4 ms·

Lauren Weinstein is sounding the alarm on passkeys which is flawed and that it would make a huge headache for a lot of people especilly normal folks. https://ma

Lauren Weinstein is sounding the alarm on passkeys which is flawed and that it would make a huge headache for a lot of people especilly normal folks. https://mastodon.laurenweinstein.org/@lauren/111103819626952178 https://mastodon.laurenweinstein.org/@lauren/111103819626952... https://mastodon.laurenweinstein.org/@lauren/111211366080459949 https://mastodon.laurenweinstein.org/@lauren/111211366080459...

d-z-m 3y ago
To me, it's unclear what the headache is. If the argument is about the consequences of passkeys for most ordinary people, most people are signed into their google account on their mobile device. In that case, your account is compromised anyway if your device authentication is breached. For Google in particular, password/passkey isn't a binary choice(currently). You can fall back to the password sign-in flow if your device doesn't have a passkey.
two_handfuls 3y ago
“Weak device authentication”? I though all phones had fingerprint scanners or face scanning nowadays?
- deleted 3y ago
  [deleted]
zestyping 3y ago
This debate is frustrating because it lacks data — it's full of opinions about which risk is worse than which other. To compare the risks and benefits, we need to know how often people actually re-use passwords, use 2FA, rely solely on their phone screen lock for access to all their accounts, use biometrics, need account recovery, and so on. That data is the only way to settle the debate (and would allow each person can settle it for themselves, perhaps differently based on their circumstances). Google has most of this data. They should publish it to back up their claims.
- grotorea 3y ago
  https://www.youtube.com/watch?v=RFACQvL_8S4 https://www.youtube.com/watch?v=RFACQvL_8S4 has some statistics from Google, including a floor of 17% on password reuse.
crote 3y ago
Yup! I've had similar complaints for years now. Modulo the whole privacy/vendor lockin issue, passkeys are not a terrible alternative to people without 2FA reusing the same basic password on every single website. However, when you actually rely on it to secure things, it quickly becomes a massive nightmare - made even worse by it being treated as equivalent to password+2FA.
- jesseendahl 3y ago
  > made even worse by it being treated as equivalent to password+2FA. passkeys are significantly more secure than the most widely-used/most popular forms of 2FA, because the most popular forms of 2FA are TOTP and SMS, and both are subject to phishing attacks. A passkey alone is much more secure than the vast majority of password + 2FA combinations. The only thing stronger than a passkey standing alone is a Security Key, but Security Keys come with a lot of usability downsides that can easily bite the average user, including: - inconvenience: you have to remember to carry it around with you everywhere (and not lose it!) - recoverability: you're completely screwed if you lose it and don't have extras that you already previously added to your accounts. (this also means that you need to buy at least two security keys to have a decent recovery story.) - rotation (have to log in to every single service, one by one, to re-add new key if you change keys) And if you really want the extra security that a Security Key provides, you can use a Security Key as a passkey.
  - jjav 3y ago
    > passkeys are significantly more secure Blanket statements like this demonstrate a misunderstanding that "security" is just one thing in a single lineal scale. In reality you have to ask, secure against what? And to answer that meaningfully you need to a thorough threat model for the specific use case of person P and account A. The same person P will have a different threat model for every account they have. The D in STRIDE is for denial of service. Passkeys are much worse on this axis than any other solution. You need to evaluate for the specific combination (P,A) how much this matters vs. other criteria.
    - 3y ago
gowld 3y ago
Does he explain the flaw anywhere? He says it's "easy to find" but apaprently he can't find it. https://mastodon.laurenweinstein.org/@lauren/111211489395997661 https://mastodon.laurenweinstein.org/@lauren/111211489395997... Why is "weak device password" a reason to avoid passkeys, when those users presumably have weak service passwords as well?
- panarky 3y ago
  It seems like his argument is that putting access to valuable accounts on your phone is a bad practice, because if your phone is stolen at the club after the thief watched you enter your code, then the thief can get at your banking, brokerage, crypto, password manager, etc. But that argument doesn't address how passkeys somehow make that worse. Sure, if you don't want your valuable stuff stolen, don't put it on your phone. But that's a problem whether you use passkeys or passwords or passwordless links sent to your email or SMS.
  - pseudalopex 3y ago
    The argument for passkeys is they make it better. Not not worse.
  - passkeyspoor 3y ago
    The point is that the phone with a crappy 4 digit pin can be used to authenticate everything on every device the user owns that uses passkeys. It's a one stop shop of failure.
    - Dlanv 3y ago
      Phones are already that way. They have text messages and email which is enough to log into almost any service.
      - passkeyspoor 3y ago
        Yes, that's also bad. They're both bad. Passkeys are worse.
donmcronald 3y ago
It's not about security. It's about having a system for digital signatures that acts against the interests of the user.
- drdaeman 3y ago
  The fundamental idea of using asymmetric cryptography to authenticate is good. It is time-proven, and it works in the best interests of users, simultaneously providing improved security. SSH just works (and while it typically lacks fancy UIs for key management, it's irrelevant to the core idea). The passkeys design, though, has a number of obvious deficiencies and limitations. It is drastically better than ye olde <input type="password" /> but it's not a good standard. The other alternative is SRP, but no browser vendor had bothered to do anything about this, so it remains a curiosity implemented on a couple websites (with all JS crypto gotchas, so - no good).

d-z-m 3y ago

To me, it's unclear what the headache is. If the argument is about the consequences of passkeys for most ordinary people, most people are signed into their google account on their mobile device. In that case, your account is compromised anyway if your device authentication is breached. For Google in particular, password/passkey isn't a binary choice(currently). You can fall back to the password sign-in flow if your device doesn't have a passkey.

two_handfuls 3y ago

“Weak device authentication”? I though all phones had fingerprint scanners or face scanning nowadays?

deleted 3y ago
[deleted]

zestyping 3y ago

This debate is frustrating because it lacks data — it's full of opinions about which risk is worse than which other. To compare the risks and benefits, we need to know how often people actually re-use passwords, use 2FA, rely solely on their phone screen lock for access to all their accounts, use biometrics, need account recovery, and so on. That data is the only way to settle the debate (and would allow each person can settle it for themselves, perhaps differently based on their circumstances). Google has most of this data. They should publish it to back up their claims.

grotorea 3y ago
https://www.youtube.com/watch?v=RFACQvL_8S4 https://www.youtube.com/watch?v=RFACQvL_8S4 has some statistics from Google, including a floor of 17% on password reuse.

crote 3y ago

Yup! I've had similar complaints for years now. Modulo the whole privacy/vendor lockin issue, passkeys are not a terrible alternative to people without 2FA reusing the same basic password on every single website. However, when you actually rely on it to secure things, it quickly becomes a massive nightmare - made even worse by it being treated as equivalent to password+2FA.

jesseendahl 3y ago
> made even worse by it being treated as equivalent to password+2FA. passkeys are significantly more secure than the most widely-used/most popular forms of 2FA, because the most popular forms of 2FA are TOTP and SMS, and both are subject to phishing attacks. A passkey alone is much more secure than the vast majority of password + 2FA combinations. The only thing stronger than a passkey standing alone is a Security Key, but Security Keys come with a lot of usability downsides that can easily bite the average user, including: - inconvenience: you have to remember to carry it around with you everywhere (and not lose it!) - recoverability: you're completely screwed if you lose it and don't have extras that you already previously added to your accounts. (this also means that you need to buy at least two security keys to have a decent recovery story.) - rotation (have to log in to every single service, one by one, to re-add new key if you change keys) And if you really want the extra security that a Security Key provides, you can use a Security Key as a passkey.
- jjav 3y ago
  > passkeys are significantly more secure Blanket statements like this demonstrate a misunderstanding that "security" is just one thing in a single lineal scale. In reality you have to ask, secure against what? And to answer that meaningfully you need to a thorough threat model for the specific use case of person P and account A. The same person P will have a different threat model for every account they have. The D in STRIDE is for denial of service. Passkeys are much worse on this axis than any other solution. You need to evaluate for the specific combination (P,A) how much this matters vs. other criteria.
  - 3y ago

gowld 3y ago

Does he explain the flaw anywhere? He says it's "easy to find" but apaprently he can't find it. https://mastodon.laurenweinstein.org/@lauren/111211489395997661 https://mastodon.laurenweinstein.org/@lauren/111211489395997... Why is "weak device password" a reason to avoid passkeys, when those users presumably have weak service passwords as well?

panarky 3y ago
It seems like his argument is that putting access to valuable accounts on your phone is a bad practice, because if your phone is stolen at the club after the thief watched you enter your code, then the thief can get at your banking, brokerage, crypto, password manager, etc. But that argument doesn't address how passkeys somehow make that worse. Sure, if you don't want your valuable stuff stolen, don't put it on your phone. But that's a problem whether you use passkeys or passwords or passwordless links sent to your email or SMS.
- pseudalopex 3y ago
  The argument for passkeys is they make it better. Not not worse.
- passkeyspoor 3y ago
  The point is that the phone with a crappy 4 digit pin can be used to authenticate everything on every device the user owns that uses passkeys. It's a one stop shop of failure.
  - Dlanv 3y ago
    Phones are already that way. They have text messages and email which is enough to log into almost any service.
    - passkeyspoor 3y ago
      Yes, that's also bad. They're both bad. Passkeys are worse.

donmcronald 3y ago

It's not about security. It's about having a system for digital signatures that acts against the interests of the user.

drdaeman 3y ago
The fundamental idea of using asymmetric cryptography to authenticate is good. It is time-proven, and it works in the best interests of users, simultaneously providing improved security. SSH just works (and while it typically lacks fancy UIs for key management, it's irrelevant to the core idea). The passkeys design, though, has a number of obvious deficiencies and limitations. It is drastically better than ye olde <input type="password" /> but it's not a good standard. The other alternative is SRP, but no browser vendor had bothered to do anything about this, so it remains a curiosity implemented on a couple websites (with all JS crypto gotchas, so - no good).