorised access, but as the parent mentioned, biometrics are a bit of a grey area - in certain countries / jurisdictions you can be forced to unlock a device using biometrics even if it's illegal to force a password out of you.
NoZebra120vClip 4y ago
I don't "know" any of my passwords anymore! First it was "use complex passwords" so passwords got harder to remember, but it was doable. Then it was "don't reuse your passwords" and I'd made a good show of it by dreaming up 3-4 distinct passwords that I rotated in different services. Then I started managing my accounts in an app because I had too many to manually/mentally track. Then it was "use a password manager" and so as I transitioned to the password manager, I had it generate very strong random passwords that I had no hope of remembering, much less typing in manually. So I don't remember any passwords anymore and I couldn't remember them if I tried. I couldn't even type them (although I could transition to a "correct horse battery staple" method instead.) And I'm beholden to my password manager, plus my Yubikeys plus my phone plus my email, due to disparate mandatory MFA challenges. Authentication has become really splintered and really complex. It's ridiculous to insist in this day and age that a password is "something you know" unless it's a master password to unlock your vault or your employer's SSO or something. So that ship has sailed, sorry to inform you!
- kingbirdy 4y ago
  I don't think you responded to the comment you meant to
- knaik94 4y ago
  I know all of my passwords, I don't reuse passwords, and I chose from the very beginning to never rely on auto-generated passwords. I would be fine without any kind of password manager. You are making a lot of generalizations about how people interact with passwords. I don't have a single Yubikey, I use Aegis on android that allows me to generate codes and self manage backups of my 2FA secrets. It even supports DUO 2F, but I don't mess with DUO accounts because they are hotp and not totp so you will run into sync issues if your aren't careful. I do have the secret key backed up though. My passwords are something I know. More importantly, even if you use a password manager, your master password is still something you know in the eyes of the law. That covers all passwords that are accessed using a master password as something you know. That's the whole point of multifactor, the second factor is irrelevant without the first. I could surrender all of the 2F secrets and it still wouldn't matter because a password is something I know. Not knowing your passwords is a choice, which you are free to make, I made the opposite choice. I can understand not wanting to remember every password, but it's worth creating self chosen passwords for the critical accounts like google, microsoft, github, and financials, in my opinion. I use biometrics for my mobile OS, but biometrics are only enabled after first unlocking the phone with the pin/password. I use a traditional password for my pc.
jbverschoor 4y ago
You need to authenticate are least once before you can use your biometrics

shortcake27 4y ago

Also, haven’t people been going on for years about how biometrics are _not_ passwords? I would personally feel far less secure replacing my master password with a passkey, especially if the biometric is fingerprint. But I guess this increases security for the vast majority of people while decreasing security for a small minority. Which is probably still an overall win. I’ll continue using a strong master password for as long as it’s possible.

tadfisher 4y ago
Passkeys are tokens that have nothing to do with your biometric data. When you "unlock" a passkey on a smartphone, you are granting access to decrypt the token using a secure element coprocessor. Your biometric data is not the passkey, is only used for local authentication, and does not leave the device.
- shortcake27 4y ago
  > Passkeys are tokens that have nothing to do with your biometric data. Did you read the linked article? 1Password is allowing users to avoid having a master password at all, instead allowing them to use only biometrics to access their vaults. So this specific implementation that we're talking about right now very much has something to do with biometrics. > Your biometric data is not the passkey. Never said it was. > is only used for local authentication, and does not leave the device. Not my concern. My concern is that my biometric data is public. The same fingerprint that would unlock my phone/laptop also happens to be plastered all over said devices as well as everything else I touch. Plenty of videos on YouTube where people have lifted fingerprints and unlocked devices. Most facial recognition technologies can be fooled with a photo. I have a serious issue with someone being able to access my 1Password vault without needing a secret such as a password that only I know. FaceID is probably the only technology I'd trust to prevent unauthorised access, but as the parent mentioned, biometrics are a bit of a grey area - in certain countries / jurisdictions you can be forced to unlock a device using biometrics even if it's illegal to force a password out of you.

NoZebra120vClip 4y ago

I don't "know" any of my passwords anymore! First it was "use complex passwords" so passwords got harder to remember, but it was doable. Then it was "don't reuse your passwords" and I'd made a good show of it by dreaming up 3-4 distinct passwords that I rotated in different services. Then I started managing my accounts in an app because I had too many to manually/mentally track. Then it was "use a password manager" and so as I transitioned to the password manager, I had it generate very strong random passwords that I had no hope of remembering, much less typing in manually. So I don't remember any passwords anymore and I couldn't remember them if I tried. I couldn't even type them (although I could transition to a "correct horse battery staple" method instead.) And I'm beholden to my password manager, plus my Yubikeys plus my phone plus my email, due to disparate mandatory MFA challenges. Authentication has become really splintered and really complex. It's ridiculous to insist in this day and age that a password is "something you know" unless it's a master password to unlock your vault or your employer's SSO or something. So that ship has sailed, sorry to inform you!

kingbirdy 4y ago
I don't think you responded to the comment you meant to
knaik94 4y ago
I know all of my passwords, I don't reuse passwords, and I chose from the very beginning to never rely on auto-generated passwords. I would be fine without any kind of password manager. You are making a lot of generalizations about how people interact with passwords. I don't have a single Yubikey, I use Aegis on android that allows me to generate codes and self manage backups of my 2FA secrets. It even supports DUO 2F, but I don't mess with DUO accounts because they are hotp and not totp so you will run into sync issues if your aren't careful. I do have the secret key backed up though. My passwords are something I know. More importantly, even if you use a password manager, your master password is still something you know in the eyes of the law. That covers all passwords that are accessed using a master password as something you know. That's the whole point of multifactor, the second factor is irrelevant without the first. I could surrender all of the 2F secrets and it still wouldn't matter because a password is something I know. Not knowing your passwords is a choice, which you are free to make, I made the opposite choice. I can understand not wanting to remember every password, but it's worth creating self chosen passwords for the critical accounts like google, microsoft, github, and financials, in my opinion. I use biometrics for my mobile OS, but biometrics are only enabled after first unlocking the phone with the pin/password. I use a traditional password for my pc.

jbverschoor 4y ago

You need to authenticate are least once before you can use your biometrics