3 ms·

it's better than a password because good passwords pretty much require to be generated by password managers in this day and age. Which means you can't actually

it's better than a password because good passwords pretty much require to be generated by password managers in this day and age. Which means you can't actually remember them anyway, yet a password is still hackable or guessable Theoretically of course but not really, I've had some fairly long passwords of mine hacked somehow. I assume because a service stored them in plaintext and then got hacked. Make it 40 or 50 characters long, it doesn't matter: It's still just text and it can be stolen from you by remote, digital thievery somehow. The promise of passkeys is that this cannot happen anymore, they'd have to steal your physical device AND your way of unlocking that device. Sure you still need a master password to unlock your password manager but like I mentioned above: You now need this any way because you need a password manager no matter what.

tharkun__ 3y ago
From the Last Pass blog about a recent incident: Cloud-based backup storage – contained configuration data, API secrets, third-party integration secrets, customer metadata, and backups of all customer vault data. All sensitive customer vault data, other than URLs, file paths to installed LastPass Windows or macOS software, and certain use cases involving email addresses, were encrypted using our Zero knowledge model and can only be decrypted with a unique encryption key derived from each user’s master password. As a reminder, end user master passwords are never known to LastPass and are not stored or maintained by LastPass – therefore, they were not included in the exfiltrated data. https://blog.lastpass.com/2023/03/security-incident-update-recommended-actions/ https://blog.lastpass.com/2023/03/security-incident-update-r... In other words, the thieves went to the bank vault a d stole your safety deposit box but can't access it because they need your key, which only you posses. If I can store my passkeys in 1password (or lastpass etc) then nobody needs access to my physical phone. They just need access to my password manager's password. I agree that for many many people password managers are way better than alternatives. But they don't magically make everything safe. It's like MFA. "it is all safe now because we will send you a code via SMS" and the people fall for social engineering attacks that make them disclose the code the attacker just had the bank send to them. I doubt such people will be a le to safely use a password manager or passkey for that matter. Passkey are just new enough that we have not had widespread news about how crooks were able to find the weak link(s). Probably on the human side again like in many cases.
- Nathanba 3y ago
  well I really thought that the whole point of passkeys was that they are tied to the device. Syncing a passkey should have only meant that you have a backup, not that you can actually log in from a totally different device with that other device's passkey...
  - tharkun__ 3y ago
    What is the point of a backup if I can't restore the backup to any place my choosing? The point is that if my device get lost, stolen, dies or is damaged irreparably I can always just use another device, restore my backup and done. So even if there is some sort of hardware tie in that only ever works with real hardware an attacker just needs hardware. Or virtual hardware I guess ;) Totally out of context parallel: Pokémon Go. A game that gets you out into the world to find and capture Pokémons and talk to other people. Or spoof your GPS coordinates with a simple SDR setup. No anti-cheating software on the phone will ever know.

tharkun__ 3y ago

From the Last Pass blog about a recent incident: Cloud-based backup storage – contained configuration data, API secrets, third-party integration secrets, customer metadata, and backups of all customer vault data. All sensitive customer vault data, other than URLs, file paths to installed LastPass Windows or macOS software, and certain use cases involving email addresses, were encrypted using our Zero knowledge model and can only be decrypted with a unique encryption key derived from each user’s master password. As a reminder, end user master passwords are never known to LastPass and are not stored or maintained by LastPass – therefore, they were not included in the exfiltrated data. https://blog.lastpass.com/2023/03/security-incident-update-recommended-actions/ https://blog.lastpass.com/2023/03/security-incident-update-r... In other words, the thieves went to the bank vault a d stole your safety deposit box but can't access it because they need your key, which only you posses. If I can store my passkeys in 1password (or lastpass etc) then nobody needs access to my physical phone. They just need access to my password manager's password. I agree that for many many people password managers are way better than alternatives. But they don't magically make everything safe. It's like MFA. "it is all safe now because we will send you a code via SMS" and the people fall for social engineering attacks that make them disclose the code the attacker just had the bank send to them. I doubt such people will be a le to safely use a password manager or passkey for that matter. Passkey are just new enough that we have not had widespread news about how crooks were able to find the weak link(s). Probably on the human side again like in many cases.

Nathanba 3y ago
well I really thought that the whole point of passkeys was that they are tied to the device. Syncing a passkey should have only meant that you have a backup, not that you can actually log in from a totally different device with that other device's passkey...
- tharkun__ 3y ago
  What is the point of a backup if I can't restore the backup to any place my choosing? The point is that if my device get lost, stolen, dies or is damaged irreparably I can always just use another device, restore my backup and done. So even if there is some sort of hardware tie in that only ever works with real hardware an attacker just needs hardware. Or virtual hardware I guess ;) Totally out of context parallel: Pokémon Go. A game that gets you out into the world to find and capture Pokémons and talk to other people. Or spoof your GPS coordinates with a simple SDR setup. No anti-cheating software on the phone will ever know.