5 ms·

How does this address OP's concern? If you have a single device (e.g. an iPhone) and you store all your passkeys on it, then losing it means you lost all passke

How does this address OP's concern? If you have a single device (e.g. an iPhone) and you store all your passkeys on it, then losing it means you lost all passkeys. Your post describes exactly that: - "I can’t recover the keys if I lose the hardware" - "That is a risk you’ll need to take if you’re using hardware authenticators" Fantasizing that with this proposed simplification of the authentication process people will introduce complexities such as a password manager or a backup hardware device is naive to say the least.

stavros 3y ago
I haven't heard anyone claim that passkeys are simpler than passwords, as that would be trivially false. The claim is that they're more secure while still remaining fairly usable. Passkeys are WebAuthn credentials that are synced between devices, so they aren't hardware keys, they're software keys.
- jjav 3y ago
  > more secure "more secure" is a completely meaningless statement, I wish this usage would die already (in general). You need to talk about security in the face of a very specific threat, then you can say solution A is better than solution B against threat T1, worse for T2 and about a wash for T3 and so on. Security is not a linear scale from 0-100 where you can say "more secure". There are many different criteria and any given solution will be better in some, worse in others. You must do a threat model for your specific use case to say if something is better or worse for those specific threats, and keep in mind other people will have very different threat models for the same solution.
  - keskival 3y ago
    The most problematic and the most probable security risk I have relating to logins is losing access. It for example took a week to restore access to my Apple account after I had forgotten to update my phone number there. Since this is the greatest security problem, I would hope all the vendors trying to improve security would focus on that.
    - jjav 3y ago
      > The most problematic and the most probable security risk I have relating to logins is losing access. Exactly. Unrecoverable secrets tied to closed hardware solve for the scenario where your most important criteria is that no attacker be able to ever access your account, even at the expense of yourself possibly losing access to it forever. Does this solve a problem anyone actually has for consumer accounts? No. That threat model makes sense for highly classified information where it is preferable to lose the information forever than have an attacker get it. Other than that, it's not a reasonable threat model to optimize for.
  - jesseendahl 3y ago
    Threat #1: Credential theft from server breaches Threat #2: User creates a weak credential Threat #3: User reuses a credential (uses same credential across multiple services) Threat #4: Phishing Attackers use huge password dumps compiled from multiple server breaches, and then try them against other services. Relying on a combination of the fruits of their labor from all four threats, attackers successfully compromise millions of accounts on the internet every year. If you want to see the data, check out the Verizon Data Breach Investigation Report that comes out every year.* These threats affect a majority of both consumers and enterprises. Passkeys address all four of these major real-world threats. Passwords address none of them. Threat #1 mitigation: with passkeys, only a public key is stored on the server. Attackers can steal all the public keys they want; it will not help them compromise any user's account. Threat #2 mitigation: passkeys (which are WebAuthn credentials) are guaranteed to be cryptographically strong. It is not possible for a user to generate an insecure passkey. This is because the browser the the Operating System APIs take care of generating the credential. Threat #3 mitigation: passkeys (which are WebAuthn credentials) are guaranteed to be unique. It is not possible for a user to reuse the same passkey across multiple apps/websites. This is because the browser the the Operating System APIs take care of ensuring that a new, unique credential (passkey) is generated for every new app/website the user sign's into. Threat #4 mitigation: passkeys (and all WebAuthn credentials) are bound to the server FQDN at the time they are created. The browser and Operating System APIs take care of ensuring the credential is only ever sent to the app/website server it was created for. Users cannot be tricked (via phishing) into using their passkey on a malicious app/website controlled by an attacker. * https://www.verizon.com/business/resources/T249/reports/2023-data-breach-investigations-report-dbir.pdf https://www.verizon.com/business/resources/T249/reports/2023...
    - sanitycheck 3y ago
      You are correct about all of that. But personally, as a technically able user, my risk of randomly losing access to my Google (or MS, Apple, Meta, etc) account is far greater than from all those threats combined. If we had a trustworthy and accountable authority operating this stuff then it would be great. But we don't, we have a bunch of companies who are neither of those things. It's like mandating that everyone must use self-driving cars that are on average safer than human motorists but occasionally randomly drive off a cliff.
- raxxorraxor 3y ago
  They are not more secure from a cryptographic standpoint. There are different attack vectors and for some passkeys are superior but in others they are certainly not. Additionally, part of the security concern is also accessibility by yourself. edit: Just tried the Google passkeys on one of my Android phones. It is a complete usability hell and it seems I cannot opt out again without logging in from my browser and deleting my "device". If there is another way to just do it from my device without an additional browser, please tell.
- 90-00-09 3y ago
  Here is Google discussing how passkeys are easier and simpler to use than passwords: https://security.googleblog.com/2023/05/making-authentication-faster-than-ever.html https://security.googleblog.com/2023/05/making-authenticatio... Here is 1Password discussing how passkeys are simpler to use than passwords: https://1password.com/product/passkeys https://1password.com/product/passkeys Here is Ars Technica declaring that passkeys are easier to use than passwords: https://arstechnica.com/information-technology/2023/05/passwordless-google-accounts-are-easier-and-more-secure-than-passwords-heres-why/ https://arstechnica.com/information-technology/2023/05/passw... Etc etc. If this is the first time you are seeing businesses and media refer to passkeys as being simpler to use than passwords you haven't been paying attention.
  - stavros 3y ago
    Oh huh, I stand corrected. I thought passwords were easy, but, thinking about it, I've had lots of trouble trying to figure out which password I've used for each site. I can definitely believe passkeys are easier, in light of that.
    - 90-00-09 3y ago
      Personally I think that’s the best selling point of passkeys. Most non-tech people don’t use password managers and have to memorize passwords, reset frequently passwords they can’t remember, etc. Security is way harder to sell than convenience. Saying that, I am struggling to understand what is the expectation for ordinary user behavior in terms of hardware-tied credentials. Eg so many people upgrade their iPhone every 1-2 years. If passkeys are not transferred to the new phone, what is the industry suggesting people do?
      - stavros 3y ago
        Passkeys are Google-synced WebAuthn keys, so there's no such thing as hardware-tied passkeys. If you want to use hardware WebAuthn keys, you should know what you're doing.
- JohnFen 3y ago
  > I haven't heard anyone claim that passkeys are simpler than passwords, as that would be trivially false. I have frequently heard and read claims that passkeys are easier to use than passwords. The claim always seemed incorrect to me for so many reasons. What passkeys do is make things more complicated, but move where the complication is.
jiggawatts 3y ago
“Hardware vendors helpfully suggest buying more hardware as a solution to a problem they introduced.”
bshacklett 3y ago
The _full_ quote says: “That is a risk you’ll need to take if you’re using hardware authenticators. The fact that the key isn’t copiable means you only have one of it, so you should probably be enrolling multiple hardware authenticators on each account, or just switching to a software authenticator if you don’t care about the decreased security.” Software authentication with backup and synchronization is how passkeys are being shown to end users on two of the biggest platforms. For Apple, this is iCloud. For Android, it’s Google Play services. Add to that the fact that 2FA tokens are very often tied to a particular phone, and there’s very little difference between a passkey and the current system of passwords + 2FA, except that passkeys are currently far more resistant to phishing. Certainly it’s far from perfect, but for the majority of every day users out there, this is a huge potential leap in preventing phishing attacks, which _are_ a real (and growing) threat. Rather than just throwing the technology out, perhaps we, as well informed people, should be looking for solutions to the problem of bootstrapping and recovery, rather than just throwing out the first technology that has a real chance at fixing this problem.

stavros 3y ago

I haven't heard anyone claim that passkeys are simpler than passwords, as that would be trivially false. The claim is that they're more secure while still remaining fairly usable. Passkeys are WebAuthn credentials that are synced between devices, so they aren't hardware keys, they're software keys.

jjav 3y ago
> more secure "more secure" is a completely meaningless statement, I wish this usage would die already (in general). You need to talk about security in the face of a very specific threat, then you can say solution A is better than solution B against threat T1, worse for T2 and about a wash for T3 and so on. Security is not a linear scale from 0-100 where you can say "more secure". There are many different criteria and any given solution will be better in some, worse in others. You must do a threat model for your specific use case to say if something is better or worse for those specific threats, and keep in mind other people will have very different threat models for the same solution.
- keskival 3y ago
  The most problematic and the most probable security risk I have relating to logins is losing access. It for example took a week to restore access to my Apple account after I had forgotten to update my phone number there. Since this is the greatest security problem, I would hope all the vendors trying to improve security would focus on that.
  - jjav 3y ago
    > The most problematic and the most probable security risk I have relating to logins is losing access. Exactly. Unrecoverable secrets tied to closed hardware solve for the scenario where your most important criteria is that no attacker be able to ever access your account, even at the expense of yourself possibly losing access to it forever. Does this solve a problem anyone actually has for consumer accounts? No. That threat model makes sense for highly classified information where it is preferable to lose the information forever than have an attacker get it. Other than that, it's not a reasonable threat model to optimize for.
- jesseendahl 3y ago
  Threat #1: Credential theft from server breaches Threat #2: User creates a weak credential Threat #3: User reuses a credential (uses same credential across multiple services) Threat #4: Phishing Attackers use huge password dumps compiled from multiple server breaches, and then try them against other services. Relying on a combination of the fruits of their labor from all four threats, attackers successfully compromise millions of accounts on the internet every year. If you want to see the data, check out the Verizon Data Breach Investigation Report that comes out every year.* These threats affect a majority of both consumers and enterprises. Passkeys address all four of these major real-world threats. Passwords address none of them. Threat #1 mitigation: with passkeys, only a public key is stored on the server. Attackers can steal all the public keys they want; it will not help them compromise any user's account. Threat #2 mitigation: passkeys (which are WebAuthn credentials) are guaranteed to be cryptographically strong. It is not possible for a user to generate an insecure passkey. This is because the browser the the Operating System APIs take care of generating the credential. Threat #3 mitigation: passkeys (which are WebAuthn credentials) are guaranteed to be unique. It is not possible for a user to reuse the same passkey across multiple apps/websites. This is because the browser the the Operating System APIs take care of ensuring that a new, unique credential (passkey) is generated for every new app/website the user sign's into. Threat #4 mitigation: passkeys (and all WebAuthn credentials) are bound to the server FQDN at the time they are created. The browser and Operating System APIs take care of ensuring the credential is only ever sent to the app/website server it was created for. Users cannot be tricked (via phishing) into using their passkey on a malicious app/website controlled by an attacker. * https://www.verizon.com/business/resources/T249/reports/2023-data-breach-investigations-report-dbir.pdf https://www.verizon.com/business/resources/T249/reports/2023...
  - sanitycheck 3y ago
    You are correct about all of that. But personally, as a technically able user, my risk of randomly losing access to my Google (or MS, Apple, Meta, etc) account is far greater than from all those threats combined. If we had a trustworthy and accountable authority operating this stuff then it would be great. But we don't, we have a bunch of companies who are neither of those things. It's like mandating that everyone must use self-driving cars that are on average safer than human motorists but occasionally randomly drive off a cliff.
raxxorraxor 3y ago
They are not more secure from a cryptographic standpoint. There are different attack vectors and for some passkeys are superior but in others they are certainly not. Additionally, part of the security concern is also accessibility by yourself. edit: Just tried the Google passkeys on one of my Android phones. It is a complete usability hell and it seems I cannot opt out again without logging in from my browser and deleting my "device". If there is another way to just do it from my device without an additional browser, please tell.
90-00-09 3y ago
Here is Google discussing how passkeys are easier and simpler to use than passwords: https://security.googleblog.com/2023/05/making-authentication-faster-than-ever.html https://security.googleblog.com/2023/05/making-authenticatio... Here is 1Password discussing how passkeys are simpler to use than passwords: https://1password.com/product/passkeys https://1password.com/product/passkeys Here is Ars Technica declaring that passkeys are easier to use than passwords: https://arstechnica.com/information-technology/2023/05/passwordless-google-accounts-are-easier-and-more-secure-than-passwords-heres-why/ https://arstechnica.com/information-technology/2023/05/passw... Etc etc. If this is the first time you are seeing businesses and media refer to passkeys as being simpler to use than passwords you haven't been paying attention.
- stavros 3y ago
  Oh huh, I stand corrected. I thought passwords were easy, but, thinking about it, I've had lots of trouble trying to figure out which password I've used for each site. I can definitely believe passkeys are easier, in light of that.
  - 90-00-09 3y ago
    Personally I think that’s the best selling point of passkeys. Most non-tech people don’t use password managers and have to memorize passwords, reset frequently passwords they can’t remember, etc. Security is way harder to sell than convenience. Saying that, I am struggling to understand what is the expectation for ordinary user behavior in terms of hardware-tied credentials. Eg so many people upgrade their iPhone every 1-2 years. If passkeys are not transferred to the new phone, what is the industry suggesting people do?
    - stavros 3y ago
      Passkeys are Google-synced WebAuthn keys, so there's no such thing as hardware-tied passkeys. If you want to use hardware WebAuthn keys, you should know what you're doing.
JohnFen 3y ago
> I haven't heard anyone claim that passkeys are simpler than passwords, as that would be trivially false. I have frequently heard and read claims that passkeys are easier to use than passwords. The claim always seemed incorrect to me for so many reasons. What passkeys do is make things more complicated, but move where the complication is.

jiggawatts 3y ago

“Hardware vendors helpfully suggest buying more hardware as a solution to a problem they introduced.”

bshacklett 3y ago

The _full_ quote says: “That is a risk you’ll need to take if you’re using hardware authenticators. The fact that the key isn’t copiable means you only have one of it, so you should probably be enrolling multiple hardware authenticators on each account, or just switching to a software authenticator if you don’t care about the decreased security.” Software authentication with backup and synchronization is how passkeys are being shown to end users on two of the biggest platforms. For Apple, this is iCloud. For Android, it’s Google Play services. Add to that the fact that 2FA tokens are very often tied to a particular phone, and there’s very little difference between a passkey and the current system of passwords + 2FA, except that passkeys are currently far more resistant to phishing. Certainly it’s far from perfect, but for the majority of every day users out there, this is a huge potential leap in preventing phishing attacks, which _are_ a real (and growing) threat. Rather than just throwing the technology out, perhaps we, as well informed people, should be looking for solutions to the problem of bootstrapping and recovery, rather than just throwing out the first technology that has a real chance at fixing this problem.