5 ms·

Passkeys (in the sense the article is referring to, which is to say FIDO2 passkeys) are explicitly portable between devices. And the difference is they're alway

Passkeys (in the sense the article is referring to, which is to say FIDO2 passkeys) are explicitly portable between devices. And the difference is they're always unique per-site in a way that passwords are not necessarily. It's possible to approach the security of passkeys if you always use unique passwords per-site (with e.g. a password manager) but you're still then vulnerable to phishing unlike with passkeys.

deleted 4y ago
[deleted]
Groxx 4y ago
Most password managers check the urls before filling.
- vlovich123 4y ago
  That doesn't prevent phishing attacks where the user goes "uggh. my password manager isn't working again. I'm going to copy-paste the password in by hand".
  - danShumway 4y ago
    Similarly, passkeys don't necessarily block the phishing attack where the user goes, "ugh, this dongle/phone isn't working, I guess I need to put in one of these one-time recovery codes." Account recovery is still going to be a weak point here, and it's a kind of double-edged sword. If you're really strict about passkeys getting shared between devices or manually accessed, then users are going to lose access to accounts a lot, and recovery methods are going to get easier to accommodate those situations, which will in turn re-open phishing vulnerabilities. On the other hand, if services don't implement those recovery options, then the first time a user gets burned with losing access to an account for a week, they're going to stop using passkeys, and broader adoption will be halted.
danShumway 4y ago
> are explicitly portable between devices Yes and no. Passkeys are portable in the sense that Apple/Google have already compromised on the "keys should never leave your device" standard and have set up backup/restore options for if you lose your phone within their ecosystem. This is portability, but extremely limited portability. It's not portability in the sense of allowing you to migrate between ecosystems. There is also some promise that passkeys will be portable between Google/Apple ecosystems in the future. The fact that the FIDO alliance refuses to build a client-independent way of moving between ecosystems and instead seems to be suggesting that migration should be handled with environment-dependent implementations severely limits how useful that portability will be. Passkeys are also "portable" in the sense that you can register multiple keys with a single site. But this is not actual portability, it's just backup/replication. When you get a new device outside of the ecosystem, you can't port your passkeys anywhere. What you can do is register that device with every single site you have an account with. This should obviously be seen as a barrier to the goal of replacing passwords entirely, but for some reason it's not seen that way. To understand the problem, we have to stop thinking of the current world where there are like 4 or 5 sites that have passkeys attached to them; you have to instead think of a world where passkeys won and a user has hundreds of sites with passkeys attached to them, many of which they might not have visited in nearly a decade. And when they buy a new device, they have to migrate all of them. That's not portability, that is not something that a non-techie user wants to go through. > you're still then vulnerable to phishing unlike with passkeys. Extremely important to mention in these discussions, passkeys are phishing-resistant, not phishing-proof. We gave up on phishing-proof when Google and Apple started doing backup and restore within their own ecosystems. Your iCloud credentials can be phished, at which point your passkeys can also be phished by setting up a new iPhone. Arguably, the Yubikey/dedicated-token approach was phishing-proof (for at least a somewhat narrow definition of phishing), but that's not the approach that mainstream platforms are going for. If you're using an iPhone, your passkeys already get backed up. That ship has sailed, the only fight remaining is whether or not you should be able to import them to something that's not an Apple device.
- ryukafalz 4y ago
  Yes, migration between ecosystems being missing is an issue that needs to be fixed, and I hope that happens. That said, Google/Apple/Microsoft aren't the only providers that can provide passkey support; the password managers are getting into the game too. 1Password already has a demo available, and Bitwarden has said they're working on it. I plan to use those when they're available rather than any of the big players, because they are cross platform (and Bitwarden is even FOSS). > Extremely important to mention in these discussions, passkeys are phishing-resistant, not phishing-proof. We gave up on phishing-proof when Google and Apple started doing backup and restore within their own ecosystems. Your iCloud credentials can be phished, at which point your passkeys can also be phished by setting up a new iPhone. Sure. You could get more specific and say the act of logging in with a passkey is phishing-proof, but access to the passkey "wallet" is not necessarily. That's still a substantial improvement though; to use 1Password as an example, I use it to log into things much more frequently than I set up 1Password on a new device (which involves a security key in addition to your master password). But the security of this is indeed dependent on the particular implementation.

deleted 4y ago

[deleted]

Groxx 4y ago

Most password managers check the urls before filling.

vlovich123 4y ago
That doesn't prevent phishing attacks where the user goes "uggh. my password manager isn't working again. I'm going to copy-paste the password in by hand".
- danShumway 4y ago
  Similarly, passkeys don't necessarily block the phishing attack where the user goes, "ugh, this dongle/phone isn't working, I guess I need to put in one of these one-time recovery codes." Account recovery is still going to be a weak point here, and it's a kind of double-edged sword. If you're really strict about passkeys getting shared between devices or manually accessed, then users are going to lose access to accounts a lot, and recovery methods are going to get easier to accommodate those situations, which will in turn re-open phishing vulnerabilities. On the other hand, if services don't implement those recovery options, then the first time a user gets burned with losing access to an account for a week, they're going to stop using passkeys, and broader adoption will be halted.

danShumway 4y ago

> are explicitly portable between devices Yes and no. Passkeys are portable in the sense that Apple/Google have already compromised on the "keys should never leave your device" standard and have set up backup/restore options for if you lose your phone within their ecosystem. This is portability, but extremely limited portability. It's not portability in the sense of allowing you to migrate between ecosystems. There is also some promise that passkeys will be portable between Google/Apple ecosystems in the future. The fact that the FIDO alliance refuses to build a client-independent way of moving between ecosystems and instead seems to be suggesting that migration should be handled with environment-dependent implementations severely limits how useful that portability will be. Passkeys are also "portable" in the sense that you can register multiple keys with a single site. But this is not actual portability, it's just backup/replication. When you get a new device outside of the ecosystem, you can't port your passkeys anywhere. What you can do is register that device with every single site you have an account with. This should obviously be seen as a barrier to the goal of replacing passwords entirely, but for some reason it's not seen that way. To understand the problem, we have to stop thinking of the current world where there are like 4 or 5 sites that have passkeys attached to them; you have to instead think of a world where passkeys won and a user has hundreds of sites with passkeys attached to them, many of which they might not have visited in nearly a decade. And when they buy a new device, they have to migrate all of them. That's not portability, that is not something that a non-techie user wants to go through. > you're still then vulnerable to phishing unlike with passkeys. Extremely important to mention in these discussions, passkeys are phishing-resistant, not phishing-proof. We gave up on phishing-proof when Google and Apple started doing backup and restore within their own ecosystems. Your iCloud credentials can be phished, at which point your passkeys can also be phished by setting up a new iPhone. Arguably, the Yubikey/dedicated-token approach was phishing-proof (for at least a somewhat narrow definition of phishing), but that's not the approach that mainstream platforms are going for. If you're using an iPhone, your passkeys already get backed up. That ship has sailed, the only fight remaining is whether or not you should be able to import them to something that's not an Apple device.

ryukafalz 4y ago
Yes, migration between ecosystems being missing is an issue that needs to be fixed, and I hope that happens. That said, Google/Apple/Microsoft aren't the only providers that can provide passkey support; the password managers are getting into the game too. 1Password already has a demo available, and Bitwarden has said they're working on it. I plan to use those when they're available rather than any of the big players, because they are cross platform (and Bitwarden is even FOSS). > Extremely important to mention in these discussions, passkeys are phishing-resistant, not phishing-proof. We gave up on phishing-proof when Google and Apple started doing backup and restore within their own ecosystems. Your iCloud credentials can be phished, at which point your passkeys can also be phished by setting up a new iPhone. Sure. You could get more specific and say the act of logging in with a passkey is phishing-proof, but access to the passkey "wallet" is not necessarily. That's still a substantial improvement though; to use 1Password as an example, I use it to log into things much more frequently than I set up 1Password on a new device (which involves a security key in addition to your master password). But the security of this is indeed dependent on the particular implementation.