5 ms·

I hope they get over that. It's a blob of data. It's no more special than a TOTP secret or a conventional password, and I am completely uninterested in pretendi

by jerf 3y ago

I hope they get over that. It's a blob of data. It's no more special than a TOTP secret or a conventional password, and I am completely uninterested in pretending otherwise because of a slick marketing campaign. It's a "thing I know" whether anybody likes it or not and you can't turn it into a "thing I have" just because you won't let me export it from this particular software. (Proof that it is a "thing I know": It fits into Bitwarden, which is a "thing I know" storage mechanism. Anything that can be stored by BitWarden is a thing-I-know.) As long as it's a thing I know you might as well give me the benefits of being a thing I know, since I'm paying the costs of it anyhow. I back up at the Vaultwarden backend store level anyhow. Probably shouldn't give me that sort of advantage over the commercial option.

SheinhardtWigCo 3y ago
It is special - it should be a reference to an asymmetric key stored in hardware. But it's not clear whether they are actually doing this.
- SV_BubbleTime 3y ago
  If it is just a pointer a hardware, even more reason to let you export it.
  - m-p-3 3y ago
    The idea is that the key never, EVER leave the hardware or password manager. What you do is have multiple Passkeys on separate devices per account. Kind of like how you should generate SSH private keys on the local machine and never leave this particular system, and you then add their public keys to the server you will connect to. You can them revoke access to each machine independently.
- ryan29 3y ago
  Some snippets from the FAQ [1]. > The public key is stored on the website and the private key is stored on your device or in your passkey provider, e.g. your Bitwarden Vault. > Passkeys are often able to sync across your devices, however not all platforms support this yet. So it sounds like it's not stored in hardware. It'll be interesting to see how it works if solutions that use a TPM or similar start to emerge. I have nearly 1000 passwords and many of them are shared with colleagues, parents, siblings, etc.. I can't even imagine a way you could make that work if the private key is owned by a TPM (aka a hardware bound key) and needs to be enrolled somehow prior to becoming usable. What happens if I have 500 passkeys backed by keys in a TPM and I get a new computer? 1. https://bitwarden.com/resources/passkeys-faq/ https://bitwarden.com/resources/passkeys-faq/
  - tw04 3y ago
    > What happens if I have 500 passkeys backed by keys in a TPM and I get a new computer? In theory the same thing that happens today with a yubikey - you have multiple devices with valid keys.
- Groxx 3y ago
  A big part of passkeys is that they are (often) not in hardware, so they can be synced.
Racing0461 3y ago
Agreed. unless its stored in a tpm module or on an actual piece of hardware like a yubikey, no amount of software (especially a browser plugin written in javascript let alone low level drivers for an OS) can turn a "thing i know" into a "thing i have".
noman-land 3y ago
I see this common refrain from people. How is writing something down so that you don't have to remember it a "thing you know"? You literally don't know it. A "thing you know" never leaves your brain, otherwise it becomes a "thing you have".
- jerf 3y ago
  It comes from the fact there are three fundamental ways to authenticate: a thing you know, a thing you have, a thing you are. You may not "know" a passkey or a TOTP token, but you are using computers in their most fundamental role as bicycles for the mind to "know" them for you. This means they still fit into "thing you know". Clearly a TOTP token is not a thing you are. Less clearly, it is not a thing you have. Passkeys and TOTP tokens "want" to be a thing you have, but in the end they aren't. My little proof in my parent post may be small, but I'm quite serious... if you can store it in a password manager, that is proof that it is a thing you know, not a thing you have. It turns out making a "thing you have" be a true thing you have is very difficult. It may even be impossible, in some sense. Everything that is a "thing you have" seems to be a thing you know masquerading as a thing you have through some security-through-obscurity. Between that and the fact that "thing you are" has incredibly poor, if not outright dangerous characteristics if you try to scale it up, I'm actually not on board with the "passwords suck because things-you-know suck and we must replace them immediately!" I think they whole argument stinks of a classic engineering mistake of considering only the pros of one option and only the cons of another. I think when you take a holistic view, "thing you know" is the only practical, scalable option of the three basic options. If passkeys make it easier, fine, I'm up for some improvement, but I'm not on board the "passkeys must be a thing you have" and I fully intend to use them as things I know as much as I can and have no intention of letting anyone make my passkeys into objects.
  - unethical_ban 3y ago
    Yep. Thing you have is a passkey that can't be copied at all, like a yuibikey, some physical manifestation that can't be easily cloned. Arguably TOTP is "have" due to being linked to a phone when doing push to a single device.
jopsen 3y ago
From: https://bitwarden.com/help/storing-passkeys/ https://bitwarden.com/help/storing-passkeys/ > Saving and using passkeys are a feature of the Bitwarden browser extension. Other Bitwarden clients can be used to view the saved passkey. So sadly, like TOTP I can't trust bitwarden to only keep my keys in an HSM on the server. I really wish exporting would be impossible. Today, I need to add my primary and backup passkey devices whenever I signup for a service. If keys were only stored on the server, then I could use it as a level of indirection.

by jerf 3y ago

SheinhardtWigCo 3y ago

It is special - it should be a reference to an asymmetric key stored in hardware. But it's not clear whether they are actually doing this.

SV_BubbleTime 3y ago
If it is just a pointer a hardware, even more reason to let you export it.
- m-p-3 3y ago
  The idea is that the key never, EVER leave the hardware or password manager. What you do is have multiple Passkeys on separate devices per account. Kind of like how you should generate SSH private keys on the local machine and never leave this particular system, and you then add their public keys to the server you will connect to. You can them revoke access to each machine independently.
ryan29 3y ago
Some snippets from the FAQ [1]. > The public key is stored on the website and the private key is stored on your device or in your passkey provider, e.g. your Bitwarden Vault. > Passkeys are often able to sync across your devices, however not all platforms support this yet. So it sounds like it's not stored in hardware. It'll be interesting to see how it works if solutions that use a TPM or similar start to emerge. I have nearly 1000 passwords and many of them are shared with colleagues, parents, siblings, etc.. I can't even imagine a way you could make that work if the private key is owned by a TPM (aka a hardware bound key) and needs to be enrolled somehow prior to becoming usable. What happens if I have 500 passkeys backed by keys in a TPM and I get a new computer? 1. https://bitwarden.com/resources/passkeys-faq/ https://bitwarden.com/resources/passkeys-faq/
- tw04 3y ago
  > What happens if I have 500 passkeys backed by keys in a TPM and I get a new computer? In theory the same thing that happens today with a yubikey - you have multiple devices with valid keys.
Groxx 3y ago
A big part of passkeys is that they are (often) not in hardware, so they can be synced.

Racing0461 3y ago

Agreed. unless its stored in a tpm module or on an actual piece of hardware like a yubikey, no amount of software (especially a browser plugin written in javascript let alone low level drivers for an OS) can turn a "thing i know" into a "thing i have".

noman-land 3y ago

I see this common refrain from people. How is writing something down so that you don't have to remember it a "thing you know"? You literally don't know it. A "thing you know" never leaves your brain, otherwise it becomes a "thing you have".

jerf 3y ago
It comes from the fact there are three fundamental ways to authenticate: a thing you know, a thing you have, a thing you are. You may not "know" a passkey or a TOTP token, but you are using computers in their most fundamental role as bicycles for the mind to "know" them for you. This means they still fit into "thing you know". Clearly a TOTP token is not a thing you are. Less clearly, it is not a thing you have. Passkeys and TOTP tokens "want" to be a thing you have, but in the end they aren't. My little proof in my parent post may be small, but I'm quite serious... if you can store it in a password manager, that is proof that it is a thing you know, not a thing you have. It turns out making a "thing you have" be a true thing you have is very difficult. It may even be impossible, in some sense. Everything that is a "thing you have" seems to be a thing you know masquerading as a thing you have through some security-through-obscurity. Between that and the fact that "thing you are" has incredibly poor, if not outright dangerous characteristics if you try to scale it up, I'm actually not on board with the "passwords suck because things-you-know suck and we must replace them immediately!" I think they whole argument stinks of a classic engineering mistake of considering only the pros of one option and only the cons of another. I think when you take a holistic view, "thing you know" is the only practical, scalable option of the three basic options. If passkeys make it easier, fine, I'm up for some improvement, but I'm not on board the "passkeys must be a thing you have" and I fully intend to use them as things I know as much as I can and have no intention of letting anyone make my passkeys into objects.
- unethical_ban 3y ago
  Yep. Thing you have is a passkey that can't be copied at all, like a yuibikey, some physical manifestation that can't be easily cloned. Arguably TOTP is "have" due to being linked to a phone when doing push to a single device.

jopsen 3y ago

From: https://bitwarden.com/help/storing-passkeys/ https://bitwarden.com/help/storing-passkeys/ > Saving and using passkeys are a feature of the Bitwarden browser extension. Other Bitwarden clients can be used to view the saved passkey. So sadly, like TOTP I can't trust bitwarden to only keep my keys in an HSM on the server. I really wish exporting would be impossible. Today, I need to add my primary and backup passkey devices whenever I signup for a service. If keys were only stored on the server, then I could use it as a level of indirection.