3 ms·

Passkey is a concept that even the majority of tech enthusiasts seem not to have groked as of today. The thing that google/Apple have brought to the table is cl

Passkey is a concept that even the majority of tech enthusiasts seem not to have groked as of today. The thing that google/Apple have brought to the table is cloud backup of your private keys (yes, you should have lots of questions about how that is managed). This should enable disaster recovery/device transition for people using a phone as one of their passkeys. You’d probably add a fingerprint from your laptop for convenience, and if that laptop is all you have then no disaster recovery for you. However, to be fair, if people have one of something it’s going to be a phone. If you use google or android, then those keys are backed up into the cloud “securely”. Those keys are also “secured” on the device. Not as good as HSM, but if you dig into the details it’s probably much more solid than you’d expect.

donmcronald 4y ago
> The thing that google/Apple have brought to the table is cloud backup of your private keys (yes, you should have lots of questions about how that is managed). Absolutely. I keep my BitLocker keys in my Microsoft account because it's a simple solution that provides good enough security for me. If someone wants access to my data they have to get the key and my disk. I understand it and I'm satisfied with how it works. With passkeys, having a cloud backup doesn't even make sense to me. If I'm using a YubiKey or a TPM, the private key can't be extracted to back it up, so what do they back up? Do I have to opt in to a weaker system to get cloud backups? At the very least, I should be able to designate trusted parties (parents, siblings, kids) where at least one of them has to approve the recovery of a cloud backup. Microsoft, Google, etc. shouldn't be able to access it at all. I trust my family, not big tech.
- lll-o-lll 4y ago
  Apple, as an example, promise that your keys are end-to-end encrypted and not viewable by Apple themselves. https://support.apple.com/en-au/HT213305#:~:text=Recovery%20security&text=Passkeys%20can%20be%20recovered%20through,and%20other%20data%20it%20contains https://support.apple.com/en-au/HT213305#:~:text=Recovery%20.... Should you trust Apple? Is this secure enough if a password can still be used that recovers all these keys? Ultimately there is always a convenience/security trade-off. The “passkey” concept has it right for the 99% of users case (in my opinion). For that 1%, it’s still WebAuthn, so nothing stops you from using a Yubikey with a second safe-held Yubikey for disaster recovery.
  - donmcronald 4y ago
    > Apple, as an example, promise that your keys are end-to-end encrypted and not viewable by Apple themselves. That means single device users are in for a bad time if they lose their device.
    - lll-o-lll 4y ago
      Incorrect. They get a new phone, login with their password and all their keys are downloaded to the new device.
      - donmcronald 4y ago
        I’m guessing that means there’s some kind of key derivation happening which means it’s super similar to modern password managers IMO. I realize there are some benefits, but in a password based world I can memorize my highest value passwords and salt others with a common password. I don’t see the value in making such a big change for such little gain.

donmcronald 4y ago

> The thing that google/Apple have brought to the table is cloud backup of your private keys (yes, you should have lots of questions about how that is managed). Absolutely. I keep my BitLocker keys in my Microsoft account because it's a simple solution that provides good enough security for me. If someone wants access to my data they have to get the key and my disk. I understand it and I'm satisfied with how it works. With passkeys, having a cloud backup doesn't even make sense to me. If I'm using a YubiKey or a TPM, the private key can't be extracted to back it up, so what do they back up? Do I have to opt in to a weaker system to get cloud backups? At the very least, I should be able to designate trusted parties (parents, siblings, kids) where at least one of them has to approve the recovery of a cloud backup. Microsoft, Google, etc. shouldn't be able to access it at all. I trust my family, not big tech.

lll-o-lll 4y ago
Apple, as an example, promise that your keys are end-to-end encrypted and not viewable by Apple themselves. https://support.apple.com/en-au/HT213305#:~:text=Recovery%20security&text=Passkeys%20can%20be%20recovered%20through,and%20other%20data%20it%20contains https://support.apple.com/en-au/HT213305#:~:text=Recovery%20.... Should you trust Apple? Is this secure enough if a password can still be used that recovers all these keys? Ultimately there is always a convenience/security trade-off. The “passkey” concept has it right for the 99% of users case (in my opinion). For that 1%, it’s still WebAuthn, so nothing stops you from using a Yubikey with a second safe-held Yubikey for disaster recovery.
- donmcronald 4y ago
  > Apple, as an example, promise that your keys are end-to-end encrypted and not viewable by Apple themselves. That means single device users are in for a bad time if they lose their device.
  - lll-o-lll 4y ago
    Incorrect. They get a new phone, login with their password and all their keys are downloaded to the new device.
    - donmcronald 4y ago
      I’m guessing that means there’s some kind of key derivation happening which means it’s super similar to modern password managers IMO. I realize there are some benefits, but in a password based world I can memorize my highest value passwords and salt others with a common password. I don’t see the value in making such a big change for such little gain.