9 ms·

As others have pointed out, cryptographic authentication is very hard to bootstrap if you simply loose your device. Just last month my missus cracked the glass

As others have pointed out, cryptographic authentication is very hard to bootstrap if you simply loose your device. Just last month my missus cracked the glass of her iPhone. Apple repaired it under AppleCare, which is great… except… that they didn’t tell her that the “glass repair” entails them replacing the guts of the phone and wiping it in the process. Apple iPhone backups don’t contain cryptographic secrets like eSIMs! She got stuck in a loop where she couldn’t activate her eSIM because that needed her email, but her email needed MS Authenticator, which she couldn’t activate without an SMS. She had to drive to the Telco with a pile of photo ID to reissue her eSIM. Her bank account got locked in the process despite the password being correct because of some sort of phone hardware lock. This took days to fix and multiple in-person visits to various organisations. If this had happened while overseas on holiday, she would have been screwed. Times have changed. Your entire digital identity is now a smart card in your phones That Smart Card is either a SIM card or an onboard TPM chip, but in any event if you lose it, you may as well be dead as far as anyone else is concerned. Passkeys make this much worse. At least if you still have a physical SIM you can transfer it from any phone to any other phone. Passkeys are not cross-vendor transferable! Run away screaming. Don’t believe the hype. Wait until the vendors get their act together and come up with a solution for transfer and recovery.

hbt 3y ago
what you are describing is why I use a virtual phone for all services. you can do it on your own with twilio, then create a phone number and have a program forward you stuff to your real phone. the twilio phone is hard to lose as it has an api and you can toss it when you want to start over. except now, you need an entire phone virtualized as your proxy instead of just a twilio phone number. they keep raising the barrier
- jesseendahl 3y ago
  This provides significantly weaker account security than using a passkey. 2FA codes delivered over SMS can be phished.
  - MrDrMcCoy 3y ago
    Tell that to my bank :(
brundolf 3y ago
Honestly, if they'd just give me the option to write it down (or take a picture or whatever) and manually restore it by typing it in if I need to, that would just about solve the issue
- metafunctor 3y ago
  The point is that the private key resides on a tamperproof piece of hardware. Malware, viruses, or shoulder surfers cannot copy the key. The solution is to set up multiple pieces of secure hardware, not writing down the keys to the castle on a piece of paper.
  - kahnclusions 3y ago
    Great so now people need to be rich enough to own multiple phones? Really. The solution can’t be “buy multiple devices” when the average person can barely afford to maintain one working device.
    - Dlanv 3y ago
      Your computer can also be a passkey. I currently use both my laptop and my computer as a passkey, and a USB drive. So I have 3 backups to my Google account. It is true that you do need to be rich enough to own a phone and ~100 USD of something else (laptop or USB), which does put redundancy out of the reach of a large portion of the world. But then they can just use regular 2fa at the expense of not being phishing-proof.
      - tmpX7dMeXU 3y ago
        You have to be within several layers of bubbles to not see how small a percent of the general population are going to even understand any of this BS. Things being this complicated makes them a non-starter. A nerd vanity project. And this isn’t a knock on the “intelligence” of the general population. They quite rightfully won’t want to spend their limited time on God’s earth learning about all this.
      - 3y ago
redrblackr 3y ago
EDIT: I assumed passkeys refer exclusively to hardware passkeys, mb. My answer below means separate HARDWARE "security keys", not ones tied to a smartphone, Google or Microsoft account... The problem here is that you are assuming one passkey. Just like you don't get just one key for your door its risky to get only one passkey, if you are planning to use it exclusively. Passkeys are like normal keys but for your digital life. They have many benefits over normal keys like being impossible to copy/pick while still being easy to replace (as long as you have one that works) and if used properly (with a short pin-code) someone who finds or steal your key cant log in to your virtual doors anyway. They compare even better to passwords. Just get one for your keychain and one to put at your stationary computer at home. The only thing to remember is to add both to your account(s), which still is faster than fiddling with your password manager and/or second factors. Passkeys are really amazing, the only thing(s) remaining is to stop confusing people with terminology, explain that you should have a pair and for services to start properly using the keys as a combined first+second factor with a pin (which you can have safely the same on all your passkeys, in contrast to passwords). What do you mean not cross-vendor transferable? You can use any brand key that properly implements the protocol (fido2/webaunth), and replace them with any brand key. If you mean copy them, well yea that's kinda the point.. There are plenty of ways for recovery on reasonable services, sometimes they ask to set up way to many (and with multiple passkeys, recovery is only relevant if you loose ALL of your keys). Just want to point out that if your missus had a pair of passkeys there would not have been any issue!
deleted 3y ago
[deleted]
jjav 3y ago
> Run away screaming. Don’t believe the hype. Wait until the vendors get their act together and come up with a solution for transfer and recovery. Very much this. Having authentication tied to hardware you don't control is a near-certain denial of service in the future. People love to hate on passwords but the reality is that for many circumstances (threat models) they are the best compromise. You can make them more than strong enough (take 32+ bytes out of /dev/random and encode however you like, nobody will ever brute force that in this universe) and various passwords managers solve the problem of re-use (never reuse a password). And it comes with the benefit that you control how it is stored and can apply as much redundancy as you want to feel comfortable.
- EGreg 3y ago
  Just like the rest of it, they’re going to try to lock down the open web, general-purpose computing, etc. They are going to be the gatekeepers if you and the web services let them. Oh yeah — also they’ll run all the web, email and other services anyway. Trap you in their metaverse and AI most likely, since that’s where your coworkers and friends will be you’ll have to be there too. Resist by opting out :)
  - paiute 3y ago
    I think it’s time for a government solution, but nowadays it’d be done to be benefit big tech and the surveillance state.
    - EGreg 3y ago
      How about an open source one? https://intercoin.org/overview.pdf https://intercoin.org/overview.pdf
      - trinsic2 3y ago
        Riiight. Another cryptocurrency solution. crypto falls into the same category of untrustworthiness as the rest of these so called solutions. The only difference is the that crypto has a more murky past.
cpuguy83 3y ago
This is just bad and uninformed advice. Adding a passkey to an account is like adding a yubikey to an account (experience wise). You can (typically) add multiple keys to your account. It's also not all or nothing. You can (in every service I've setup) still have a password and an even a TOTP.
- ungamedplayer 3y ago
  Can, if the auth provider allows it. In my limited experience of 4 accounts with passkey, only one does.. kinda. The multiple passkey option kicks out my other session when i use the other passkey.
- qudat 3y ago
  There is no way adding multiple keys to your account is more work than a password manager. Just use a password manager and retain full control over your secrets.
  - davkan 3y ago
    Yeah I don’t really see the upside of these over just sticking with bitwarden.
skybrian 3y ago
Your wife's experience sounds very bad and the risk of getting locked out of your various accounts is serious. That doesn't mean giving up on having good security, though. Passkeys don't work like eSims and other users' situations might not be the same. Their failure modes will be different. They might have more than one device (like a phone and a tablet), or they might not use MS Authenticator for their email, or they might have set up different recovery methods? We need more backups and user education, which ideally would include rehearsing account recovery before it's actually necessary.
deleted 3y ago
[deleted]
hedora 3y ago
To save people from reading the article before running away screaming: > But while they’re a big step forward, we know that new technologies take time to catch on — so passwords may be around for a little while. That's why people will still be given the option to use a password to sign in and may opt-out of passkeys by turning off “Skip password when possible.” So, soon passwords will be added to “Killed by Google,” along with my account. (I keep zero devices logged in.) It’s well past time to migrate off my few remaining use cases. I wonder if my employer will be able to reset my corporate account passkeys when the inevitable happens.
RockRobotRock 3y ago
As an aside, I bought a hardware TOTP token that I could have access to if i got locked out Bitwarden/Authy: https://www.amazon.com/gp/product/B07RQPJNZH https://www.amazon.com/gp/product/B07RQPJNZH It would be awesome to have an "emergency" server where I could type in the URL, decrypt it with my passphrase and OTP, and get access to everything I need temporarily so I can re-bootstrap all my stuff. Of course, this doesn't solve the problem of SMS 2fa being used for everything, but it's a good first step. I am in favor of crossplatform solutions like YubiKey. Apple and Google passkeys are lame.
samcat116 3y ago
An eSIM isn't a cryptographic secret you need to backup its provisioned by your carrier.
- jiggawatts 3y ago
  It is quite literally a virtual Smart Card stored in a TPM chip. It has a private key in a hardware device, making it a cryptographic secret.
two_handfuls 3y ago
My understanding is that Passkeys are transferrable, unlike earlier efforts. See for example this iOS help page: https://support.apple.com/guide/iphone/passkeys-passwords-devices-iph82d6721b2/ios https://support.apple.com/guide/iphone/passkeys-passwords-de... Unless you store the passkey in a hardware Fido key like a Yubikey. Then the way to transfer it is to physically carry the key and plug it to another device.
- d-z-m 3y ago
  OP specifically mentions "cross-vendor" transferable. Which, to my understanding, is currently true.
  - two_handfuls 3y ago
    You can set up a Yubikey on a mac and use it on a Windows machine. It’s cross-vendor transferrable.
    - d-z-m 3y ago
      In this case, we're using the term "cross-vendor transferable" to mean that the key material can be exported out of one vendor and imported into another. So if you could export the passkey from Windows Hello and import it into your iCloud Keychain, that would be cross-vendor transferable. Or if you could export the Resident Key out of your Yubikey and import it into Google Password Manager, that would be cross-vendor transferable.
      - two_handfuls 3y ago
        The horror scenario of the parent post was completely avoidable with “not cross-vendor transferrable” keys as I describe. This “cross-vendor” property is nice but it’s not required to defend against being locked out of one’s stuff.
Brajeshwar 3y ago
Ok. Now, I need to re-read and I’m tad worried. I moved quite a bit of logins to Passkey and I chose to stay with the Apple ecosystem as my Passkey Lord/God. So far, it has worked and I have moved between devices (desktops, mobile, and the in-betweener). Assuming I’m going to stay for quite a while with the Apple Ecosystem, am I doing it wrong by making my Passkeys pass through my Apple ID? For instance, I change my eSim or number or replace phone, won't accept next time I login and then verify from the laptop, desktop, iPad, watch, or, heck, the Apple Polishing Cloth? (Assuming the cloth will become a smart cloth eventually).
jrockway 3y ago
As with everything, you probably want a backup. Get more than one passkey. I pretty much use 3; Yubikey in my workstation, portable Yubikey, phone. All 3 of those can bootstrap Google, which I use for email, and Apple, which I use for my phone. Then, everything else is in 1password, which are available through those mediums. Worst case, I am pretty sure in the most dire of dire emergencies, I can get my email back no matter what. Verify ID with my DNS provider, switch MX records, back in business. Even then, it's not necessarily essential to daily life. (A colossal inconvenient to lose access? For sure. Death sentence? Probably not.) All my SMS and Signal contacts are elsewhere. I can spend money out of my bank account by writing a check. I can get into work stuff by showing up in person at an office. I do think that passkeys are probably too complicated for the ordinary user of computers; unfortunately that "we'll just email you a link every single time you want to sign in" seems like the most user-friendly passwordless authentication. I also don't feel great about my habit of putting passkeys in 1password, because I know I'm locked in forever. But, I like the service, and when I want to switch, welp, at least there's a list of accounts I have to remake. My biggest fear is something like forgetting my phone's passcode. One time I woke up, got distracted at just the wrong moment, and could not for the life of me remember my 6 digit passcode. (I also use the same code to unlock my workstation.) I had to distract myself and then use muscle memory to remember it. It was really crazy, truly one of those "did I just have a stroke" moments. I have that saved in 1password now, so if I have one unlocked device, I can refresh my memory. This happened a while ago and I don't think I have dementia. Just a weird quirk. (Meanwhile, I can perfectly remember every 1-year-max-lifetime password I've ever had at any job. A lot of that good does when you can't remember a 6 digit number!)
bhawks 3y ago
The solution to your problem is simply more passkeys. I am not being sarcastic - which ever service your authenticating to make sure you have passkeys from at least 2 different devices so you do not lock yourself out. If you don't fit into this multi device assumption, passkeys are not going to work well for you. There will not be a standard for transfer / recovery.
- raxxorraxor 3y ago
  That is completely unrealistic to me. The normal users will not register different devices and will simply be locked out when the device fails or is lost. And the question they will ask is about the need to have two passwords.
- MrDrMcCoy 3y ago
  Not just multiple devices, but multiple locations. A fire, flood, car accident, or theft can result in the total loss of multiple devices unless one is sufficiently far away and also secure. Then there's keeping that remote device up to date. This is beyond the patience, finance, and understanding of virtually everyone.
negative_zero 3y ago
Completely agree. Currently I can perform a full bootstrap using information stored in my brain (with my partner's brain as backup). Any new "solution to passwords" that doesn't allow that means an instant NO from me. I don't care how much more theoretically secure it is.
- raxxorraxor 3y ago
  It isn't more secure if you use a secure password with the standard way of auth today. Especially not theoretically what relates to cryptography. Some common attack vectors like phishing would be more secure since you more or less automatically generate different credentials for different services, just as you get different access tokens from your oauth service. Token theft is an issue too, but only ever partially compromises you for a limited time.
  - mwwaters 3y ago
    Having different passwords doesn't prevent phishing where you think you're logging into the service being phished. The hacker would also create a new TOTP on that service once they get in to that service.
solatic 3y ago
Passkeys follow the 3-2-1 backup rule, just like any other digital data. The main difference being that you don't need to backup the passkey itself, just have multiple passkeys. Have 3 passkeys 2 of them on-person at any time (e.g. one on your phone TPM, one on a Yubikey) 1 of them off-site (e.g. keep a backup Yubikey at home in a fireproof safe, or use a 1Password passkey, depending on your threat model) Whenever you sign up for a new vendor/service, register all three passkeys with your account.
- radlad 3y ago
  ... or just store a password in your password manager. I thought passkeys were supposed to be convenient to use.
- stouset 3y ago
  I do follow this. Unfortunately, it leaves out one glaring flaw: you can’t register a Passkey you don’t physically have. I use four: an Apple Passkey, a YubiKey I keep on me, a YubiKey at home, and a YubiKey in the bank. When I sign up for a service, I need to register all four of them. Not only is this generally a bit of a pain in the ass, but it also means I have to remember to go fetch the one in the bank vault periodically and update the credentials. If I could save a stub locally that would let me register with a key not in my physical presence, that would go a long way to making this more usable. Even better would be the ability to register a bundle of them all in one go without having to do it four separate times. As it stands right now, it’s hard to recommend to users who don’t understand or care enough to take all of these steps. Which to be clear is entirely reasonable on their part. It’s an unacceptable amount of work and mental accounting for it to be something the average person can do without high risk of losing their entire digital identity.
  - solatic 3y ago
    > I have to remember to go fetch the one in the bank vault periodically I feel you, but I don't think Average Joe's threat model requires keeping a Yubikey in a safe deposit box (this is besides the issue that safe deposit boxes are less safe than you think: https://www.nytimes.com/2019/07/19/business/safe-deposit-box-theft.html https://www.nytimes.com/2019/07/19/business/safe-deposit-box... ). A cloud-based passkey (like 1Password) is fine as the off-site backup key for most people.
sandeep_random 3y ago
Passkeys are one of the non-phishable means for authentication. If something is easy to recover for user then its same for a malicious actor. Some platform based passkeys (apple, google) are actually sync-able across the devices. The whole Passkeys concept is under debate and discussion for what it means for different types of WebAuthn authenticators when it comes to the ability to sync the credentials. Alternatively one can use security keys which they can keep with themselves and could protect themselves by enrolling one additional security key for recovery purposes that they can keep away. Regardless the whole idea is to have more than one MFA factors enrolled so that one is not get locked out. Ease of using WebAuthn/ Passkeys overweighs typing in password, SMS, TOTP codes and has big savings for big players to avoid phishing attacks. It might not be suitable for every use case but worth using for some.
lynx23 3y ago
Not being able to regain access in exceptional cases is one of the big reasons why I am very weary about being forced to activate 2FA and other auth. It is so nice in theory... But the reality is that many users only use their phone to do almost everything digital in their life. My gf works for an assitive technology reseller. Since 2FA has been forced down the throats of unsuspecting users, she had to support several of their customers in regaining access to their Apple ID, noticing a few glitches in the supposed apple support path while at it. Phone hardware changes every few years. email addresses can change. And phone numbers can change. Combine all of them, and 2FA is suddenly no longer such a good idea... For reasonably sized companies, 2FA might be a good solution, because in case of you loosing access in some way, there is likely a support path that gets you back on track in reasonable amount of time, given that IRL auth is relatively simple. But for services where you are just a number, like every big provider, I believe a reasonably strong "master" password is still comforting to have.
v7p1Qbt1im 3y ago
> Passkeys are not cross-vendor transferable! They are when using a third party password manager like 1password or dashlane. At least in they are device agnostic. Haven‘t yet tried to export a passkey to another manager.
iampivot 3y ago
Pretty sure apple makes you sign a paper saying that you agree to the device being wiped.
Moldoteck 3y ago
That's the reason i have 2 devices with my accounts and auth app. One is for daily use and another one is a backup phone in case something happens to the first one
NikkiA 3y ago
TBH I don't trust google on security one bit after one of my namesakes attached her phone to my google account a few months ago without any warning or prompting by google to me.
SergeAx 3y ago
This is why I do my own secrets backup: VeraCrypt volume syncing between several devices and cloud storages.
deleted 3y ago
[deleted]
ktosobcy 3y ago
For that reason I don't want passkey. Password and regular 2fa/totp are fine... when setting 2fa I put it on my phone and my computer and another password vault on rpi... granted, everything still in same location but still somewhat better. I'm not really sold on esim neither - regular sims let you pop and swap them easily... why complicate it?
- jesseendahl 3y ago
  >Password and regular 2fa/totp are fine This might feel true, but it's factually not true. Both passwords and TOTP can be phished. In addition, passwords can be weak, reused, and password hashes can (and are frequently) stolen and cracked in server breaches. Passkeys are guaranteed to be strong, unique (can't be reused), strongly phishing-resistant, and there's nothing worth stealing from servers (just public keys). Passwords and TOTP are not fine, they're both fundamentally broken when you look at them in the context of the modern internet attack landscape.
  - dvngnt_ 3y ago
    pros and cons to each approach
    - jesseendahl 3y ago
      What are the pros to using phishable passwords and 2FA?
      - dvngnt_ 3y ago
        easier to use and harder to be locked out. years ago i was robbed in dc of my phone at night on the way to a concert. i use google voice and was able to login at cvs to contact a friend to meet me there. in 2023 i would have been locked out by not having a 2fa or phone
  - ktosobcy 3y ago
    If someone is ignorant and (Re)uses weak password then it's own fault. Yes, phishing can happen but it's more convoluted (and again - lack of attention). Being conscious about it brings the benefit of not relying on single point of failure...
qingcharles 3y ago
Add to that many web sites now make it a point of pride that they employ no humans in support and will not do anything to help you get back into your account if you are locked out (Google, Meta etc).
- KennyBlanken 3y ago
  They employ humans in support - behind firewalls like follower counts. If Neil deGrasse Tyson gets locked out of his Instagram, you can be damn well sure someone answers his support request. If you or I, in two to four digit follower counts, have an issue? We can get fucked. Damn near most companies do this with the social media PR teams, too. Any tags/mentions, messages, etc are filtered through software that decides how much cloud you have and thus how worthy of attention you are. Delta loses your guitar and you've got 100 followers? Nobody in the social media team is likely to even see it. Someone with 5000 followers, and a post about it gets a couple hundred likes/retweets? American is going to fall over themselves to make it right. That's the great lie about social media - that you can use it to draw attention to a problem you're having. Unless you've cultivated a large enough following, you'll be completely ignored.
- bshacklett 3y ago
  That’s a great reason not to use those services.
metafunctor 3y ago
Why do you believe that introducing support for passkeys inherently makes the situation worse? If you don't trust them, you're not forced to use them; traditional methods still exist. In any case, you should have multiple methods. It could be passkeys on multiple devices. It could be TOTP, plus recovery codes in a safe. Passkeys are just one more method. For the longest time, the gold standard for authenticating people has been tamperproof hardware with keys that cannot be copied. Except iPhones actually have credible biometrics on top of that. Much better than Yubikeys, for example. Of course you always need to have at least one backup device or other method in case your primary device is lost. Now that this is finally making it's way to the “normal people”, it's suddenly a “run away screaming” scenario? Come on.
- pseudalopex 3y ago
  > If you don't trust them, you're not forced to use them; traditional methods still exist. I predict this will not be true always.
  - noahtallen 3y ago
    Yes, the security industry is probably going to shift massively to Passkeys over the next few years. Phishing is a massive issue for enterprise security, and Passkeys basically completely fix it. IMO, this also means the problems with Passkeys will get fixed pretty quickly. And given I can already store my Passkey in 1Password and then use it on every device I currently use (including Firefox on mac/windows and iOS Safari), it's honestly not a huge problem. I think passwords are a much bigger problem for people. Simple/re-used passwords are still incredibly common-place, and too many people don't realize how big of a problem that is. Once you incorporate a password manager so that you don't need to remember passwords... Passkeys via a password manager should be even easier to use, given you don't have to rely on browser extensions auto-detecting input fields.
    - tharkun__ 3y ago
      How do you secure 1Password? With a passkey? See the loop? Or a password? Wait, didn't we want to get rid of passwords? How is that any better? The kinds of people with reused passwords all over the place won't use 1Password. And if you do use 1password to actually generate strong passwords you don't need passkeys and it works on all kinds of services without those having to support passkeys.
Shank 3y ago
> Run away screaming. Don’t believe the hype. Wait until the vendors get their act together and come up with a solution for transfer and recovery. I believe all of the issues you've described, but you can usually add multiple passkeys to each service. There is nothing stopping you from adding your iPhone and a cheap android phone and having redundancy, or using 1Password and storing your passkey in there. iPhone backups do store backups of the media stored in iCloud Keychain, if you have another apple device or if you have the recovery key, you can get back in. You just need the device passcode or recovery key and you can re-bootstrap everything. eSIMs are unique because they're carrier things and those things have and always will be a pain and tied to stores and phone calls.
- selcuka 3y ago
  There are workarounds, but that doesn't mean that passkeys is a half-baked technology. The real, simple solution would be a way to write down the passkey, similar to an SSH private key.
  - metafunctor 3y ago
    A main idea of passkeys is that the private keys are bound to hardware and cannot be copied. Using the private key is subject to biometric authentication. This eliminates a whole category of issues where the private key could get stolen. So no, writing down the SSH private key is not the solution. The solution is to trust multiple private keys, each stored within tamperproof hardware. This is also why, as a service provider, I'd like to see some device attestation. I want to know that the keys being used here are not written on a fucking piece of paper.
    - hypothesis 3y ago
      > This is also why, as a service provider, I'd like to see some device attestation. I want to know that the keys being used here are not written on a fucking piece of paper. This is precisely why user should run away. Service provider is moving liability to end user and washing their hand away, while user gets screwed if anything happens during vacation.
briffle 3y ago
that is why its important for 3rd party tools like bitwarden and 1password to support passkeys..

hbt 3y ago

what you are describing is why I use a virtual phone for all services. you can do it on your own with twilio, then create a phone number and have a program forward you stuff to your real phone. the twilio phone is hard to lose as it has an api and you can toss it when you want to start over. except now, you need an entire phone virtualized as your proxy instead of just a twilio phone number. they keep raising the barrier

jesseendahl 3y ago
This provides significantly weaker account security than using a passkey. 2FA codes delivered over SMS can be phished.
- MrDrMcCoy 3y ago
  Tell that to my bank :(

brundolf 3y ago

Honestly, if they'd just give me the option to write it down (or take a picture or whatever) and manually restore it by typing it in if I need to, that would just about solve the issue

metafunctor 3y ago
The point is that the private key resides on a tamperproof piece of hardware. Malware, viruses, or shoulder surfers cannot copy the key. The solution is to set up multiple pieces of secure hardware, not writing down the keys to the castle on a piece of paper.
- kahnclusions 3y ago
  Great so now people need to be rich enough to own multiple phones? Really. The solution can’t be “buy multiple devices” when the average person can barely afford to maintain one working device.
  - Dlanv 3y ago
    Your computer can also be a passkey. I currently use both my laptop and my computer as a passkey, and a USB drive. So I have 3 backups to my Google account. It is true that you do need to be rich enough to own a phone and ~100 USD of something else (laptop or USB), which does put redundancy out of the reach of a large portion of the world. But then they can just use regular 2fa at the expense of not being phishing-proof.
    - tmpX7dMeXU 3y ago
      You have to be within several layers of bubbles to not see how small a percent of the general population are going to even understand any of this BS. Things being this complicated makes them a non-starter. A nerd vanity project. And this isn’t a knock on the “intelligence” of the general population. They quite rightfully won’t want to spend their limited time on God’s earth learning about all this.
    - 3y ago

redrblackr 3y ago

EDIT: I assumed passkeys refer exclusively to hardware passkeys, mb. My answer below means separate HARDWARE "security keys", not ones tied to a smartphone, Google or Microsoft account... The problem here is that you are assuming one passkey. Just like you don't get just one key for your door its risky to get only one passkey, if you are planning to use it exclusively. Passkeys are like normal keys but for your digital life. They have many benefits over normal keys like being impossible to copy/pick while still being easy to replace (as long as you have one that works) and if used properly (with a short pin-code) someone who finds or steal your key cant log in to your virtual doors anyway. They compare even better to passwords. Just get one for your keychain and one to put at your stationary computer at home. The only thing to remember is to add both to your account(s), which still is faster than fiddling with your password manager and/or second factors. Passkeys are really amazing, the only thing(s) remaining is to stop confusing people with terminology, explain that you should have a pair and for services to start properly using the keys as a combined first+second factor with a pin (which you can have safely the same on all your passkeys, in contrast to passwords). What do you mean not cross-vendor transferable? You can use any brand key that properly implements the protocol (fido2/webaunth), and replace them with any brand key. If you mean copy them, well yea that's kinda the point.. There are plenty of ways for recovery on reasonable services, sometimes they ask to set up way to many (and with multiple passkeys, recovery is only relevant if you loose ALL of your keys). Just want to point out that if your missus had a pair of passkeys there would not have been any issue!

deleted 3y ago

[deleted]

jjav 3y ago

> Run away screaming. Don’t believe the hype. Wait until the vendors get their act together and come up with a solution for transfer and recovery. Very much this. Having authentication tied to hardware you don't control is a near-certain denial of service in the future. People love to hate on passwords but the reality is that for many circumstances (threat models) they are the best compromise. You can make them more than strong enough (take 32+ bytes out of /dev/random and encode however you like, nobody will ever brute force that in this universe) and various passwords managers solve the problem of re-use (never reuse a password). And it comes with the benefit that you control how it is stored and can apply as much redundancy as you want to feel comfortable.

EGreg 3y ago
Just like the rest of it, they’re going to try to lock down the open web, general-purpose computing, etc. They are going to be the gatekeepers if you and the web services let them. Oh yeah — also they’ll run all the web, email and other services anyway. Trap you in their metaverse and AI most likely, since that’s where your coworkers and friends will be you’ll have to be there too. Resist by opting out :)
- paiute 3y ago
  I think it’s time for a government solution, but nowadays it’d be done to be benefit big tech and the surveillance state.
  - EGreg 3y ago
    How about an open source one? https://intercoin.org/overview.pdf https://intercoin.org/overview.pdf
    - trinsic2 3y ago
      Riiight. Another cryptocurrency solution. crypto falls into the same category of untrustworthiness as the rest of these so called solutions. The only difference is the that crypto has a more murky past.

cpuguy83 3y ago

This is just bad and uninformed advice. Adding a passkey to an account is like adding a yubikey to an account (experience wise). You can (typically) add multiple keys to your account. It's also not all or nothing. You can (in every service I've setup) still have a password and an even a TOTP.

ungamedplayer 3y ago
Can, if the auth provider allows it. In my limited experience of 4 accounts with passkey, only one does.. kinda. The multiple passkey option kicks out my other session when i use the other passkey.
qudat 3y ago
There is no way adding multiple keys to your account is more work than a password manager. Just use a password manager and retain full control over your secrets.
- davkan 3y ago
  Yeah I don’t really see the upside of these over just sticking with bitwarden.

skybrian 3y ago

Your wife's experience sounds very bad and the risk of getting locked out of your various accounts is serious. That doesn't mean giving up on having good security, though. Passkeys don't work like eSims and other users' situations might not be the same. Their failure modes will be different. They might have more than one device (like a phone and a tablet), or they might not use MS Authenticator for their email, or they might have set up different recovery methods? We need more backups and user education, which ideally would include rehearsing account recovery before it's actually necessary.

deleted 3y ago

[deleted]

hedora 3y ago

To save people from reading the article before running away screaming: > But while they’re a big step forward, we know that new technologies take time to catch on — so passwords may be around for a little while. That's why people will still be given the option to use a password to sign in and may opt-out of passkeys by turning off “Skip password when possible.” So, soon passwords will be added to “Killed by Google,” along with my account. (I keep zero devices logged in.) It’s well past time to migrate off my few remaining use cases. I wonder if my employer will be able to reset my corporate account passkeys when the inevitable happens.

RockRobotRock 3y ago

As an aside, I bought a hardware TOTP token that I could have access to if i got locked out Bitwarden/Authy: https://www.amazon.com/gp/product/B07RQPJNZH https://www.amazon.com/gp/product/B07RQPJNZH It would be awesome to have an "emergency" server where I could type in the URL, decrypt it with my passphrase and OTP, and get access to everything I need temporarily so I can re-bootstrap all my stuff. Of course, this doesn't solve the problem of SMS 2fa being used for everything, but it's a good first step. I am in favor of crossplatform solutions like YubiKey. Apple and Google passkeys are lame.

samcat116 3y ago

An eSIM isn't a cryptographic secret you need to backup its provisioned by your carrier.

jiggawatts 3y ago
It is quite literally a virtual Smart Card stored in a TPM chip. It has a private key in a hardware device, making it a cryptographic secret.

two_handfuls 3y ago

My understanding is that Passkeys are transferrable, unlike earlier efforts. See for example this iOS help page: https://support.apple.com/guide/iphone/passkeys-passwords-devices-iph82d6721b2/ios https://support.apple.com/guide/iphone/passkeys-passwords-de... Unless you store the passkey in a hardware Fido key like a Yubikey. Then the way to transfer it is to physically carry the key and plug it to another device.

d-z-m 3y ago
OP specifically mentions "cross-vendor" transferable. Which, to my understanding, is currently true.
- two_handfuls 3y ago
  You can set up a Yubikey on a mac and use it on a Windows machine. It’s cross-vendor transferrable.
  - d-z-m 3y ago
    In this case, we're using the term "cross-vendor transferable" to mean that the key material can be exported out of one vendor and imported into another. So if you could export the passkey from Windows Hello and import it into your iCloud Keychain, that would be cross-vendor transferable. Or if you could export the Resident Key out of your Yubikey and import it into Google Password Manager, that would be cross-vendor transferable.
    - two_handfuls 3y ago
      The horror scenario of the parent post was completely avoidable with “not cross-vendor transferrable” keys as I describe. This “cross-vendor” property is nice but it’s not required to defend against being locked out of one’s stuff.

Brajeshwar 3y ago

Ok. Now, I need to re-read and I’m tad worried. I moved quite a bit of logins to Passkey and I chose to stay with the Apple ecosystem as my Passkey Lord/God. So far, it has worked and I have moved between devices (desktops, mobile, and the in-betweener). Assuming I’m going to stay for quite a while with the Apple Ecosystem, am I doing it wrong by making my Passkeys pass through my Apple ID? For instance, I change my eSim or number or replace phone, won't accept next time I login and then verify from the laptop, desktop, iPad, watch, or, heck, the Apple Polishing Cloth? (Assuming the cloth will become a smart cloth eventually).

jrockway 3y ago

As with everything, you probably want a backup. Get more than one passkey. I pretty much use 3; Yubikey in my workstation, portable Yubikey, phone. All 3 of those can bootstrap Google, which I use for email, and Apple, which I use for my phone. Then, everything else is in 1password, which are available through those mediums. Worst case, I am pretty sure in the most dire of dire emergencies, I can get my email back no matter what. Verify ID with my DNS provider, switch MX records, back in business. Even then, it's not necessarily essential to daily life. (A colossal inconvenient to lose access? For sure. Death sentence? Probably not.) All my SMS and Signal contacts are elsewhere. I can spend money out of my bank account by writing a check. I can get into work stuff by showing up in person at an office. I do think that passkeys are probably too complicated for the ordinary user of computers; unfortunately that "we'll just email you a link every single time you want to sign in" seems like the most user-friendly passwordless authentication. I also don't feel great about my habit of putting passkeys in 1password, because I know I'm locked in forever. But, I like the service, and when I want to switch, welp, at least there's a list of accounts I have to remake. My biggest fear is something like forgetting my phone's passcode. One time I woke up, got distracted at just the wrong moment, and could not for the life of me remember my 6 digit passcode. (I also use the same code to unlock my workstation.) I had to distract myself and then use muscle memory to remember it. It was really crazy, truly one of those "did I just have a stroke" moments. I have that saved in 1password now, so if I have one unlocked device, I can refresh my memory. This happened a while ago and I don't think I have dementia. Just a weird quirk. (Meanwhile, I can perfectly remember every 1-year-max-lifetime password I've ever had at any job. A lot of that good does when you can't remember a 6 digit number!)

bhawks 3y ago

The solution to your problem is simply more passkeys. I am not being sarcastic - which ever service your authenticating to make sure you have passkeys from at least 2 different devices so you do not lock yourself out. If you don't fit into this multi device assumption, passkeys are not going to work well for you. There will not be a standard for transfer / recovery.

raxxorraxor 3y ago
That is completely unrealistic to me. The normal users will not register different devices and will simply be locked out when the device fails or is lost. And the question they will ask is about the need to have two passwords.
MrDrMcCoy 3y ago
Not just multiple devices, but multiple locations. A fire, flood, car accident, or theft can result in the total loss of multiple devices unless one is sufficiently far away and also secure. Then there's keeping that remote device up to date. This is beyond the patience, finance, and understanding of virtually everyone.

negative_zero 3y ago

Completely agree. Currently I can perform a full bootstrap using information stored in my brain (with my partner's brain as backup). Any new "solution to passwords" that doesn't allow that means an instant NO from me. I don't care how much more theoretically secure it is.

raxxorraxor 3y ago
It isn't more secure if you use a secure password with the standard way of auth today. Especially not theoretically what relates to cryptography. Some common attack vectors like phishing would be more secure since you more or less automatically generate different credentials for different services, just as you get different access tokens from your oauth service. Token theft is an issue too, but only ever partially compromises you for a limited time.
- mwwaters 3y ago
  Having different passwords doesn't prevent phishing where you think you're logging into the service being phished. The hacker would also create a new TOTP on that service once they get in to that service.

solatic 3y ago

Passkeys follow the 3-2-1 backup rule, just like any other digital data. The main difference being that you don't need to backup the passkey itself, just have multiple passkeys. Have 3 passkeys 2 of them on-person at any time (e.g. one on your phone TPM, one on a Yubikey) 1 of them off-site (e.g. keep a backup Yubikey at home in a fireproof safe, or use a 1Password passkey, depending on your threat model) Whenever you sign up for a new vendor/service, register all three passkeys with your account.

radlad 3y ago
... or just store a password in your password manager. I thought passkeys were supposed to be convenient to use.
stouset 3y ago
I do follow this. Unfortunately, it leaves out one glaring flaw: you can’t register a Passkey you don’t physically have. I use four: an Apple Passkey, a YubiKey I keep on me, a YubiKey at home, and a YubiKey in the bank. When I sign up for a service, I need to register all four of them. Not only is this generally a bit of a pain in the ass, but it also means I have to remember to go fetch the one in the bank vault periodically and update the credentials. If I could save a stub locally that would let me register with a key not in my physical presence, that would go a long way to making this more usable. Even better would be the ability to register a bundle of them all in one go without having to do it four separate times. As it stands right now, it’s hard to recommend to users who don’t understand or care enough to take all of these steps. Which to be clear is entirely reasonable on their part. It’s an unacceptable amount of work and mental accounting for it to be something the average person can do without high risk of losing their entire digital identity.
- solatic 3y ago
  > I have to remember to go fetch the one in the bank vault periodically I feel you, but I don't think Average Joe's threat model requires keeping a Yubikey in a safe deposit box (this is besides the issue that safe deposit boxes are less safe than you think: https://www.nytimes.com/2019/07/19/business/safe-deposit-box-theft.html https://www.nytimes.com/2019/07/19/business/safe-deposit-box... ). A cloud-based passkey (like 1Password) is fine as the off-site backup key for most people.

sandeep_random 3y ago

Passkeys are one of the non-phishable means for authentication. If something is easy to recover for user then its same for a malicious actor. Some platform based passkeys (apple, google) are actually sync-able across the devices. The whole Passkeys concept is under debate and discussion for what it means for different types of WebAuthn authenticators when it comes to the ability to sync the credentials. Alternatively one can use security keys which they can keep with themselves and could protect themselves by enrolling one additional security key for recovery purposes that they can keep away. Regardless the whole idea is to have more than one MFA factors enrolled so that one is not get locked out. Ease of using WebAuthn/ Passkeys overweighs typing in password, SMS, TOTP codes and has big savings for big players to avoid phishing attacks. It might not be suitable for every use case but worth using for some.

lynx23 3y ago

Not being able to regain access in exceptional cases is one of the big reasons why I am very weary about being forced to activate 2FA and other auth. It is so nice in theory... But the reality is that many users only use their phone to do almost everything digital in their life. My gf works for an assitive technology reseller. Since 2FA has been forced down the throats of unsuspecting users, she had to support several of their customers in regaining access to their Apple ID, noticing a few glitches in the supposed apple support path while at it. Phone hardware changes every few years. email addresses can change. And phone numbers can change. Combine all of them, and 2FA is suddenly no longer such a good idea... For reasonably sized companies, 2FA might be a good solution, because in case of you loosing access in some way, there is likely a support path that gets you back on track in reasonable amount of time, given that IRL auth is relatively simple. But for services where you are just a number, like every big provider, I believe a reasonably strong "master" password is still comforting to have.

v7p1Qbt1im 3y ago

> Passkeys are not cross-vendor transferable! They are when using a third party password manager like 1password or dashlane. At least in they are device agnostic. Haven‘t yet tried to export a passkey to another manager.

iampivot 3y ago

Pretty sure apple makes you sign a paper saying that you agree to the device being wiped.

Moldoteck 3y ago

That's the reason i have 2 devices with my accounts and auth app. One is for daily use and another one is a backup phone in case something happens to the first one

NikkiA 3y ago

TBH I don't trust google on security one bit after one of my namesakes attached her phone to my google account a few months ago without any warning or prompting by google to me.

SergeAx 3y ago

This is why I do my own secrets backup: VeraCrypt volume syncing between several devices and cloud storages.

deleted 3y ago

[deleted]

ktosobcy 3y ago

For that reason I don't want passkey. Password and regular 2fa/totp are fine... when setting 2fa I put it on my phone and my computer and another password vault on rpi... granted, everything still in same location but still somewhat better. I'm not really sold on esim neither - regular sims let you pop and swap them easily... why complicate it?

jesseendahl 3y ago
>Password and regular 2fa/totp are fine This might feel true, but it's factually not true. Both passwords and TOTP can be phished. In addition, passwords can be weak, reused, and password hashes can (and are frequently) stolen and cracked in server breaches. Passkeys are guaranteed to be strong, unique (can't be reused), strongly phishing-resistant, and there's nothing worth stealing from servers (just public keys). Passwords and TOTP are not fine, they're both fundamentally broken when you look at them in the context of the modern internet attack landscape.
- dvngnt_ 3y ago
  pros and cons to each approach
  - jesseendahl 3y ago
    What are the pros to using phishable passwords and 2FA?
    - dvngnt_ 3y ago
      easier to use and harder to be locked out. years ago i was robbed in dc of my phone at night on the way to a concert. i use google voice and was able to login at cvs to contact a friend to meet me there. in 2023 i would have been locked out by not having a 2fa or phone
- ktosobcy 3y ago
  If someone is ignorant and (Re)uses weak password then it's own fault. Yes, phishing can happen but it's more convoluted (and again - lack of attention). Being conscious about it brings the benefit of not relying on single point of failure...

qingcharles 3y ago

Add to that many web sites now make it a point of pride that they employ no humans in support and will not do anything to help you get back into your account if you are locked out (Google, Meta etc).

KennyBlanken 3y ago
They employ humans in support - behind firewalls like follower counts. If Neil deGrasse Tyson gets locked out of his Instagram, you can be damn well sure someone answers his support request. If you or I, in two to four digit follower counts, have an issue? We can get fucked. Damn near most companies do this with the social media PR teams, too. Any tags/mentions, messages, etc are filtered through software that decides how much cloud you have and thus how worthy of attention you are. Delta loses your guitar and you've got 100 followers? Nobody in the social media team is likely to even see it. Someone with 5000 followers, and a post about it gets a couple hundred likes/retweets? American is going to fall over themselves to make it right. That's the great lie about social media - that you can use it to draw attention to a problem you're having. Unless you've cultivated a large enough following, you'll be completely ignored.
bshacklett 3y ago
That’s a great reason not to use those services.

metafunctor 3y ago

Why do you believe that introducing support for passkeys inherently makes the situation worse? If you don't trust them, you're not forced to use them; traditional methods still exist. In any case, you should have multiple methods. It could be passkeys on multiple devices. It could be TOTP, plus recovery codes in a safe. Passkeys are just one more method. For the longest time, the gold standard for authenticating people has been tamperproof hardware with keys that cannot be copied. Except iPhones actually have credible biometrics on top of that. Much better than Yubikeys, for example. Of course you always need to have at least one backup device or other method in case your primary device is lost. Now that this is finally making it's way to the “normal people”, it's suddenly a “run away screaming” scenario? Come on.

pseudalopex 3y ago
> If you don't trust them, you're not forced to use them; traditional methods still exist. I predict this will not be true always.
- noahtallen 3y ago
  Yes, the security industry is probably going to shift massively to Passkeys over the next few years. Phishing is a massive issue for enterprise security, and Passkeys basically completely fix it. IMO, this also means the problems with Passkeys will get fixed pretty quickly. And given I can already store my Passkey in 1Password and then use it on every device I currently use (including Firefox on mac/windows and iOS Safari), it's honestly not a huge problem. I think passwords are a much bigger problem for people. Simple/re-used passwords are still incredibly common-place, and too many people don't realize how big of a problem that is. Once you incorporate a password manager so that you don't need to remember passwords... Passkeys via a password manager should be even easier to use, given you don't have to rely on browser extensions auto-detecting input fields.
  - tharkun__ 3y ago
    How do you secure 1Password? With a passkey? See the loop? Or a password? Wait, didn't we want to get rid of passwords? How is that any better? The kinds of people with reused passwords all over the place won't use 1Password. And if you do use 1password to actually generate strong passwords you don't need passkeys and it works on all kinds of services without those having to support passkeys.

Shank 3y ago

> Run away screaming. Don’t believe the hype. Wait until the vendors get their act together and come up with a solution for transfer and recovery. I believe all of the issues you've described, but you can usually add multiple passkeys to each service. There is nothing stopping you from adding your iPhone and a cheap android phone and having redundancy, or using 1Password and storing your passkey in there. iPhone backups do store backups of the media stored in iCloud Keychain, if you have another apple device or if you have the recovery key, you can get back in. You just need the device passcode or recovery key and you can re-bootstrap everything. eSIMs are unique because they're carrier things and those things have and always will be a pain and tied to stores and phone calls.

selcuka 3y ago
There are workarounds, but that doesn't mean that passkeys is a half-baked technology. The real, simple solution would be a way to write down the passkey, similar to an SSH private key.
- metafunctor 3y ago
  A main idea of passkeys is that the private keys are bound to hardware and cannot be copied. Using the private key is subject to biometric authentication. This eliminates a whole category of issues where the private key could get stolen. So no, writing down the SSH private key is not the solution. The solution is to trust multiple private keys, each stored within tamperproof hardware. This is also why, as a service provider, I'd like to see some device attestation. I want to know that the keys being used here are not written on a fucking piece of paper.
  - hypothesis 3y ago
    > This is also why, as a service provider, I'd like to see some device attestation. I want to know that the keys being used here are not written on a fucking piece of paper. This is precisely why user should run away. Service provider is moving liability to end user and washing their hand away, while user gets screwed if anything happens during vacation.

briffle 3y ago

that is why its important for 3rd party tools like bitwarden and 1password to support passkeys..