4 ms·

This is exciting, I love that we're moving toward passkeys. When I tell non-devs that passwords will be going away in the years to come they almost can't unders

This is exciting, I love that we're moving toward passkeys. When I tell non-devs that passwords will be going away in the years to come they almost can't understand what I'm saying. Like we've all lived this life of passwords for as long as we can remember so the idea of not getting having to click "Forgot my password" once a day is foreign to us. It's sort of like we've been gaslighted into thinking this is how it has to be for years and it's crumbling away now. Meanwhile I'm sure a decade from now we'll all look back and say "Remember when we had to type _secret characters_ into a little box to log in to an app/site?"

candiddevmike 4y ago
The problem with passkeys IMO is they typically aren't portable between devices, and if they are, they will have some of the same problems as passwords. A long passphrase will probably have the same threat profile as a portable passkey, but with an easier implementation.
- toomuchtodo 4y ago
  For the vast majority of your layman use cases, passkeys are perfect because the switch rate between ecosystems is low. My mid 90s grandmother is not able to use a password manager, she's just not capable. Same for my mid 60s in laws. Passkeys fix this for them. If your use case requires heterogenous ecosystem support, it might make sense to wait for your preferred password manager to have passkey support (to have an independent sync fabric). Worst case scenario, you have multiple passkeys per service identity/web property, one in each sync ecosystem (if the relying party supports it). Still better than passwords! If your SSO provider does't support passwordless/passkeys, loudly complain to them :) Azure Active Directory supports it, I have worked with a team to implement it. (great post btw to the Teleport folks, both content and visual appeal)
  - candiddevmike 4y ago
    Hopefully someday some smart person invents a standard, secure way of handling enrollment/forgot my pass(key|word), as that will always be the weakest link. As much as it freaks some people out, a cryptographic national ID would be really helpful for this, IMO.
    - toomuchtodo 4y ago
      https://stripe.com/identity https://stripe.com/identity Agreed about a cryptographic national ID. One day! Login.gov is already prototyping using USPS for in person identity verification, we'll get there. https://news.ycombinator.com/item?id=34735448 https://news.ycombinator.com/item?id=34735448
- ryukafalz 4y ago
  Passkeys (in the sense the article is referring to, which is to say FIDO2 passkeys) are explicitly portable between devices. And the difference is they're always unique per-site in a way that passwords are not necessarily. It's possible to approach the security of passkeys if you always use unique passwords per-site (with e.g. a password manager) but you're still then vulnerable to phishing unlike with passkeys.
  - deleted 4y ago
    [deleted]
  - Groxx 4y ago
    Most password managers check the urls before filling.
    - vlovich123 4y ago
      That doesn't prevent phishing attacks where the user goes "uggh. my password manager isn't working again. I'm going to copy-paste the password in by hand".
      - danShumway 4y ago
        Similarly, passkeys don't necessarily block the phishing attack where the user goes, "ugh, this dongle/phone isn't working, I guess I need to put in one of these one-time recovery codes." Account recovery is still going to be a weak point here, and it's a kind of double-edged sword. If you're really strict about passkeys getting shared between devices or manually accessed, then users are going to lose access to accounts a lot, and recovery methods are going to get easier to accommodate those situations, which will in turn re-open phishing vulnerabilities. On the other hand, if services don't implement those recovery options, then the first time a user gets burned with losing access to an account for a week, they're going to stop using passkeys, and broader adoption will be halted.
  - danShumway 4y ago
    > are explicitly portable between devices Yes and no. Passkeys are portable in the sense that Apple/Google have already compromised on the "keys should never leave your device" standard and have set up backup/restore options for if you lose your phone within their ecosystem. This is portability, but extremely limited portability. It's not portability in the sense of allowing you to migrate between ecosystems. There is also some promise that passkeys will be portable between Google/Apple ecosystems in the future. The fact that the FIDO alliance refuses to build a client-independent way of moving between ecosystems and instead seems to be suggesting that migration should be handled with environment-dependent implementations severely limits how useful that portability will be. Passkeys are also "portable" in the sense that you can register multiple keys with a single site. But this is not actual portability, it's just backup/replication. When you get a new device outside of the ecosystem, you can't port your passkeys anywhere. What you can do is register that device with every single site you have an account with. This should obviously be seen as a barrier to the goal of replacing passwords entirely, but for some reason it's not seen that way. To understand the problem, we have to stop thinking of the current world where there are like 4 or 5 sites that have passkeys attached to them; you have to instead think of a world where passkeys won and a user has hundreds of sites with passkeys attached to them, many of which they might not have visited in nearly a decade. And when they buy a new device, they have to migrate all of them. That's not portability, that is not something that a non-techie user wants to go through. > you're still then vulnerable to phishing unlike with passkeys. Extremely important to mention in these discussions, passkeys are phishing-resistant, not phishing-proof. We gave up on phishing-proof when Google and Apple started doing backup and restore within their own ecosystems. Your iCloud credentials can be phished, at which point your passkeys can also be phished by setting up a new iPhone. Arguably, the Yubikey/dedicated-token approach was phishing-proof (for at least a somewhat narrow definition of phishing), but that's not the approach that mainstream platforms are going for. If you're using an iPhone, your passkeys already get backed up. That ship has sailed, the only fight remaining is whether or not you should be able to import them to something that's not an Apple device.

candiddevmike 4y ago

The problem with passkeys IMO is they typically aren't portable between devices, and if they are, they will have some of the same problems as passwords. A long passphrase will probably have the same threat profile as a portable passkey, but with an easier implementation.

toomuchtodo 4y ago
For the vast majority of your layman use cases, passkeys are perfect because the switch rate between ecosystems is low. My mid 90s grandmother is not able to use a password manager, she's just not capable. Same for my mid 60s in laws. Passkeys fix this for them. If your use case requires heterogenous ecosystem support, it might make sense to wait for your preferred password manager to have passkey support (to have an independent sync fabric). Worst case scenario, you have multiple passkeys per service identity/web property, one in each sync ecosystem (if the relying party supports it). Still better than passwords! If your SSO provider does't support passwordless/passkeys, loudly complain to them :) Azure Active Directory supports it, I have worked with a team to implement it. (great post btw to the Teleport folks, both content and visual appeal)
- candiddevmike 4y ago
  Hopefully someday some smart person invents a standard, secure way of handling enrollment/forgot my pass(key|word), as that will always be the weakest link. As much as it freaks some people out, a cryptographic national ID would be really helpful for this, IMO.
  - toomuchtodo 4y ago
    https://stripe.com/identity https://stripe.com/identity Agreed about a cryptographic national ID. One day! Login.gov is already prototyping using USPS for in person identity verification, we'll get there. https://news.ycombinator.com/item?id=34735448 https://news.ycombinator.com/item?id=34735448
ryukafalz 4y ago
Passkeys (in the sense the article is referring to, which is to say FIDO2 passkeys) are explicitly portable between devices. And the difference is they're always unique per-site in a way that passwords are not necessarily. It's possible to approach the security of passkeys if you always use unique passwords per-site (with e.g. a password manager) but you're still then vulnerable to phishing unlike with passkeys.
- deleted 4y ago
  [deleted]
- Groxx 4y ago
  Most password managers check the urls before filling.
  - vlovich123 4y ago
    That doesn't prevent phishing attacks where the user goes "uggh. my password manager isn't working again. I'm going to copy-paste the password in by hand".
    - danShumway 4y ago
      Similarly, passkeys don't necessarily block the phishing attack where the user goes, "ugh, this dongle/phone isn't working, I guess I need to put in one of these one-time recovery codes." Account recovery is still going to be a weak point here, and it's a kind of double-edged sword. If you're really strict about passkeys getting shared between devices or manually accessed, then users are going to lose access to accounts a lot, and recovery methods are going to get easier to accommodate those situations, which will in turn re-open phishing vulnerabilities. On the other hand, if services don't implement those recovery options, then the first time a user gets burned with losing access to an account for a week, they're going to stop using passkeys, and broader adoption will be halted.
- danShumway 4y ago
  > are explicitly portable between devices Yes and no. Passkeys are portable in the sense that Apple/Google have already compromised on the "keys should never leave your device" standard and have set up backup/restore options for if you lose your phone within their ecosystem. This is portability, but extremely limited portability. It's not portability in the sense of allowing you to migrate between ecosystems. There is also some promise that passkeys will be portable between Google/Apple ecosystems in the future. The fact that the FIDO alliance refuses to build a client-independent way of moving between ecosystems and instead seems to be suggesting that migration should be handled with environment-dependent implementations severely limits how useful that portability will be. Passkeys are also "portable" in the sense that you can register multiple keys with a single site. But this is not actual portability, it's just backup/replication. When you get a new device outside of the ecosystem, you can't port your passkeys anywhere. What you can do is register that device with every single site you have an account with. This should obviously be seen as a barrier to the goal of replacing passwords entirely, but for some reason it's not seen that way. To understand the problem, we have to stop thinking of the current world where there are like 4 or 5 sites that have passkeys attached to them; you have to instead think of a world where passkeys won and a user has hundreds of sites with passkeys attached to them, many of which they might not have visited in nearly a decade. And when they buy a new device, they have to migrate all of them. That's not portability, that is not something that a non-techie user wants to go through. > you're still then vulnerable to phishing unlike with passkeys. Extremely important to mention in these discussions, passkeys are phishing-resistant, not phishing-proof. We gave up on phishing-proof when Google and Apple started doing backup and restore within their own ecosystems. Your iCloud credentials can be phished, at which point your passkeys can also be phished by setting up a new iPhone. Arguably, the Yubikey/dedicated-token approach was phishing-proof (for at least a somewhat narrow definition of phishing), but that's not the approach that mainstream platforms are going for. If you're using an iPhone, your passkeys already get backed up. That ship has sailed, the only fight remaining is whether or not you should be able to import them to something that's not an Apple device.