12 ms·

> made even worse by it being treated as equivalent to password+2FA. passkeys are significantly more secure than the most widely-used/most popular forms of 2FA

> made even worse by it being treated as equivalent to password+2FA. passkeys are significantly more secure than the most widely-used/most popular forms of 2FA, because the most popular forms of 2FA are TOTP and SMS, and both are subject to phishing attacks. A passkey alone is much more secure than the vast majority of password + 2FA combinations. The only thing stronger than a passkey standing alone is a Security Key, but Security Keys come with a lot of usability downsides that can easily bite the average user, including: - inconvenience: you have to remember to carry it around with you everywhere (and not lose it!) - recoverability: you're completely screwed if you lose it and don't have extras that you already previously added to your accounts. (this also means that you need to buy at least two security keys to have a decent recovery story.) - rotation (have to log in to every single service, one by one, to re-add new key if you change keys) And if you really want the extra security that a Security Key provides, you can use a Security Key as a passkey.

jjav 3y ago
> passkeys are significantly more secure Blanket statements like this demonstrate a misunderstanding that "security" is just one thing in a single lineal scale. In reality you have to ask, secure against what? And to answer that meaningfully you need to a thorough threat model for the specific use case of person P and account A. The same person P will have a different threat model for every account they have. The D in STRIDE is for denial of service. Passkeys are much worse on this axis than any other solution. You need to evaluate for the specific combination (P,A) how much this matters vs. other criteria.
- joshuamorton 3y ago
  I don't think this is correct. It's more difficult to steal something from me than to, e.g. repeatedly force password reset emails. From a ux perspective, it may be easier to accidentally kneecap yourself with a passkey, but security wise, they're still probably better since it's harder for someone else to kneecap you.
- jesseendahl 3y ago
  I'm not sure why you didn't include the rest of the sentence, which made it clear that I was making a very specific comparison to password + phishable forms of 2FA. I was very clearly not making a blanket statement. Here's the full context again: passkeys are significantly more secure than the most widely-used/most popular forms of 2FA, because the most popular forms of 2FA are TOTP and SMS, and both are subject to phishing attacks. >The D in STRIDE is for denial of service. Passkeys are much worse on this axis than any other solution. You need to evaluate for the specific combination (P,A) how much this matters vs. other criteria. How are passkeys (really, WebAuthn credentials in general) any worse in terms of denial-of-service attacks than passwords? I think you're trying to make a point about specific passkey/password managers, rather than the actual credentials themselves. Is that accurate?

jjav 3y ago

> passkeys are significantly more secure Blanket statements like this demonstrate a misunderstanding that "security" is just one thing in a single lineal scale. In reality you have to ask, secure against what? And to answer that meaningfully you need to a thorough threat model for the specific use case of person P and account A. The same person P will have a different threat model for every account they have. The D in STRIDE is for denial of service. Passkeys are much worse on this axis than any other solution. You need to evaluate for the specific combination (P,A) how much this matters vs. other criteria.

joshuamorton 3y ago
I don't think this is correct. It's more difficult to steal something from me than to, e.g. repeatedly force password reset emails. From a ux perspective, it may be easier to accidentally kneecap yourself with a passkey, but security wise, they're still probably better since it's harder for someone else to kneecap you.
jesseendahl 3y ago
I'm not sure why you didn't include the rest of the sentence, which made it clear that I was making a very specific comparison to password + phishable forms of 2FA. I was very clearly not making a blanket statement. Here's the full context again: passkeys are significantly more secure than the most widely-used/most popular forms of 2FA, because the most popular forms of 2FA are TOTP and SMS, and both are subject to phishing attacks. >The D in STRIDE is for denial of service. Passkeys are much worse on this axis than any other solution. You need to evaluate for the specific combination (P,A) how much this matters vs. other criteria. How are passkeys (really, WebAuthn credentials in general) any worse in terms of denial-of-service attacks than passwords? I think you're trying to make a point about specific passkey/password managers, rather than the actual credentials themselves. Is that accurate?