5 ms·

Ignorant question: Are Passkeys, at some level of abstraction, permanently replacing "something you know" (password) with "something you have"? If I am in som

Ignorant question: Are Passkeys, at some level of abstraction, permanently replacing "something you know" (password) with "something you have"? If I am in some kind of calamity (dropped my phone, got robbed, etc), and I come to a friendly person's house, it sounds to me like I simply would not be able to login to potentially critical services, no matter how much I know, because I don't have anything (the device that passkeys are tied to / on). Is that true? And... am I the only person completely dreading this system? I don't live on my one and only phone; I have two phones, 3-4 tablets, 4-5 computers I use regularly. Of various operating systems, browsers, manufacturers, etc. I can create a password of arbitrary complexity and security and comfortably use all my devices as well as any new device that comes my way. Passkeys sound... like a nightmare? (they also sound AMAZING to my wife and family... woohoo no passwords, I just have to use my phone... until they INEVITABLY lose or break their phone... and then they'll come to me and I have no idea what to tell them anymore -- all your passkeys were on your device and now they're gone forever because Google & Apple decided it was better for you, and you did not follow obscure methods I frankly cannot help or explain to you to maybe possibly back them up, one day, when method exists, to some other device)

dcow 4y ago
I like to explain it like this: If you use a password manager today, then you're already essentially using something you have, because you need to be in possession of your login database to retrieve passwords, and nobody can remember that in their head. Passkeys is a formalization of the idea that you should be using a password manager where all the passwords are random uncrackable 32 character strings, and if we add this constraint then we can crazy secure things like employ asymmetric crypto to prevent phishing and MITM attacks, so woO!. You are right to be concerned about the whole device thing though. Apple addresses this by requiring that you use/enable iCloud keychain in order to use passkeys. The generalized solution to this is allowing 3rd parties to be your passkey provider, so that you can choose how your passkeys are stored (cloud synced vs device bound) and e.g. whether you want an implementation where you can unlock them with one strong something you know, something you are, something your have, or any combination thereof, the only limit being the features/options the different 3rd party products will offer, depending on their target market, etc.
- JohnFen 4y ago
  > The generalized solution to this is allowing 3rd parties to be your passkey provider, so that you can choose how your passkeys are stored The password manager I use has no cloud component (which is why I chose it), and addresses this by allowing me to export my password collection to an encrypted backup file. Would this be a thing that the passkey folks would be OK with? That would ease a lot of my hesitation.
  - snowwrestler 4y ago
    Yes you can just use a hardware FIDO token like a Yubikey as your passkey. And you can enroll more than one, so if you lose or wreck one, you’re not locked out.
    - danShumway 3y ago
      This is not really the same thing as what GP is asking? They're asking about backing up existing keys, you're talking about creating new ones. I can back up my entire password database just by copying a file. To "back up" a Yubikey I buy a new key then I individually visit every single site I have an account on and attach a new key one by one. That's not equivalent. It also makes setup a lot less convenient than a password manager would be. Every time I set up an account I need to set up two devices? And ideally they should be stored in different places, just having 2 Yubikeys in my pocket isn't really doing much for me, so now every signup is literally a 2-step process that involves going to 2 locations. "Just" is doing a lot of work here.
      - tadfisher 3y ago
        You are describing the tradeoff made by passkeys, yes. The idea is that it shouldn't be possible for someone to phish your passkey, because lives on a piece of hardware and signs challenges, but is not transmitted to the requesting party (or to anyone). Luckily, passkey "syncing" and "backup" means issuing a new key that's signed by an old key, so you can in fact have the convenience of paper-based backups if you want (that's how the QR codes work for syncing between passkey managers). I trust you can appreciate how this improves security in general, by trading some convenience.
lll-o-lll 4y ago
Yes, it replaces something you know with something you have and something you are. The hypothetical scenario you describe is a downside. As to your other concerns. Registering a passkey from each of your devices should be a trivial exercise. If you want to play with this now, GitHub has good integration (you can keep your password, the passkeys you register are just alternative ways to access). For your family, your concerns are not warranted because the “cloud backup” is part of the integration. With Apple, as an example, the passkeys are tied to your keychain, and changing devices/disaster recovery is relatively trivial. The passkeys are also accessible from all your Apple devices, so you don’t have to create separate ones.
aimor 4y ago
"And... am I the only person completely dreading this system? Passkeys sound... like a nightmare?" It's already a bad dream for me. I can't stand all the 6-digit code I have to fetch to do things like: check email, schedule appointments, pay bills, just plain buy stuff. I'm glad we're long past the days of emailing users forgotten passwords in plaintext, but I'd prefer to accept less security for the convenience of being able to log into an account without proving my identity via phone.
dwaite 3y ago
> Are Passkeys, at some level of abstraction, permanently replacing "something you know" (password) with "something you have"? Sometimes. The authenticator you choose to use sets the policy of what makes a valid authentication. So if your authenticator is "Google Password Manager", it is whatever steps you need to get into your Google account and enable the password manager. If you do not have the infrastructure to get into that account (say, you have a SMS fallback and your phone is dead), you'll be locked out. If your authenticator is say a hardware security key, then most likely losing that key means you have no backups. Even in this case, you can have more than one mechanism to recover access or to prove who you are (even if it is a second hardware key at home in the safe).
gondaloof 3y ago
This is my worry, but you now you just have to make sure you can access your keychain. Test your keychain access today, “lose your devices” and see if you can still get all your keys through other methods. This is especially important with 2FA. It is true that you cannot probably access your password without a new “owned” device though, gone are the days where you can hop onto a fresh device and type in your password of your email provider.

dcow 4y ago

I like to explain it like this: If you use a password manager today, then you're already essentially using something you have, because you need to be in possession of your login database to retrieve passwords, and nobody can remember that in their head. Passkeys is a formalization of the idea that you should be using a password manager where all the passwords are random uncrackable 32 character strings, and if we add this constraint then we can crazy secure things like employ asymmetric crypto to prevent phishing and MITM attacks, so woO!. You are right to be concerned about the whole device thing though. Apple addresses this by requiring that you use/enable iCloud keychain in order to use passkeys. The generalized solution to this is allowing 3rd parties to be your passkey provider, so that you can choose how your passkeys are stored (cloud synced vs device bound) and e.g. whether you want an implementation where you can unlock them with one strong something you know, something you are, something your have, or any combination thereof, the only limit being the features/options the different 3rd party products will offer, depending on their target market, etc.

JohnFen 4y ago
> The generalized solution to this is allowing 3rd parties to be your passkey provider, so that you can choose how your passkeys are stored The password manager I use has no cloud component (which is why I chose it), and addresses this by allowing me to export my password collection to an encrypted backup file. Would this be a thing that the passkey folks would be OK with? That would ease a lot of my hesitation.
- snowwrestler 4y ago
  Yes you can just use a hardware FIDO token like a Yubikey as your passkey. And you can enroll more than one, so if you lose or wreck one, you’re not locked out.
  - danShumway 3y ago
    This is not really the same thing as what GP is asking? They're asking about backing up existing keys, you're talking about creating new ones. I can back up my entire password database just by copying a file. To "back up" a Yubikey I buy a new key then I individually visit every single site I have an account on and attach a new key one by one. That's not equivalent. It also makes setup a lot less convenient than a password manager would be. Every time I set up an account I need to set up two devices? And ideally they should be stored in different places, just having 2 Yubikeys in my pocket isn't really doing much for me, so now every signup is literally a 2-step process that involves going to 2 locations. "Just" is doing a lot of work here.
    - tadfisher 3y ago
      You are describing the tradeoff made by passkeys, yes. The idea is that it shouldn't be possible for someone to phish your passkey, because lives on a piece of hardware and signs challenges, but is not transmitted to the requesting party (or to anyone). Luckily, passkey "syncing" and "backup" means issuing a new key that's signed by an old key, so you can in fact have the convenience of paper-based backups if you want (that's how the QR codes work for syncing between passkey managers). I trust you can appreciate how this improves security in general, by trading some convenience.

lll-o-lll 4y ago

Yes, it replaces something you know with something you have and something you are. The hypothetical scenario you describe is a downside. As to your other concerns. Registering a passkey from each of your devices should be a trivial exercise. If you want to play with this now, GitHub has good integration (you can keep your password, the passkeys you register are just alternative ways to access). For your family, your concerns are not warranted because the “cloud backup” is part of the integration. With Apple, as an example, the passkeys are tied to your keychain, and changing devices/disaster recovery is relatively trivial. The passkeys are also accessible from all your Apple devices, so you don’t have to create separate ones.

aimor 4y ago

"And... am I the only person completely dreading this system? Passkeys sound... like a nightmare?" It's already a bad dream for me. I can't stand all the 6-digit code I have to fetch to do things like: check email, schedule appointments, pay bills, just plain buy stuff. I'm glad we're long past the days of emailing users forgotten passwords in plaintext, but I'd prefer to accept less security for the convenience of being able to log into an account without proving my identity via phone.

dwaite 3y ago

> Are Passkeys, at some level of abstraction, permanently replacing "something you know" (password) with "something you have"? Sometimes. The authenticator you choose to use sets the policy of what makes a valid authentication. So if your authenticator is "Google Password Manager", it is whatever steps you need to get into your Google account and enable the password manager. If you do not have the infrastructure to get into that account (say, you have a SMS fallback and your phone is dead), you'll be locked out. If your authenticator is say a hardware security key, then most likely losing that key means you have no backups. Even in this case, you can have more than one mechanism to recover access or to prove who you are (even if it is a second hardware key at home in the safe).

gondaloof 3y ago

This is my worry, but you now you just have to make sure you can access your keychain. Test your keychain access today, “lose your devices” and see if you can still get all your keys through other methods. This is especially important with 2FA. It is true that you cannot probably access your password without a new “owned” device though, gone are the days where you can hop onto a fresh device and type in your password of your email provider.