15 ms·

Are Passkeys the beginning of the end of passwords? I hope not

39 points by cratermoon 3y ago

bediger4000 3y ago
I'm in on anything that prevents the "best practice" of entering new passwords that have esoteric standards of "strength", twice, BLIND, on a crap cellphone "keyboard". The dots/stars for "password" type input fields might have prevented shoulder surfing in the days of wide-field-of-vision CRT monitors, and typing passwords twice on a real keyboard might have helped decrease people typing something they didn't mean, but it's all irrelevant in the age of narrow field LED cellphones held close to the face, using much smaller fonts.
- sonicanatidae 3y ago
  The dots are a legacy thing now. I agree 100%. Yes, they protect you from shoulder surfing, all twice in your life, where that may have been a factor. Otherwise, they are just an implement to the user, at this point.
- JohnFen 3y ago
  I agree entirely. Obscuring the text was largely pointless even before smart phones became common.
- hooverd 3y ago
  Decent websites will at least make it toggleable.
- Animats 3y ago
  The dot thing is actually a holdover from the days of printing terminals, where, if something wasn't done to hide them, passwords would be on paper in a trash can.
  - bediger4000 3y ago
    Them I'm glad Unix login programs just didn't print any password characters. But it shows how a best practice isn't appropriate for all circumstances, and that they outlive their usefulness.
- jclulow 3y ago
  If you're going to drop secret masking, it at least needs to be optionally still available. Modern cameras can capture quite a lot od what's on today's bright, high contrast, high resolution, wide viewing angle screens from surprisingly far away. Unless we're going to use a dark cloth on our phones as if they were an old view camera, I think secret masking still serves a purpose on phones.
nullindividual 3y ago
> The only reason why Big Tech have hyped up Passkeys this much I can't think of any other reason Big Tech (and small tech, and medium tech, government, and the list goes on) would want to eliminate passwords, an insecure concept, to replace them with a form of proof of ownership. > [not pasting full quote because ...] "And developers and users... ― Google" > No, they do not! - Author Certainly, many developers hate all of the reasons outlined by the quote from the ethereal identity known as the "Google". Many users hate them for the same reason, too, but for some reason the author doesn't believe that developers or users dislike the UX, security, or liability of passwords (the Author, here, is apparently speaking for upwards of 8 billion individuals -- as one of them, I can certainly make up my own mind, thanks). > Passkeys also makes you more vulnerable to seizures of electronics and keys. This is why it is important for devices, like the iPhone, have a quick way of putting themselves into a 'locked, require pin/pass' mode. Or just don't enable Face ID/similar biometrics for a 'master' password. > And when it happens to you, Google will let you know that they reserve the right to terminate your account for any reason or no reason at all. The ethereal Google can look at you funny and decide they will lock your account without any reason. I'm not sure what makes this situation any different. People commonly use their Chrome account, or Microsoft account, etc. in conjunction with the OS/browser's password manager. With passkeys, they're effectively in a _no worse_ state than they are today. If you want to argue about backups, these are likely the same individuals who wouldn't know why you'd need a backup to begin with. FWIW, I agree that there shouldn't be vendor lock-in with any form of identity, but there doesn't seem to be a challenger that is willing to bring something forward that eliminates both the security nightmares that are passwords as well as being highly portable with no vendor tie-in which finally, is easy to use. Big Tech found "secure" and "easy to use" which is what users are going to flock to.
- hooverd 3y ago
  I think Passkeys are a great idea utterly ruined by vendors licking their chops over locking users in and creeping remote attestation.
  - CharlesW 3y ago
    How am I “locked in” when I can use a different passkey manager whenever I want, just like I can use a different password manager whenever I want? How does a passkey differ from a password from an attestation POV?
sonicanatidae 3y ago
Costs. There are many reasons to secure logins with passkeys, but all of those reasons seem to be beaten by the costs of rolling it out. After all, breaches are someone else's problem. The company? They get a pittance fine, then carry on. The people responsible? they get bonuses.
JohnFen 3y ago
Passkeys do not fit my use cases very well and in some cases introduce an unacceptable amount of friction. I don't plan on using them for that reason.
snailmailman 3y ago
I’ve been using a password manager for all my passwords for years. Moving from “store a password” to “store a passkey” isn’t that big of a difference. The main thing for me seems to be that you can scan a qr code to authenticate another device, a workflow that I will probably end up using. It’s certainly easier and more secure than manually typing a 20+ character password into an untrusted device. Yeah im sure people will use googles passkey storage, or apples passkey storage, but that was already happening with passwords too. Passkeys isn’t going to change that. Third party password managers are already adding support for passkeys. And OS support for third party passkeys is already there on mobile. Personally I’m looking forward to passkeys. Just going to make my life a little bit easier. I’m going to continue using a self hosted vaultwarden instance. It already supports passkeys on desktop, and I’m eagerly awaiting mobile support for autofilling them. Hopefully that comes soon.
- timr 3y ago
  The big problem I have with passkeys is that, as currently implemented by ~everyone, they eliminate true second-factor authentication. I haven't seen an implementation yet that allows me to have something I know, and something I possess. That, to me, is less secure.
  - whatshisface 3y ago
    The ability to send SMSes or authenticate from your phone are both things you know.
    - tunesmith 3y ago
      No they aren't; not unless access to that phone (including accessing the 2FA functionality) is in turn protected by a passcode/passphrase that you "know".
      - whatshisface 3y ago
        Anyone with the right information can do either one. Including send SMSes: phone company customer support can let other people use your phone number.
perryizgr8 3y ago
The only reason pass keys are being pushed so heavily is because they are another step in the direction of the customer/user having absolutely zero control over the hardware they own, and the software they use. If you doubt this, ask yourself why there's no way to look at your passkey in android? I haven't checked ios but I'll be surprised if it let's you just look at your own passkey.
- WD40ForRust2 3y ago
  [dead]
- growse 3y ago
  I can't look at the secret material in my solo usb key either. That's a feature. Do I have "zero control" over it?
  - perryizgr8 3y ago
    Yes, pretty much. As the owner you should be able to look at the secret, copy it, publish it, whatever you want. At least with USB keys it is opt in. With passkey I'll be forced to give up my ownership because there are literally no viable options other than Google and Apple for smartphones.
    - growse 3y ago
      This has a very "technically correct" feel to it, which doesn't actually translate into anything useful in the real world. If you think the very existence of HSMs threatens the concept of "ownership over your hardware", then I guess that's a view. > With passkey I'll be forced to give up my ownership because there are literally no viable options other than Google and Apple for smartphones. Every existing webauthn token is a passkey.
      - perryizgr8 3y ago
        > Every existing webauthn token is a passkey. How to use my existing webauthn token in my iphone as a passkey?
gerwim 3y ago
What is this post ranting about? Pushing your keys to big tech? There is no difference if you use Chrome’s password manager for passwords or passkeys. You can save passkeys on your own network if you use Bitwarden or if you want, write your own solution. For 99% of the internet users, passkeys are much better than passwords.
- echohack5 3y ago
  Here's a workflow: 1. Normally I run everything on my own devices, use 1Password, 2FA, etc, but rarely I need to use a locked down device and manually and painstakingly enter 100+ character passwords and 2FA keys. Installing anything on the device is out of the question, but I need to use a web browser and auth using these credentials. Copy and paste and externally using any devices to connect with the system is prohibited. How does doing a FIDO2 dance work in this scenario?
  - konha 3y ago
    > Copy and paste and externally using any devices to connect with the system is prohibited. Like a keyboard? In which case: How do you enter your password? Is that a common scenario? Where you can use a (presumably) usb attached keyboard but you cannot insert your security key?
    - hedora 3y ago
      Air-gapping the machine running a web browser from the machine that stores your passwords seems completely reasonable to me. So does preventing people from plugging random USB devices into shared machines.
      - keep_reading 3y ago
        And yet all the non-technical folks you give this advice to will look at you like you have two heads. This is completely unreasonable unrealistic user-unfriendly advice
apitman 3y ago
I run a free, open source login provider[0] and have been keeping a close eye on passkeys. I think this article gets a bit too much into FUD territory. While big tech control over passkeys is certainly something that should be watched closely as we move forward, all signs currently are that the system will be relatively open to third party developers, including open source solutions. That said, I have other concerns, especially when it comes to decentralized and self-hosted apps. The main problem is that passkeys don't offer any sort of an identity handle to use for granting access to someone who doesn't already have a passkey registered with your system. For example, if I have a self-hosted photo server, and I want to give a friend access to an album, I can simply grant access to friend@example.com. As long as they can prove they own that email address they can access the album. I'm not aware of any way to do this with passkeys. But big tech won't be equally affected. Google photos for example ties your passkey to your gmail address, so their users still get the convenience of semi-global user search and the extra security of passkeys. IMO we need something more like Mozilla Persona that ties a global identifier such as an email address to a key pair. I'm curious if we could build a protocol around OpenPubkey[1] for this purpose. There may be a way to add this to passkeys but I suspect not given how tightly each passkey is tied to the domain it's created for. [0]: https://lastlogin.io/ https://lastlogin.io/ [1]: https://www.bastionzero.com/openpubkey https://www.bastionzero.com/openpubkey
- cratermoon 3y ago
  > the system will be relatively open to third party developers, including open source solutions. Yes, it will be. Right up until it isn't. See e.g. RedHat, HashiCorp Terraform
dmd 3y ago
Side comment: "The ASCII ribbon campaign was an Internet phenomenon started in 1998 advocating that email be sent only in plain text" When people say "plain text", they really mean "American English". When you rephrase it like that, it sounds a bit racist ... because it is.
- deleted 3y ago
  [deleted]
- hedora 3y ago
  Claiming the ASCII ribbon campaign was racist is neither technically correct nor practically correct. There weren't any machines that supported ASCII directly that late in the game. Instead, everything supported DOS code pages. Those are supersets of ASCII, and those supported localization. This was often called "ASCII", since that's pronounced with fewer syllables. On top of that, by 1998, mainstream systems were starting to support UTF-8, and, as a superset of ASCII, it was treated like "just another" plain-text format / extended ASCII code page by software user interfaces of the time. Practically speaking, the campaign was against sending HTML (or, god forbid, RTF) emails. That doesn't preclude localization at all.
- currymj 3y ago
  the "ASCII ribbon" referred to a ribbon drawn as ASCII art, not an insistence that people use exclusively ASCII characters. Unicode is still plain text and supports any language you can think of, and also most languages you can't think of.
- JohnFen 3y ago
  > When people say "plain text", they really mean "American English" No, when people say "plain text", they mean not HTML.
cchance 3y ago
I mean... bitwarden has passkey support already, so your not really beholden to google/microsoft etc for storing and generating keys as well so your not just stuck to using the MS Windows or Apple storage :S
- hedora 3y ago
  Bitwarden won't let you back up your passkeys though. That's a second, equally fundamental, problem with passkeys (and it is their entire reason for existing; the whole concept of passkeys is flawed). I wonder if the open source re-implementation of the vault protocol can export / import passkeys.
  - alyandon 3y ago
    You can self-host Bitwarden via an open source implementation of the backend API called Vaultwarden and backup the data as often as you like.
  - snailmailman 3y ago
    They don’t currently but they say the feature is coming. All the passkey features in Bitwarden are very much half-baked at the moment as it is brand new. On mobile you can’t even use the passkeys yet. They show up on mobile but no way to use them. I hope Bitwarden finishes the features soon.
  - growse 3y ago
    Genuinely curious: what's the use case that's solved by being able to back up a passkey? Why is it not solved by simply registering multiple passkeys for your account context? Is it just friction of having to set it up multiple times per account?
    - hedora 3y ago
      Part of the concern is the friction of setting up on the order 100 accounts on an order of a dozen different devices over the next few year (I hadn't thought of that until you mentioned it), but its mostly that I don't trust any of the authentication providers to not accidentally lock me out of my own account. Anyway, the immediate concrete use case for me is the same as being able to back up my password list: If I lose all my devices (or, more likely, some cloud provider does what Google Drive did last week), then I can restore from the backup. Also, I've already arranged to be able to backup my password list and to store the backup in an offline / secure way. I don't want to set up a second account recovery path just for passkeys. Finally, there's no data on any of my portable devices that I care about. I break a laptop or phone every N years, and I learned long ago to treat them as disposable. As currently implemented, passkeys break that invariant.
efitz 3y ago
I use a password manager that supports passkeys so overall I don’t care. However, I have two gripes with passkeys: (1) the workflow for getting a passkey is all over the place; I wish it was more uniform, and (2) diagnosability is crap. The QR-code-approve-on-your-phone workflow has never once worked for me (Brave on MacOS + iPhone)
tptacek 3y ago
This article states clearly the case for Passkeys: passwords are vulnerable to phishing attacks. Phishing attacks are effective, anti-phishing training doesn't work (even for technically savvy users), and hardware tokens are too cumbersome; meanwhile, people already have a capable second factor device they carry around, and it's silly not to use it. I don't know how much HTML email really has to do with phishing (successful phishing attacks are multimodal and tend to exploit browser chrome as much as anything else), but regardless: it isn't going anywhere, and even if it were the primary cause of phishing, the engineering failure would still be in the authentication system, not in the email presentation system; being able to control a layout on a screen simply shouldn't result in account takeover. Passwords are obsolete.
- Lendal 3y ago
  What? Just because passwords are flawed doesn't make passkeys the answer. The article does not say passwords are perfect. It says the current implementation of passkeys that has been created so far is worse.
- lapcat 3y ago
  > Phishing attacks are effective, anti-phishing training doesn't work (even for technically savvy users) This is overstating the case. I've never been successfully phished. Many people have never been successfully phished. Yes, phishing exists, but it's not an excuse for big tech companies to take away all user freedom. "Those who would give up essential Liberty, to purchase a little temporary Safety, deserve neither Liberty nor Safety." I think passkeys are fine in concept — replacing passwords with site-specific cryptographic keypairs — but the demands of the big tech companies go too far above and beyond the basic concept. For example, here are statements from the person in charge of passkeys at Apple: > If you can drop a single device in a lake and lose your credential, it’s not a passkey. Passkeys are backed up and synced across your devices to deliver a great and safe user experience, while also eliminating phishing. If it’s device-bound, it’s not a passkey. :) https://hachyderm.io/@rmondello/111188643228872151 https://hachyderm.io/@rmondello/111188643228872151 > A reminder to attendees of Authenticate and people everywhere that “device-bound passkey” is an oxymoron. Passkeys are a phishing-resistant password replacement, usable by people of all levels of technical sophistication, built in to smartphones. If a credential is not resilient to device loss, and it doesn’t sync across devices, calling it a passkey will confuse your users who will expect a durable, resilient credential. https://hachyderm.io/@rmondello/111252067006418583 https://hachyderm.io/@rmondello/111252067006418583 To me, these statements are both paternalistic and frightening. You have to understand what they mean by "synced" and "phishing-resistant". The big tech companies are taking these superfluous requirements to extreme. In essence, the attitude is that users can't be trusted with anything, and so users can't be given any control. This attitude is anathema to me. All of my passwords are SSH keys are regularly backed up to multiple storage locations, including offsite. However, I take care of backups myself, manually. I don't use any cloud syncing service. I don't trust them, for a number of reasons, I don't want to use them at all. If I have to use a cloud sync service with my credentials, that's a nonstarter. Moreover, as far as I can tell, when the big tech companies say "phishing-resistant", what they actually mean is that it should be impossible for the user to manually export and examine the private keys, because that would theoretically allow phishing. To my knowledge, FIDO still hasn't agreed on export/import methods, and it's very telling to me that they were willing to ship passkeys without this feature, which I would consider essential. My suspicion is that the "solution" they eventually come up with is some sort of "trusted" list of service providers, who can export/import between themselves without giving users direct access to the keys. There are much bigger problems in the world than phishing. We can harm ourselves in so many ways: driving a car, riding a bike, crossing the street, smoking cigarettes, drinking alcohol, eating bad food, using a chainsaw, opening the front door for strangers, or any combination of the aforementioned. Thank god that cars aren't locked down yet, though I expect that "security professionals" will demand that it be done someday for our own good. Freedom is dangerous. Yes, freedom means that users can be phished. And it means that passwords can be lost. But the absence of freedom is even more dangerous, and I'll fight to the death to preserve my freedom.
throwawa14223 3y ago
The update at the bottom of the article is the most damning in my opinion. You can host your own, but unlike a password there is no promise that your self-hosted version will be compatible with a service.
0xjmp 3y ago
Hang on a sec. > Users don't have the same life experience as security people and sometimes a user simply do not know how to verify a link on e.g. his iPhone. Later... > My password is mine. I control my password. I own my password. I am not dependent upon some third party closed proprietary operating system or device to handle my security. I would rather have a piece of paper with all my passwords written down, stored in a drawer at home So the general public apparently lacks the ability to verify the url in an email, but _do not_ lack the ability to safely control their password? You completely ignore the ability of the site administrator to safely control your password by the way. Altruistic as it may be to be anti-Big Tech, they are pushing the needle forward on cybersecurity. Looking at Apple, they invested millions into a special biometric device that ensures the fingerprint cannot be retrieved by *anyone*. Also, I missed the part of this article where a quote was identified that hardware keys are for the entire population of the world? We do not roll keys out to every single employee - you're right about that. It's an interoperability nightmare. We do roll keys out to critical staff though. CEOs, COOs, high profile figures, critical service admins, etc. These folks are already trained and understand exactly why this initiative is so important; usually because they themselves have been targeted already. Hardware keys are a great thing. I'm frankly getting really exhausted reading about how every new solution must be engineered to fit every single human of planet earth's needs. Its simply not designed with them in mind because they're simply not ready yet. It is what it is. Nuclear power plants don't air gap controls because they hope the same system is used by Walmart down the street. They do it because their risk is... well... nuclear. Hardware keys in tech are no different.
alin23 3y ago
None of my relatives care about remembering passwords, not even those more technically inclined. They create the password, and 30 seconds later forget they even did such a thing. Someone even lost access to their iPhone 8 because after replacing the screen, they got a "This device is locked". But they could not remember their iCloud email and password, they didn't need to remember it. The phone worked fine for years without it. Now it's a perfectly functioning phone, but locked and useless. The difference between "account" and "email" is also lost on them. Not a week goes by before someone needs to access a new site they need to register, and I get the same: I already have this "gmail" thing, why do I need to create another gmail?? (because they have to use their email as the "username") And this is the norm! Most devs creating these systems don't understand this. A passkey sounds marvelous to me, it finally uses the thing that should be the password: the person itself. That is what a password should say after all: yes, this is me, the person that owns this account why do I need to tell you this mumbojumbo words and symbols to know that it's me? you have my face and finger data, match them please. But that's only if it seamlessly supports biometrics like FaceID/TouchID/BrainwavesID-or-something, otherwise it will be just as useless.
- jksflkjl3jk3 3y ago
  > you have my face and finger data, match them please. No thanks. A kidnapper or the government also has access to my face and fingerprints. As tech changes, usable biometric data will likely be captured by 3rd parties from a distance as well. I'll stick with something that I know and at least have some limited constitutional protection from being forced to divulge.
  - the_snooze 3y ago
    That's not what passkeys are though. The server isn't validating if you have a matching face. The server is only checking if you have the private key that corresponds to a public key registered to your account. The private key lives on your device, and may be encrypted under a PIN, password, or biometric. In all those cases, the decryption operation is strictly local. Let's say some crook makes a convincing copy of your face. With passkeys, that's still not enough to log in. They have to have your private key too.
dangus 3y ago
My problem with passkeys is this: I don’t understand how to use them. My current workflow when I sign up for a website is to save my login and password to my password manager. This works across all platforms and browsers, and I use both Mac and Windows along with using both Safari and Firefox. If I choose the passkey option Passkey stuff comes up on Safari and I’m 80% sure that means I can’t use that passkey with my PC? I don’t know how to make sure my passkey isn’t lost by switching devices. Then what do I do if I use an embedded web browser like the one on a Steam Deck or Meta Quest? With my current workflow I can just reveal the credentials and type them in in a worst case scenario that my password manager can’t be installed on that device. I have no idea what I am supposed to do, and this is even true despite the fact that I am aware that my chosen password manager supports passkeys. If this is the learning curve the average person is supposed to contend with I am hesitant to migrate because something this difficult to figure out will never be mainstream. I would welcome any of you to tell me how this is supposed to work.
- Ringz 3y ago
  Good questions.
- lowestdecks 3y ago
  Passkeys are at the beginning stages of support both from the perspective of platforms (OSes, browsers, passkey/password managers) and websites. e.g., Firefox is still figuring out how to support passkeys from OSes and passkey/password managers (e.g. https://connect.mozilla.org/t5/ideas/support-webauthn-passkeys/idi-p/14069 https://connect.mozilla.org/t5/ideas/support-webauthn-passke...) and will likely (this part is just speculation) support Firefox sync as a passkey manager eventually. This is why there is no major website that is requiring users to drop passwords yet. Nor am I aware of any that allow users to even choose to drop passwords yet. > If I choose the passkey option Passkey stuff comes up on Safari and I’m 80% sure that means I can’t use that passkey with my PC? I don’t know how to make sure my passkey isn’t lost by switching devices. If you're saving your passkeys to a credential manager (i.e. password & passkey manager), once there is support from Firefox and your credential manager of choice is plugged into any prerequisite APIs, you will be able to use your passkeys between Windows, Mac, iOS, Android, Safari, Firefox, etc. Devices like Steam Deck, Meta Quest, smart TVs may require additional support added. I'm not super familiar with the platform, but Steam Deck should be fully capable of supporting passkeys through hybrid flow. If it is running a chromium browser and has Bluetooth support, it would be trivial to add support for hybrid flow with a phone as the authenticator (that is: the phone has the passkey and signs a challenge with Bluetooth assistance). Smart TVs already have in place methods to login using a local smart phone, tablet, or laptop (which would use the passkey). I can't speak for Meta Quest because I have literally no idea how that platform works. --- As for the median user globally: the median global user has 1 device: their smartphone. Passkeys are so simple in that case. These users likely are not using any credential manager other than the one built in. Each of these major platforms (except maybe for some Chinese OSes that I'm not familiar with) already has recovery mechanisms in place for when users lose their device. The next largest group has 2-5 devices, with basically all of them able to work just fine using the phone as a hybrid authenticator. You are not a simple case. In fact, anyone that chooses to use a non-platform credential manager is not a simple case.
sys_64738 3y ago
What the heck is a passkey? I never understood the concept how it was different from passwords. Am I just dumb?

39 points by cratermoon 3y ago

I'm in on anything that prevents the "best practice" of entering new passwords that have esoteric standards of "strength", twice, BLIND, on a crap cellphone "keyboard". The dots/stars for "password" type input fields might have prevented shoulder surfing in the days of wide-field-of-vision CRT monitors, and typing passwords twice on a real keyboard might have helped decrease people typing something they didn't mean, but it's all irrelevant in the age of narrow field LED cellphones held close to the face, using much smaller fonts.

sonicanatidae 3y ago
The dots are a legacy thing now. I agree 100%. Yes, they protect you from shoulder surfing, all twice in your life, where that may have been a factor. Otherwise, they are just an implement to the user, at this point.
JohnFen 3y ago
I agree entirely. Obscuring the text was largely pointless even before smart phones became common.
hooverd 3y ago
Decent websites will at least make it toggleable.
Animats 3y ago
The dot thing is actually a holdover from the days of printing terminals, where, if something wasn't done to hide them, passwords would be on paper in a trash can.
- bediger4000 3y ago
  Them I'm glad Unix login programs just didn't print any password characters. But it shows how a best practice isn't appropriate for all circumstances, and that they outlive their usefulness.
jclulow 3y ago
If you're going to drop secret masking, it at least needs to be optionally still available. Modern cameras can capture quite a lot od what's on today's bright, high contrast, high resolution, wide viewing angle screens from surprisingly far away. Unless we're going to use a dark cloth on our phones as if they were an old view camera, I think secret masking still serves a purpose on phones.

nullindividual 3y ago

> The only reason why Big Tech have hyped up Passkeys this much I can't think of any other reason Big Tech (and small tech, and medium tech, government, and the list goes on) would want to eliminate passwords, an insecure concept, to replace them with a form of proof of ownership. > [not pasting full quote because ...] "And developers and users... ― Google" > No, they do not! - Author Certainly, many developers hate all of the reasons outlined by the quote from the ethereal identity known as the "Google". Many users hate them for the same reason, too, but for some reason the author doesn't believe that developers or users dislike the UX, security, or liability of passwords (the Author, here, is apparently speaking for upwards of 8 billion individuals -- as one of them, I can certainly make up my own mind, thanks). > Passkeys also makes you more vulnerable to seizures of electronics and keys. This is why it is important for devices, like the iPhone, have a quick way of putting themselves into a 'locked, require pin/pass' mode. Or just don't enable Face ID/similar biometrics for a 'master' password. > And when it happens to you, Google will let you know that they reserve the right to terminate your account for any reason or no reason at all. The ethereal Google can look at you funny and decide they will lock your account without any reason. I'm not sure what makes this situation any different. People commonly use their Chrome account, or Microsoft account, etc. in conjunction with the OS/browser's password manager. With passkeys, they're effectively in a _no worse_ state than they are today. If you want to argue about backups, these are likely the same individuals who wouldn't know why you'd need a backup to begin with. FWIW, I agree that there shouldn't be vendor lock-in with any form of identity, but there doesn't seem to be a challenger that is willing to bring something forward that eliminates both the security nightmares that are passwords as well as being highly portable with no vendor tie-in which finally, is easy to use. Big Tech found "secure" and "easy to use" which is what users are going to flock to.

hooverd 3y ago
I think Passkeys are a great idea utterly ruined by vendors licking their chops over locking users in and creeping remote attestation.
- CharlesW 3y ago
  How am I “locked in” when I can use a different passkey manager whenever I want, just like I can use a different password manager whenever I want? How does a passkey differ from a password from an attestation POV?

sonicanatidae 3y ago

Costs. There are many reasons to secure logins with passkeys, but all of those reasons seem to be beaten by the costs of rolling it out. After all, breaches are someone else's problem. The company? They get a pittance fine, then carry on. The people responsible? they get bonuses.

JohnFen 3y ago

Passkeys do not fit my use cases very well and in some cases introduce an unacceptable amount of friction. I don't plan on using them for that reason.

snailmailman 3y ago

I’ve been using a password manager for all my passwords for years. Moving from “store a password” to “store a passkey” isn’t that big of a difference. The main thing for me seems to be that you can scan a qr code to authenticate another device, a workflow that I will probably end up using. It’s certainly easier and more secure than manually typing a 20+ character password into an untrusted device. Yeah im sure people will use googles passkey storage, or apples passkey storage, but that was already happening with passwords too. Passkeys isn’t going to change that. Third party password managers are already adding support for passkeys. And OS support for third party passkeys is already there on mobile. Personally I’m looking forward to passkeys. Just going to make my life a little bit easier. I’m going to continue using a self hosted vaultwarden instance. It already supports passkeys on desktop, and I’m eagerly awaiting mobile support for autofilling them. Hopefully that comes soon.

timr 3y ago
The big problem I have with passkeys is that, as currently implemented by ~everyone, they eliminate true second-factor authentication. I haven't seen an implementation yet that allows me to have something I know, and something I possess. That, to me, is less secure.
- whatshisface 3y ago
  The ability to send SMSes or authenticate from your phone are both things you know.
  - tunesmith 3y ago
    No they aren't; not unless access to that phone (including accessing the 2FA functionality) is in turn protected by a passcode/passphrase that you "know".
    - whatshisface 3y ago
      Anyone with the right information can do either one. Including send SMSes: phone company customer support can let other people use your phone number.

perryizgr8 3y ago

The only reason pass keys are being pushed so heavily is because they are another step in the direction of the customer/user having absolutely zero control over the hardware they own, and the software they use. If you doubt this, ask yourself why there's no way to look at your passkey in android? I haven't checked ios but I'll be surprised if it let's you just look at your own passkey.

WD40ForRust2 3y ago
[dead]
growse 3y ago
I can't look at the secret material in my solo usb key either. That's a feature. Do I have "zero control" over it?
- perryizgr8 3y ago
  Yes, pretty much. As the owner you should be able to look at the secret, copy it, publish it, whatever you want. At least with USB keys it is opt in. With passkey I'll be forced to give up my ownership because there are literally no viable options other than Google and Apple for smartphones.
  - growse 3y ago
    This has a very "technically correct" feel to it, which doesn't actually translate into anything useful in the real world. If you think the very existence of HSMs threatens the concept of "ownership over your hardware", then I guess that's a view. > With passkey I'll be forced to give up my ownership because there are literally no viable options other than Google and Apple for smartphones. Every existing webauthn token is a passkey.
    - perryizgr8 3y ago
      > Every existing webauthn token is a passkey. How to use my existing webauthn token in my iphone as a passkey?

gerwim 3y ago

What is this post ranting about? Pushing your keys to big tech? There is no difference if you use Chrome’s password manager for passwords or passkeys. You can save passkeys on your own network if you use Bitwarden or if you want, write your own solution. For 99% of the internet users, passkeys are much better than passwords.

echohack5 3y ago
Here's a workflow: 1. Normally I run everything on my own devices, use 1Password, 2FA, etc, but rarely I need to use a locked down device and manually and painstakingly enter 100+ character passwords and 2FA keys. Installing anything on the device is out of the question, but I need to use a web browser and auth using these credentials. Copy and paste and externally using any devices to connect with the system is prohibited. How does doing a FIDO2 dance work in this scenario?
- konha 3y ago
  > Copy and paste and externally using any devices to connect with the system is prohibited. Like a keyboard? In which case: How do you enter your password? Is that a common scenario? Where you can use a (presumably) usb attached keyboard but you cannot insert your security key?
  - hedora 3y ago
    Air-gapping the machine running a web browser from the machine that stores your passwords seems completely reasonable to me. So does preventing people from plugging random USB devices into shared machines.
    - keep_reading 3y ago
      And yet all the non-technical folks you give this advice to will look at you like you have two heads. This is completely unreasonable unrealistic user-unfriendly advice

apitman 3y ago

I run a free, open source login provider[0] and have been keeping a close eye on passkeys. I think this article gets a bit too much into FUD territory. While big tech control over passkeys is certainly something that should be watched closely as we move forward, all signs currently are that the system will be relatively open to third party developers, including open source solutions. That said, I have other concerns, especially when it comes to decentralized and self-hosted apps. The main problem is that passkeys don't offer any sort of an identity handle to use for granting access to someone who doesn't already have a passkey registered with your system. For example, if I have a self-hosted photo server, and I want to give a friend access to an album, I can simply grant access to friend@example.com. As long as they can prove they own that email address they can access the album. I'm not aware of any way to do this with passkeys. But big tech won't be equally affected. Google photos for example ties your passkey to your gmail address, so their users still get the convenience of semi-global user search and the extra security of passkeys. IMO we need something more like Mozilla Persona that ties a global identifier such as an email address to a key pair. I'm curious if we could build a protocol around OpenPubkey[1] for this purpose. There may be a way to add this to passkeys but I suspect not given how tightly each passkey is tied to the domain it's created for. [0]: https://lastlogin.io/ https://lastlogin.io/ [1]: https://www.bastionzero.com/openpubkey https://www.bastionzero.com/openpubkey

cratermoon 3y ago
> the system will be relatively open to third party developers, including open source solutions. Yes, it will be. Right up until it isn't. See e.g. RedHat, HashiCorp Terraform

dmd 3y ago

Side comment: "The ASCII ribbon campaign was an Internet phenomenon started in 1998 advocating that email be sent only in plain text" When people say "plain text", they really mean "American English". When you rephrase it like that, it sounds a bit racist ... because it is.

deleted 3y ago
[deleted]
hedora 3y ago
Claiming the ASCII ribbon campaign was racist is neither technically correct nor practically correct. There weren't any machines that supported ASCII directly that late in the game. Instead, everything supported DOS code pages. Those are supersets of ASCII, and those supported localization. This was often called "ASCII", since that's pronounced with fewer syllables. On top of that, by 1998, mainstream systems were starting to support UTF-8, and, as a superset of ASCII, it was treated like "just another" plain-text format / extended ASCII code page by software user interfaces of the time. Practically speaking, the campaign was against sending HTML (or, god forbid, RTF) emails. That doesn't preclude localization at all.
currymj 3y ago
the "ASCII ribbon" referred to a ribbon drawn as ASCII art, not an insistence that people use exclusively ASCII characters. Unicode is still plain text and supports any language you can think of, and also most languages you can't think of.
JohnFen 3y ago
> When people say "plain text", they really mean "American English" No, when people say "plain text", they mean not HTML.

cchance 3y ago

I mean... bitwarden has passkey support already, so your not really beholden to google/microsoft etc for storing and generating keys as well so your not just stuck to using the MS Windows or Apple storage :S

hedora 3y ago
Bitwarden won't let you back up your passkeys though. That's a second, equally fundamental, problem with passkeys (and it is their entire reason for existing; the whole concept of passkeys is flawed). I wonder if the open source re-implementation of the vault protocol can export / import passkeys.
- alyandon 3y ago
  You can self-host Bitwarden via an open source implementation of the backend API called Vaultwarden and backup the data as often as you like.
- snailmailman 3y ago
  They don’t currently but they say the feature is coming. All the passkey features in Bitwarden are very much half-baked at the moment as it is brand new. On mobile you can’t even use the passkeys yet. They show up on mobile but no way to use them. I hope Bitwarden finishes the features soon.
- growse 3y ago
  Genuinely curious: what's the use case that's solved by being able to back up a passkey? Why is it not solved by simply registering multiple passkeys for your account context? Is it just friction of having to set it up multiple times per account?
  - hedora 3y ago
    Part of the concern is the friction of setting up on the order 100 accounts on an order of a dozen different devices over the next few year (I hadn't thought of that until you mentioned it), but its mostly that I don't trust any of the authentication providers to not accidentally lock me out of my own account. Anyway, the immediate concrete use case for me is the same as being able to back up my password list: If I lose all my devices (or, more likely, some cloud provider does what Google Drive did last week), then I can restore from the backup. Also, I've already arranged to be able to backup my password list and to store the backup in an offline / secure way. I don't want to set up a second account recovery path just for passkeys. Finally, there's no data on any of my portable devices that I care about. I break a laptop or phone every N years, and I learned long ago to treat them as disposable. As currently implemented, passkeys break that invariant.

efitz 3y ago

I use a password manager that supports passkeys so overall I don’t care. However, I have two gripes with passkeys: (1) the workflow for getting a passkey is all over the place; I wish it was more uniform, and (2) diagnosability is crap. The QR-code-approve-on-your-phone workflow has never once worked for me (Brave on MacOS + iPhone)

tptacek 3y ago

This article states clearly the case for Passkeys: passwords are vulnerable to phishing attacks. Phishing attacks are effective, anti-phishing training doesn't work (even for technically savvy users), and hardware tokens are too cumbersome; meanwhile, people already have a capable second factor device they carry around, and it's silly not to use it. I don't know how much HTML email really has to do with phishing (successful phishing attacks are multimodal and tend to exploit browser chrome as much as anything else), but regardless: it isn't going anywhere, and even if it were the primary cause of phishing, the engineering failure would still be in the authentication system, not in the email presentation system; being able to control a layout on a screen simply shouldn't result in account takeover. Passwords are obsolete.

Lendal 3y ago
What? Just because passwords are flawed doesn't make passkeys the answer. The article does not say passwords are perfect. It says the current implementation of passkeys that has been created so far is worse.
lapcat 3y ago
> Phishing attacks are effective, anti-phishing training doesn't work (even for technically savvy users) This is overstating the case. I've never been successfully phished. Many people have never been successfully phished. Yes, phishing exists, but it's not an excuse for big tech companies to take away all user freedom. "Those who would give up essential Liberty, to purchase a little temporary Safety, deserve neither Liberty nor Safety." I think passkeys are fine in concept — replacing passwords with site-specific cryptographic keypairs — but the demands of the big tech companies go too far above and beyond the basic concept. For example, here are statements from the person in charge of passkeys at Apple: > If you can drop a single device in a lake and lose your credential, it’s not a passkey. Passkeys are backed up and synced across your devices to deliver a great and safe user experience, while also eliminating phishing. If it’s device-bound, it’s not a passkey. :) https://hachyderm.io/@rmondello/111188643228872151 https://hachyderm.io/@rmondello/111188643228872151 > A reminder to attendees of Authenticate and people everywhere that “device-bound passkey” is an oxymoron. Passkeys are a phishing-resistant password replacement, usable by people of all levels of technical sophistication, built in to smartphones. If a credential is not resilient to device loss, and it doesn’t sync across devices, calling it a passkey will confuse your users who will expect a durable, resilient credential. https://hachyderm.io/@rmondello/111252067006418583 https://hachyderm.io/@rmondello/111252067006418583 To me, these statements are both paternalistic and frightening. You have to understand what they mean by "synced" and "phishing-resistant". The big tech companies are taking these superfluous requirements to extreme. In essence, the attitude is that users can't be trusted with anything, and so users can't be given any control. This attitude is anathema to me. All of my passwords are SSH keys are regularly backed up to multiple storage locations, including offsite. However, I take care of backups myself, manually. I don't use any cloud syncing service. I don't trust them, for a number of reasons, I don't want to use them at all. If I have to use a cloud sync service with my credentials, that's a nonstarter. Moreover, as far as I can tell, when the big tech companies say "phishing-resistant", what they actually mean is that it should be impossible for the user to manually export and examine the private keys, because that would theoretically allow phishing. To my knowledge, FIDO still hasn't agreed on export/import methods, and it's very telling to me that they were willing to ship passkeys without this feature, which I would consider essential. My suspicion is that the "solution" they eventually come up with is some sort of "trusted" list of service providers, who can export/import between themselves without giving users direct access to the keys. There are much bigger problems in the world than phishing. We can harm ourselves in so many ways: driving a car, riding a bike, crossing the street, smoking cigarettes, drinking alcohol, eating bad food, using a chainsaw, opening the front door for strangers, or any combination of the aforementioned. Thank god that cars aren't locked down yet, though I expect that "security professionals" will demand that it be done someday for our own good. Freedom is dangerous. Yes, freedom means that users can be phished. And it means that passwords can be lost. But the absence of freedom is even more dangerous, and I'll fight to the death to preserve my freedom.

throwawa14223 3y ago

The update at the bottom of the article is the most damning in my opinion. You can host your own, but unlike a password there is no promise that your self-hosted version will be compatible with a service.

0xjmp 3y ago

Hang on a sec. > Users don't have the same life experience as security people and sometimes a user simply do not know how to verify a link on e.g. his iPhone. Later... > My password is mine. I control my password. I own my password. I am not dependent upon some third party closed proprietary operating system or device to handle my security. I would rather have a piece of paper with all my passwords written down, stored in a drawer at home So the general public apparently lacks the ability to verify the url in an email, but _do not_ lack the ability to safely control their password? You completely ignore the ability of the site administrator to safely control your password by the way. Altruistic as it may be to be anti-Big Tech, they are pushing the needle forward on cybersecurity. Looking at Apple, they invested millions into a special biometric device that ensures the fingerprint cannot be retrieved by *anyone*. Also, I missed the part of this article where a quote was identified that hardware keys are for the entire population of the world? We do not roll keys out to every single employee - you're right about that. It's an interoperability nightmare. We do roll keys out to critical staff though. CEOs, COOs, high profile figures, critical service admins, etc. These folks are already trained and understand exactly why this initiative is so important; usually because they themselves have been targeted already. Hardware keys are a great thing. I'm frankly getting really exhausted reading about how every new solution must be engineered to fit every single human of planet earth's needs. Its simply not designed with them in mind because they're simply not ready yet. It is what it is. Nuclear power plants don't air gap controls because they hope the same system is used by Walmart down the street. They do it because their risk is... well... nuclear. Hardware keys in tech are no different.

alin23 3y ago

None of my relatives care about remembering passwords, not even those more technically inclined. They create the password, and 30 seconds later forget they even did such a thing. Someone even lost access to their iPhone 8 because after replacing the screen, they got a "This device is locked". But they could not remember their iCloud email and password, they didn't need to remember it. The phone worked fine for years without it. Now it's a perfectly functioning phone, but locked and useless. The difference between "account" and "email" is also lost on them. Not a week goes by before someone needs to access a new site they need to register, and I get the same: I already have this "gmail" thing, why do I need to create another gmail?? (because they have to use their email as the "username") And this is the norm! Most devs creating these systems don't understand this. A passkey sounds marvelous to me, it finally uses the thing that should be the password: the person itself. That is what a password should say after all: yes, this is me, the person that owns this account why do I need to tell you this mumbojumbo words and symbols to know that it's me? you have my face and finger data, match them please. But that's only if it seamlessly supports biometrics like FaceID/TouchID/BrainwavesID-or-something, otherwise it will be just as useless.

jksflkjl3jk3 3y ago
> you have my face and finger data, match them please. No thanks. A kidnapper or the government also has access to my face and fingerprints. As tech changes, usable biometric data will likely be captured by 3rd parties from a distance as well. I'll stick with something that I know and at least have some limited constitutional protection from being forced to divulge.
- the_snooze 3y ago
  That's not what passkeys are though. The server isn't validating if you have a matching face. The server is only checking if you have the private key that corresponds to a public key registered to your account. The private key lives on your device, and may be encrypted under a PIN, password, or biometric. In all those cases, the decryption operation is strictly local. Let's say some crook makes a convincing copy of your face. With passkeys, that's still not enough to log in. They have to have your private key too.

dangus 3y ago

My problem with passkeys is this: I don’t understand how to use them. My current workflow when I sign up for a website is to save my login and password to my password manager. This works across all platforms and browsers, and I use both Mac and Windows along with using both Safari and Firefox. If I choose the passkey option Passkey stuff comes up on Safari and I’m 80% sure that means I can’t use that passkey with my PC? I don’t know how to make sure my passkey isn’t lost by switching devices. Then what do I do if I use an embedded web browser like the one on a Steam Deck or Meta Quest? With my current workflow I can just reveal the credentials and type them in in a worst case scenario that my password manager can’t be installed on that device. I have no idea what I am supposed to do, and this is even true despite the fact that I am aware that my chosen password manager supports passkeys. If this is the learning curve the average person is supposed to contend with I am hesitant to migrate because something this difficult to figure out will never be mainstream. I would welcome any of you to tell me how this is supposed to work.

Ringz 3y ago
Good questions.
lowestdecks 3y ago
Passkeys are at the beginning stages of support both from the perspective of platforms (OSes, browsers, passkey/password managers) and websites. e.g., Firefox is still figuring out how to support passkeys from OSes and passkey/password managers (e.g. https://connect.mozilla.org/t5/ideas/support-webauthn-passkeys/idi-p/14069 https://connect.mozilla.org/t5/ideas/support-webauthn-passke...) and will likely (this part is just speculation) support Firefox sync as a passkey manager eventually. This is why there is no major website that is requiring users to drop passwords yet. Nor am I aware of any that allow users to even choose to drop passwords yet. > If I choose the passkey option Passkey stuff comes up on Safari and I’m 80% sure that means I can’t use that passkey with my PC? I don’t know how to make sure my passkey isn’t lost by switching devices. If you're saving your passkeys to a credential manager (i.e. password & passkey manager), once there is support from Firefox and your credential manager of choice is plugged into any prerequisite APIs, you will be able to use your passkeys between Windows, Mac, iOS, Android, Safari, Firefox, etc. Devices like Steam Deck, Meta Quest, smart TVs may require additional support added. I'm not super familiar with the platform, but Steam Deck should be fully capable of supporting passkeys through hybrid flow. If it is running a chromium browser and has Bluetooth support, it would be trivial to add support for hybrid flow with a phone as the authenticator (that is: the phone has the passkey and signs a challenge with Bluetooth assistance). Smart TVs already have in place methods to login using a local smart phone, tablet, or laptop (which would use the passkey). I can't speak for Meta Quest because I have literally no idea how that platform works. --- As for the median user globally: the median global user has 1 device: their smartphone. Passkeys are so simple in that case. These users likely are not using any credential manager other than the one built in. Each of these major platforms (except maybe for some Chinese OSes that I'm not familiar with) already has recovery mechanisms in place for when users lose their device. The next largest group has 2-5 devices, with basically all of them able to work just fine using the phone as a hybrid authenticator. You are not a simple case. In fact, anyone that chooses to use a non-platform credential manager is not a simple case.

sys_64738 3y ago

What the heck is a passkey? I never understood the concept how it was different from passwords. Am I just dumb?