5 ms·

OK, so I guess I will have to learn about these passkeys. Which source do you recommend to tell me what it actually is without marketing hype from one of the pr

by blfr 3y ago

OK, so I guess I will have to learn about these passkeys. Which source do you recommend to tell me what it actually is without marketing hype from one of the providers and honestly lays out whether it's better than my current firefox password manager + yubi keys combo.

NoZebra120vClip 3y ago
They will turn our security keys into junk: https://fy.blackhats.net.au/blog/2023-02-02-how-hype-will-turn-your-security-key-into-junk/ https://fy.blackhats.net.au/blog/2023-02-02-how-hype-will-tu...
- snuxoll 3y ago
  Personally I think the rk requirement is just fine, the long-tail goal of Passkeys is to simply credential management for users and the UX of key wrapping stands in opposition of that. Having a security key handle unlocking your platform authenticator/password manager seems to be the middle ground that's being driven towards, and as somebody with multiple YubiKey's I'm perfectly fine with it.
- microtonal 3y ago
  At the risk of setting up a straw man (but the sentiment of your comment seems negative), but should we slow down improved security for the for the whole population, so that a bunch of tech people who have hardware keys with a measly 20 or 32 slots can keep using them? Sure, authentication could also be done without resident keys, but resident keys simplify the authentication workflow a lot, since the relying party doesn't need some additional credentials to send the correct wrapped key. (Disclaimer: I have several Yubikeys.)
- yencabulator 3y ago
  Interestingly, this link says > [The definition "passkey is a resident key"] has become so invasive that even FIDO now use it as their definition. but the linked FAQ for "their definition" doesn't contain the word "resident" (anymore?).
toomuchtodo 3y ago
https://www.stavros.io/posts/clearing-up-some-passkeys-misconceptions/ https://www.stavros.io/posts/clearing-up-some-passkeys-misco... (courtesy of u/stavros)
evil-olive 3y ago
the FIDO Alliance has an FAQ [0] > What is a passkey? > Any passwordless FIDO credential is a passkey. I would recommend [1] as an excellent overview of the FIDO2 and WebAuthn standards that underlie passkeys. depending on how you use your Yubikeys, you may already be using these standards. if you already have a password manager you're happy with, the appeal of adopting passkeys is somewhat marginal. if you're using your Yubikeys for FIDO2-based MFA you're already getting the majority of the benefit. 0: https://fidoalliance.org/passkeys/#faq https://fidoalliance.org/passkeys/#faq 1: https://www.youtube.com/watch?v=DWrLBwi7ZBA https://www.youtube.com/watch?v=DWrLBwi7ZBA
- Ajedi32 3y ago
  > if you already have a password manager you're happy with, the appeal of adopting passkeys is somewhat marginal This is where I'm at personally right now; basically just waiting for my favorite password manager to add support for passkeys. After that the transition will be pretty seamless; I'll just start storing passkeys in my password manager instead of passwords wherever possible, and get a nice UX improvement as a result.
  - snuxoll 3y ago
    There's a nice security improvement to passkeys, as well. No more passwords getting leaked from poorly-run websites, security breaches, etc. You can dump an entire user database and nobody is compromised outside of the obvious privacy implications.
    - Ajedi32 3y ago
      The biggest security benefit of passkeys is that they raise the floor of security posture for the least security conscious users. E.g. You can't use "bob1989!" as your password on every single site, write it on a post-it stuck to your monitor, and enter it into every phishing site that sends you an email claiming to be from "M1cro3oft Supp0rt". For users who already have a very good security posture the security benefits of passkeys are pretty marginal. For example, I already use a long, unique password for each site via my password manager. If a site gets breached it will only affect that specific site, and even then only if they store passwords in plaintext. My passwords have enough entropy that even an MD5 hash is unlikely to be cracked in an offline attack. For me the biggest potential benefit of passkeys is better UX when signing in to websites.

by blfr 3y ago

NoZebra120vClip 3y ago

They will turn our security keys into junk: https://fy.blackhats.net.au/blog/2023-02-02-how-hype-will-turn-your-security-key-into-junk/ https://fy.blackhats.net.au/blog/2023-02-02-how-hype-will-tu...

snuxoll 3y ago
Personally I think the rk requirement is just fine, the long-tail goal of Passkeys is to simply credential management for users and the UX of key wrapping stands in opposition of that. Having a security key handle unlocking your platform authenticator/password manager seems to be the middle ground that's being driven towards, and as somebody with multiple YubiKey's I'm perfectly fine with it.
microtonal 3y ago
At the risk of setting up a straw man (but the sentiment of your comment seems negative), but should we slow down improved security for the for the whole population, so that a bunch of tech people who have hardware keys with a measly 20 or 32 slots can keep using them? Sure, authentication could also be done without resident keys, but resident keys simplify the authentication workflow a lot, since the relying party doesn't need some additional credentials to send the correct wrapped key. (Disclaimer: I have several Yubikeys.)
yencabulator 3y ago
Interestingly, this link says > [The definition "passkey is a resident key"] has become so invasive that even FIDO now use it as their definition. but the linked FAQ for "their definition" doesn't contain the word "resident" (anymore?).

toomuchtodo 3y ago

https://www.stavros.io/posts/clearing-up-some-passkeys-misconceptions/ https://www.stavros.io/posts/clearing-up-some-passkeys-misco... (courtesy of u/stavros)

evil-olive 3y ago

the FIDO Alliance has an FAQ [0] > What is a passkey? > Any passwordless FIDO credential is a passkey. I would recommend [1] as an excellent overview of the FIDO2 and WebAuthn standards that underlie passkeys. depending on how you use your Yubikeys, you may already be using these standards. if you already have a password manager you're happy with, the appeal of adopting passkeys is somewhat marginal. if you're using your Yubikeys for FIDO2-based MFA you're already getting the majority of the benefit. 0: https://fidoalliance.org/passkeys/#faq https://fidoalliance.org/passkeys/#faq 1: https://www.youtube.com/watch?v=DWrLBwi7ZBA https://www.youtube.com/watch?v=DWrLBwi7ZBA

Ajedi32 3y ago
> if you already have a password manager you're happy with, the appeal of adopting passkeys is somewhat marginal This is where I'm at personally right now; basically just waiting for my favorite password manager to add support for passkeys. After that the transition will be pretty seamless; I'll just start storing passkeys in my password manager instead of passwords wherever possible, and get a nice UX improvement as a result.
- snuxoll 3y ago
  There's a nice security improvement to passkeys, as well. No more passwords getting leaked from poorly-run websites, security breaches, etc. You can dump an entire user database and nobody is compromised outside of the obvious privacy implications.
  - Ajedi32 3y ago
    The biggest security benefit of passkeys is that they raise the floor of security posture for the least security conscious users. E.g. You can't use "bob1989!" as your password on every single site, write it on a post-it stuck to your monitor, and enter it into every phishing site that sends you an email claiming to be from "M1cro3oft Supp0rt". For users who already have a very good security posture the security benefits of passkeys are pretty marginal. For example, I already use a long, unique password for each site via my password manager. If a site gets breached it will only affect that specific site, and even then only if they store passwords in plaintext. My passwords have enough entropy that even an MD5 hash is unlikely to be cracked in an offline attack. For me the biggest potential benefit of passkeys is better UX when signing in to websites.