4 ms·

if you're someone who uses a password manager already, and is generating unique random passwords for every website, the only appreciable difference between a pa

by n42 3y ago

if you're someone who uses a password manager already, and is generating unique random passwords for every website, the only appreciable difference between a passkey and what you do today is: - the passkey is never transmitted anywhere when logging in, eliminating the largest attack vectors for stealing passwords - you can no longer manually type the passkey in on random devices that don't have your password manager on it it's basically a really really long password you don't know with some added security guarantees. if you are not already doing this, then it requires adaptation to a world where you do not know your passwords and they are stored in a vault. this does mean ironing out account recovery for the account the vault is associated with. passkeys don't change that, though.

crote 3y ago
Not quite. The biggest difference is that websites seem to trust a passkey as both a password and a 2FA token at the same time. So security-wise it essentially means giving up 2FA altogether, as passkeys are about as secure as a password manager. So for anyone with a password manager and 2FA tokens, passkeys are a downgrade.
- n42 3y ago
  that'd be more of a choice by the service operator than a design detail of passkeys, right?
- stavros 3y ago
  This is wrong. Everyone here confuses "Passkeys the standard" with "some hardware implementation they've heard of". Yubikeys require a PIN, and the key is wiped if you enter it wrong ten times. Nobody stops you from making a hardware key that requires a long password to access it. You can do whatever you want, the standard doesn't care how you want to secure your keys. The standard just asks for a key at enrollment and then asks you to sign something with that key at signup. Anything after that is up to you and your choice of device. EDIT: I've written a short post to clarify a few misconceptions: https://www.stavros.io/posts/clearing-up-some-passkeys-misconceptions/ https://www.stavros.io/posts/clearing-up-some-passkeys-misco...
somehnguy 3y ago
> you can no longer manually type the passkey in on random devices that don't have your password manager on it This answers a question about them that I've been unable to find a clear answer for anywhere. My passwords are all randomly generated and stored in my password manager. It's cumbersome to type them in on some device without my password manager and I don't do it often, but at least I have the option! I really don't like the idea that my passwords/passkeys are some thing to just be abstracted away to the point that I have no idea where they are or how to access them manually if needed.
JohnFen 3y ago
> you can no longer manually type the passkey in on random devices that don't have your password manager on it This is a huge problem, though. My password manager has no online component, and only runs on my phone. On purpose. When I use it, the password manager shows me the password that I need, and I type it in manually. I could change to a different method, but then I lose a lot of flexibility. I can no longer log into things from machines other than my own. Things like Yubikey address some of this, but then I can no longer log into machines unless I have sufficient physical access to plug the key in. To be clear, I'm not arguing that any of this means passkeys aren't desirable, but I am saying this to point out that passkeys are not functionally equivalent to passwords, and passkeys do restrict some kinds of use.
kdklol 3y ago
No, it's not "just a long password". Here are the main benefits not mentioned, which a password cannot offer, regardless of how securely it is stored: - Phishing protection - passkey credential will be uniquely bound to a domain, so you cannot be phished - Keys cannot be exfiltrated from the hardware, so even if your password manager is compromised, your key would still protect you - Duplication protection - synced counters are stored on both the key and the server, so even if somebody does clone your key (very difficult), you'll know about it (unlike passwords) Obviously, there are some necessary assumptions made, about security of the passkey implementation, DNS security and so on. >if you are not already doing this, then it requires adaptation What doesn't? >ironing out account recovery for the account the vault is associated with Agreed. This is currently the weakest point in web security in general. I'd also like to mention (for everyone else reading this) that a unique set of credentials is generated per account, so this cannot be used to track you. Also, it's an open standard and open imolementations exist. It is bot reliant on google/yubico/"big tech". They're pushing it because it works.
- n42 3y ago
  I was speaking about the experience of a user who doesn't care about the details :)
  - kdklol 3y ago
    I understand. In that case I still think it's a bit of an understatement to call it a password, since especially inexpirienced users are more vulnerable to phishing, and this does protect against it, unlike a long password (even paired with other MFA methods!) Also there's nothing to remember or to install, so again, more normie-friendly. Sorry if I came of as too agressive, maybe I should've put in some smiley faceses too :)
- nottorp 3y ago
  > Obviously, there are some necessary assumptions made, about security of the passkey implementation, DNS security and so on. Basically you need to trust more vendors of security solutions than before, isn't it? Plus you cannot access your accounts from any random device without an intricate security setup that eats at your time and messes with the device. As in you cannot borrow your friend's laptop for 5 min to check your email any more. You have to set up your keys on said laptop and then remove them, which makes it a 2 hour affair?

by n42 3y ago

crote 3y ago

Not quite. The biggest difference is that websites seem to trust a passkey as both a password and a 2FA token at the same time. So security-wise it essentially means giving up 2FA altogether, as passkeys are about as secure as a password manager. So for anyone with a password manager and 2FA tokens, passkeys are a downgrade.

n42 3y ago
that'd be more of a choice by the service operator than a design detail of passkeys, right?
stavros 3y ago
This is wrong. Everyone here confuses "Passkeys the standard" with "some hardware implementation they've heard of". Yubikeys require a PIN, and the key is wiped if you enter it wrong ten times. Nobody stops you from making a hardware key that requires a long password to access it. You can do whatever you want, the standard doesn't care how you want to secure your keys. The standard just asks for a key at enrollment and then asks you to sign something with that key at signup. Anything after that is up to you and your choice of device. EDIT: I've written a short post to clarify a few misconceptions: https://www.stavros.io/posts/clearing-up-some-passkeys-misconceptions/ https://www.stavros.io/posts/clearing-up-some-passkeys-misco...

somehnguy 3y ago

> you can no longer manually type the passkey in on random devices that don't have your password manager on it This answers a question about them that I've been unable to find a clear answer for anywhere. My passwords are all randomly generated and stored in my password manager. It's cumbersome to type them in on some device without my password manager and I don't do it often, but at least I have the option! I really don't like the idea that my passwords/passkeys are some thing to just be abstracted away to the point that I have no idea where they are or how to access them manually if needed.

JohnFen 3y ago

> you can no longer manually type the passkey in on random devices that don't have your password manager on it This is a huge problem, though. My password manager has no online component, and only runs on my phone. On purpose. When I use it, the password manager shows me the password that I need, and I type it in manually. I could change to a different method, but then I lose a lot of flexibility. I can no longer log into things from machines other than my own. Things like Yubikey address some of this, but then I can no longer log into machines unless I have sufficient physical access to plug the key in. To be clear, I'm not arguing that any of this means passkeys aren't desirable, but I am saying this to point out that passkeys are not functionally equivalent to passwords, and passkeys do restrict some kinds of use.

kdklol 3y ago

No, it's not "just a long password". Here are the main benefits not mentioned, which a password cannot offer, regardless of how securely it is stored: - Phishing protection - passkey credential will be uniquely bound to a domain, so you cannot be phished - Keys cannot be exfiltrated from the hardware, so even if your password manager is compromised, your key would still protect you - Duplication protection - synced counters are stored on both the key and the server, so even if somebody does clone your key (very difficult), you'll know about it (unlike passwords) Obviously, there are some necessary assumptions made, about security of the passkey implementation, DNS security and so on. >if you are not already doing this, then it requires adaptation What doesn't? >ironing out account recovery for the account the vault is associated with Agreed. This is currently the weakest point in web security in general. I'd also like to mention (for everyone else reading this) that a unique set of credentials is generated per account, so this cannot be used to track you. Also, it's an open standard and open imolementations exist. It is bot reliant on google/yubico/"big tech". They're pushing it because it works.

n42 3y ago
I was speaking about the experience of a user who doesn't care about the details :)
- kdklol 3y ago
  I understand. In that case I still think it's a bit of an understatement to call it a password, since especially inexpirienced users are more vulnerable to phishing, and this does protect against it, unlike a long password (even paired with other MFA methods!) Also there's nothing to remember or to install, so again, more normie-friendly. Sorry if I came of as too agressive, maybe I should've put in some smiley faceses too :)
nottorp 3y ago
> Obviously, there are some necessary assumptions made, about security of the passkey implementation, DNS security and so on. Basically you need to trust more vendors of security solutions than before, isn't it? Plus you cannot access your accounts from any random device without an intricate security setup that eats at your time and messes with the device. As in you cannot borrow your friend's laptop for 5 min to check your email any more. You have to set up your keys on said laptop and then remove them, which makes it a 2 hour affair?