10 ms·
Passkeys are generally available
- thrill 3y agoWorks smoothly with MacOS and TouchID.
- jjgreen 3y ago[flagged]
- pacifika 3y agoHad no problem with 1password.
- danpalmer 3y agoI had extensive problems with 1Password, to the point of contacting support. I set up passkeys via the recommended way – looking at sites in Watchtower to see which had passkey support available. I followed the links, added one for Google, but it didn't disappear from that list and didn't show a passkey despite choosing to update the existing entry. Tried adding one for Microsoft, no option, despite the link from 1Password. Tried adding one for Amazon, the link was US-only, didn't work with my Amazon UK account. Tried adding one to GitHub, also didn't appear to save, no passkey in 1Password, still in the Watchtower category of needing a passkey. I decided to log out of GitHub to try to log back in, but my iPhone didn't have an option of using a 1Password key (despite 1Password being my passkey provider of choice). Tried many times, on luck. Emailed support. A few hours later re-opened 1Password and saw that there was now a passkey, and then login worked. Seems I wonder if all the feature flags are taking a while to flip around the web – 1Password's own support, Microsoft's rollout, etc – as companies start to go live with it all.
- blfr 3y agoOK, so I guess I will have to learn about these passkeys. Which source do you recommend to tell me what it actually is without marketing hype from one of the providers and honestly lays out whether it's better than my current firefox password manager + yubi keys combo.
- NoZebra120vClip 3y agoThey will turn our security keys into junk: https://fy.blackhats.net.au/blog/2023-02-02-how-hype-will-turn-your-security-key-into-junk/ https://fy.blackhats.net.au/blog/2023-02-02-how-hype-will-tu...
- snuxoll 3y agoPersonally I think the rk requirement is just fine, the long-tail goal of Passkeys is to simply credential management for users and the UX of key wrapping stands in opposition of that. Having a security key handle unlocking your platform authenticator/password manager seems to be the middle ground that's being driven towards, and as somebody with multiple YubiKey's I'm perfectly fine with it.
- microtonal 3y agoAt the risk of setting up a straw man (but the sentiment of your comment seems negative), but should we slow down improved security for the for the whole population, so that a bunch of tech people who have hardware keys with a measly 20 or 32 slots can keep using them? Sure, authentication could also be done without resident keys, but resident keys simplify the authentication workflow a lot, since the relying party doesn't need some additional credentials to send the correct wrapped key. (Disclaimer: I have several Yubikeys.)
- yencabulator 3y agoInterestingly, this link says > [The definition "passkey is a resident key"] has become so invasive that even FIDO now use it as their definition. but the linked FAQ for "their definition" doesn't contain the word "resident" (anymore?).
- 3y ago
- samcat116 3y agoVery nice! Passkeys can't come soon enough to more services.
- throwawa14223 3y agoI still don’t understand why anyone who isn’t in the walled garden business would consent to passkeys.
- iknowstuff 3y agoBecause you don't understand passkeys. And you probably don't know password managers can store passkeys as well as the OS
- CharlesW 3y agoMaybe you misunderstand how they work? My GitHub account currently has a 1Password passkey and an Apple passkey. IIRC I added the Apple-generated passkey before 1Password supported them, but both work, and neither prevents me from moving to a different pass* manager in the future. I personally feel safer that passkeys aren't sync'd across multiple vendors' products.
- raisedrased 3y agoGood. Now I can access someone's entire life including their banking just by guessing the pin on their phone. We went from bad passwords to even worse pins. But hey at least advertising agencies and the police can track you from one device to the next.
- judge2020 3y agoSo step 1 is stalk someone to see their passcode, and step 2 is steal their phone. Is phone theft of this level rampant where you're from? Even if a phone is stolen, going far enough to commit wire fraud by stealing money from someone's bank is too much to ask for over selling it to China for $200+. > But hey at least advertising agencies and the police can track you from one device to the next. Passkeys are unique per login (not per device/user) and the actual synchronization provider is not in the loop - and for e2ee solutions like Password managers or iCloud Keychain, they don't even know what websites are being synced.
- musictubes 3y agoHow are passkeys worse than passwords for tracking you across devices?
- tpmx 3y agoI think a weakness with Github might be ssh-based pushes. Hopefully the user uses an ssh passphrase (typed at every remote git interaction, or typed once per session via ssh-agent. MacOS does something special with their secure enclave thing.) But how do you secure that against the threat of a keylogger running on a developer's Linux machine? Am I overthinking here? Is it already game over if the attacker runs software on that developer's machine?
- heavyset_go 3y agoYou can use FIDO security keys with SSH and a keylogger would be useless unless someone has physical access to your security key.
- tpmx 3y agoThanks, this looks interesting. Are you using Yubikeys or something else? https://developers.yubico.com/SSH/Securing_SSH_with_FIDO2.html https://developers.yubico.com/SSH/Securing_SSH_with_FIDO2.ht...
- ikornaselur 3y agoI use a Google Titan key for this purpose, have a ssh key password that I can "cache" for the session on my macos key chain, but I have to tap the Titan key for every pull/push
- heavyset_go 3y agoBoth. FIDO2 compliant devices need to implement ECDSA at minimum, which means you can use non-discoverable keys for SSH at minimum. Yubikeys, and some others, also implement Ed25519 and discoverable key storage, so you can store SSH keys on the Yubikey itself.
- wkat4242 3y agoYes be aware that the discoverable slots are very limited (I forget but I think it's 8) and they are also used for passwordless use with websites. There's no way to reassign those slots right now short of wiping the whole key.
- shepherdjerred 3y agoI've had a great experience with 1Password + Passkeys [0]. With 1Password I can sync my Passkeys between my devices, and it pops up with a notification when I can use a Passkey to login which is handy. I'm not really sure how to use Passkeys on my iPhone with 1Password, but I'm sure that'll come as Passkeys gain traction. 1Password has a directory [1] of sites that have Passkey support, so one day I moved over those accounts. [0]: https://1password.com/product/passkeys https://1password.com/product/passkeys [1]: https://passkeys.directory/ https://passkeys.directory/
- andix 3y agoThis was always driving me crazy about webauthn, that you couldn't sync it between devices. You always had to add at least a few devices, not to lose access if you lose a device. And keep track of all services, so you can add new devices if you change them. Not very practical. I try always to disable email or SMS 2FA/recovery, because I deem them to be rather unsafe. Btw Bitwarden announced to support pass keys soon ("in October").
- yencabulator 3y agoHardware keys don't want to transfer the private key out of the hardware gadget, because that compromises the security model. That's their whole point, you can't extract the secrets, the hardware would rather self-destruct than expose the secret. Lack of "sync" (while retaining ease of transferring the key between computers) is the the primary purpose of a hardware security key. You're opting to a lower security level by wanting something that can be synced.
- shepherdjerred 3y ago> You're opting to a lower security level by wanting something that can be synced. I don't think most users care
- andix 3y agoI do care about security, but if I lose my yubikey and i can't backup it, then I need to keep some (insecure) account recovery options enabled. If I can backup my passkeys, then I can disable them.
- donatj 3y agoI think the biggest roadblock to widespread adoption outside major corporations is how complex they are to implement on the server side, in particular in comparison to passwords which are trivial. Every implementation I've seen so far has been multiple thousands of lines, whereas password auth can be done in several lines. Libraries will come for every major language in time, we'll see how easy it becomes to implement. I'm hopeful.
- andix 3y agoSafe password authentication is also not trivial to implement, especially not with a second factor. Let's hope even more people will use authentication frameworks created by experts, instead of some badly salted password databases.
- teeray 3y ago> Every implementation I've seen so far has been multiple thousands of lines… Libraries will come for every major language in time, we'll see how easy it becomes to implement. I'm hopeful. This becomes a liability for security when everyone becomes a user and very few people are contributing. OpenSSL has been an example of this in the past.
- aseipp 3y ago> whereas password auth can be done in several lines. Secure password auth is complex and because of externally imposed constraints like phishing, generally needs more work to support. You also need recovery flows, etc, since just losing access typically isn't acceptable. So I don't think password auth can really be "done in several lines." Realistically, I think the takeaway is that no matter what you're talking about, storing private material on behalf of someone sucks complete ass, and is not easy to accomplish on a modern computer in a secure manner, no matter how you slice it. But we still have to do it. Luckily Passkeys do have actual tangible benefits beyond passwords (e.g. unphishable, no private key material stored by the server), so getting this right does come with actual benefits beyond the status quo.
- dwaite 3y agoA webauthn library will likely support things which you don't need for simply accepting passkeys, such as attestations and extension support. A minimal implementation can be dramatically simpler; the problem comes in conveying to an application developer what their requirements are for implementing the minimal flow.
- jopsen 3y agoIs it correct that a yubikey with U2F / webauthn can be used as a passkey, it's just the physically portable kind? Isn't this just removing the password factor, for people already using a security key?
- eli 3y agoPasskey is really just a type of webauthn. It doesn't necessarily have to remove any other factors. I think the primary goal is to replace single-factor passwords with it.
- rfoo 3y agoIn theory, passkey replaces password. Single factor passkey is more secure than single password, and it doesn't matter where it's stored. A passkey in whatever password manager we use (KeePass etc) makes sense. Such a passkey should not replace 2FA - you'd better still have a second factor. The confusing part is Google, Apple and Microsoft implemented a hardware-secured (hardware is by default the enclave of your phone AND vendor's HSM in cloud) form of passkey, which can also serve as the second factor, replacing both password and 2FA. Some website then decided to support this type of passkey only, NOT passkey + security key, some are even deprecating security key U2F support.
- dwaite 3y agoThe passkey terminology is describing a "primary factor" user experience, which requires certain WebAuthn features to be implemented. A U2F-only key does not have storage so it cannot implement discoverability on its own. So it won't work as a passkey. A more modern Yubikey/security key will have the storage to do discoverability, as well as user verification (via pin or possibly via biometric) which some sites might also require.
- tzs 3y agoLooks like GitHub is handling Passkeys smoothly. I added one on my Mac stored in 1Password with no problems. Note that not all sites are handling it quite as well. For example I tried to add one at Home Depot. As part of this they emailed me a verification code. I entered the code, and it then asked if I wanted to enable login by Face ID or Touch ID. I'm on a Mac which has neither Face ID or Touch ID so said no. It continued and I was logged in. It turns out that if you say no it doesn't actually make a Passkey. It just does a one time password free login via entering that code that was mailed to you. To actually make a Passkey for Home Depot you have to say yes to Face ID or Touch ID.
- ajyey 3y agoI also went through this today. Kind of confusing but worked in the end
- dilippkumar 3y ago> We found that Linux and Firefox users struggled to use passkeys, as those platforms don’t yet have strong support for passkeys. > As a result, we decided to enable cross-device registration of passkeys. That means, you can register a passkey on your phone while you’re using your desktop. The passkey lives in the phone, but users can connect it to their desktop and set-up and authenticate through the desktop’s browser. This enables Linux and Firefox users to set up passkeys. This has always been the real no-go for me when I was implementing auth. I looked into supporting passkeys and found that they're basically useless unless you can make some strong guarantees about who/what can access the keys stored on the device. Linux and the various BSDs can not do this today (and likely will ever be able to do this well given that someone can always recompile a malicious OS that pretends to be another well-trusted OS). If a user needs to reach to their phone to log into something on their laptop - that's never going to be really secure. It's only a matter of time before everyone starts having "We will never ask for you to log in through your phone, don't do this if someone asks you to" warning labels and respawn the entire industry of anti-phishing mechanisms for this new attack vector.
- butz 3y agoDid any Linux distro showed any interest to implement Passkeys? Ubuntu and Fedora are probably most likely to do something about it first. Ubuntu already has encryption that uses TPM chip.
- hex-m 3y agoIf you mean "FIDO2 platform authenticator", this project looks promising: https://github.com/AlfioEmanueleFresta/xdg-credentials-portal https://github.com/AlfioEmanueleFresta/xdg-credentials-porta...
- kevincox 3y ago> and likely will ever be able to do this well given that someone can always recompile a malicious OS that pretends to be another well-trusted OS I don't understand your concern here. Do you mean an evil-maid style attack? At some point you need to trust the user to keep their device secure. A Windows can also have malware.
- lostindetails 3y agoUsing passkeys as an additional login method I can understand, but I have a problem that I don't know how to solve: How can I guard against losing permanent access to my github account? Until know I have memorized a very long and random password, that I sometimes type in to keep it in memory. In case of a fire or some similar event in which I would lose my stuff (like devices recovery codes) I'd have no issue, but with the upcoming requirement on github which enforces 2-factor authentication I don't know how I would be able to get access to my account?
- wetpaws 3y ago[dead]
- neonnomad 3y ago1password can store passkeys for you and sync between multiple devices. Then I add a Yubikey Bio to add of these accounts as a backup.
- lostindetails 3y agoThank you for the answer! I don't want to use a cloud service for sync, I will take a look if an opensource solution has a direct device to device sync, I haven't thought about that. I will also checkout the yubikey bio - I guess as it's hardware so no pesky account cloud connected? Thanks for the ideas!
- tgsovlerkhgsel 3y agoGiven GitHubs policy of "no account recovery if you lose 2FA, ever, if you screw up you lose that account forever", lockout seems a bigger threat than takeover. Luckily, Github lets you add SMS 2FA. That isn't secure, but at least you should be able to get access to your phone number in case of a disaster. A TOTP seed backed up (on paper only) in multiple locations is also a good fallback.
- lostindetails 3y agoI agree - at least for me, the lockout scenario seems more likely. The SMS 2FA is great point! Until now I was able to not hand out my number to bigtech, eg. for Chatgpt I bought an new SIM card with a 5 EUR deposit that I just used for the registration process, but those cards expire after a couple of months if you don't use them. Guess I have to give out cellphone number after all... Printing out the TOTP seed and hiding the paper in multiple locations sounds somewhat wrong to me. Maybe the TOTP seed will be my new, even longer password to remember j/k Hmm, but if you would cryptographically hide it in publicly available data, it would be easy to recover. Thanks for the input!
- wkat4242 3y agoThe super annoying thing with github is that while it supports passkeys now, it still requires you to set up TOTP (eg Google authenticator) as the main MFA method and requires you to "verify" it often. Leading me to have to go find my phone, open the MFA app etc when I could just simply tap my Yubikey. It's really dumb and I hate github for it. I don't even have anything important on my account, I just use it to log some bugs in FOSS apps. It's time for the FOSS community to compete moving away from this platform as they started to do when Microsoft took it over.
- abraham 3y agoGitHub has a "Preferred 2FA method" method that you can set to passkeys.
- wkat4242 3y agoYes I know. During normal use it uses it. But you still can't remove the TOTP and it will keep asking to 'verify' it every month or so.
- abraham 3y agoI don't remember verifying TOTP in months. I'm pretty sure since I setup passkeys. Maybe it's not required if you have three methods setup.
- tgsovlerkhgsel 3y agoThe rapid change in standards coupled with confusing/changing naming got me to the point where I have no clue what the currently best approach for "passwordless and/or actually secure 2FA" is. I also got locked out of an account (not Github) that I now can't recover without providing photo ID and god knows what other data, because something about their implementation changed and now my security key is no longer accepted. Most of the few sites that accept security keys also only let you register one, which means you can't have a backup. As I understand Passkeys "solve" this by effectively being backed up to your Google or Apple account, so once that's compromised, you've lost. As long as you're using a password manager (which will not autofill on phishing sites), passwords still seem like the way to go, unfortunately...
- dwaite 3y ago> As I understand Passkeys "solve" this by effectively being backed up to your Google or Apple account, so once that's compromised, you've lost. Lowercase p, like passwords > As long as you're using a password manager (which will not autofill on phishing sites), passwords still seem like the way to go, unfortunately... Many password managers have rolled out passkey support; iOS 17 and Android 14(?) have support for third party passkey providers at the OS level, while some of these managers inject support directly into the browser via a web extension.
- ryanisnan 3y agoThank you for the correction. I have been referring to them as Passkeys.