5 ms·

I’ve been using a password manager for all my passwords for years. Moving from “store a password” to “store a passkey” isn’t that big of a difference. The main

I’ve been using a password manager for all my passwords for years. Moving from “store a password” to “store a passkey” isn’t that big of a difference. The main thing for me seems to be that you can scan a qr code to authenticate another device, a workflow that I will probably end up using. It’s certainly easier and more secure than manually typing a 20+ character password into an untrusted device. Yeah im sure people will use googles passkey storage, or apples passkey storage, but that was already happening with passwords too. Passkeys isn’t going to change that. Third party password managers are already adding support for passkeys. And OS support for third party passkeys is already there on mobile. Personally I’m looking forward to passkeys. Just going to make my life a little bit easier. I’m going to continue using a self hosted vaultwarden instance. It already supports passkeys on desktop, and I’m eagerly awaiting mobile support for autofilling them. Hopefully that comes soon.

timr 3y ago
The big problem I have with passkeys is that, as currently implemented by ~everyone, they eliminate true second-factor authentication. I haven't seen an implementation yet that allows me to have something I know, and something I possess. That, to me, is less secure.
- whatshisface 3y ago
  The ability to send SMSes or authenticate from your phone are both things you know.
  - tunesmith 3y ago
    No they aren't; not unless access to that phone (including accessing the 2FA functionality) is in turn protected by a passcode/passphrase that you "know".
    - whatshisface 3y ago
      Anyone with the right information can do either one. Including send SMSes: phone company customer support can let other people use your phone number.
      - tunesmith 3y ago
        Your comment isn't clear enough to make sense... it sounds like you are agreeing with me, but I'm guessing since you are replying you disagree.
    - cchance 3y ago
      From what i've seen every passkey implementation requires the device + a password or touchid or faceid to actually unlock the passkey authenticator... thats 2 things... the device key vault + your face
      - whatshisface 3y ago
        An image of your face is something you know. It's also a password that you can't change, and that is written down on a sticky note... on your face.
        tunesmith 3y ago
        "Something you know" means something in your head that other people can't access, and that is protected by the 5th amendment. The image of your face is not; it's something other people see every day. So it's not "something you know".
      - tunesmith 3y ago
        The whole point is to not equate "password" with "touchid/faceid". The former is "something you know", and the latter are not. In the US, it's legal to get access to someone's finger or face. It's not legal to torture someone to reveal a thought.
  - aftbit 3y ago
    Agreed - if you want true "thing you have", it needs to be a standalone hardware token, and it needs to be fundamentally impossible to extract the key from it. Otherwise, its key just becomes another "thing you know".
- marcosdumay 3y ago
  You can usually password-protect your keys. That's 2 factors by itself. That "usually" may exclude the two implementations that most people will use (but I doubt it), but it's a quite standard feature.
- the_snooze 3y ago
  Passkeys are effectively SSH keys under the hood. All implementions I've seen are two-factor as far as the user is concerned: the server challenges the client to prove they own a private key, and the private key is encrypted client-side under a password, PIN, or biometric.
  - timr 3y ago
    > Passkeys are effectively SSH keys under the hood. Yes, that's the common rebuttal. It's resistant to MITM and phishing, but it's still not two-factor. If you store your passkey on a yubikey with PIN, I suppose it's two-factor in the sense that you need the key and a PIN, but you can only store so many passkeys that way.
    - illiac786 3y ago
      But why is 2FA superior? I understand that a yubikey seems more secure than the secure enclave of a computer, but that's a very specific factor (yubikey could incidentally be a single factor actually). Is it just that more is better?
      - timr 3y ago
        The advantage of a physical second factor is that you need the physical second factor. Put all of your passkeys in a single repo (as most people will), and you're literally putting all of your eggs in a single basket. Better hope nobody gets ahold of that basket.
        illiac786 3y ago
        non-physical second factors have no benefit in your view? I don't think either, just curious to know if that's your position as well.
      - mindprism 3y ago
        It's not so much that it's "more" in the sense of more of the same, like, e.g. requiring 2 different passwords. That's a waste of time. But 2FA makes the attackers job much more difficult. If someone steals my password or compromises a key, then they still need to hijack my SIM for SMS or steal my phone to get a code from my authenticator app. That's 2 completely different kinds of shenanigans that need to be successful.
- cchance 3y ago
  All the implementations i've seen do both, you "HAVE" your phone, and you "ARE" yourself because touchid, faceid, passkey was used to unlock the key on the phone/bitwarden/whatever your using the passkey on, you still have to unlock the vault on the device you have to use the passkey
  - hedora 3y ago
    "Thing you are" is not a replacement for "thing you know" because it can't be rotated (except surgically, and... nope)
    - the_snooze 3y ago
      There's really no need to rotate it because the biometric is only used locally. Your private key is kept encrypted at rest on your device, and a biometric (or PIN or password) is used to decrypt it during the passkey "do you have the correct private key?" authentication challenge. The remote server only sees the result of the "do you have the correct private key?" challenge, not the biometric/PIN/password unlocking the private key that happens locally.
    - growse 3y ago
      No-one's forcing you to use biometrics. Stick a strong password on your device and now it's guarded by something you know.
- snailmailman 3y ago
  The “something you know” is what handicaps passwords into being weak - they have to be easy to remember. And they have to be unique per service- because the website has to know the password too and websites get hacked. Because of this people basically have to use password managers. Because otherwise they set every password to “cat123” or “spring2024” etc. And if people are generating good passwords and storing them anyway- we may as well store digital keys instead. My password manager is still protected by a good password + 2FA. Passkeys will be protected by this as well. On my phone there is biometric that can replace the password as well. How secure your passkeys are comes down to how protect them. But it’s definitely an improvement over passwords.
  - jksflkjl3jk3 3y ago
    It's an improvement over passwords as long as two things are true: 1. Open source implementations will be indistinguishable to a 3rd party from the big tech versions (so that services can't refuse to authenticate devices that haven't been locked down), and 2. The private key can be extracted from the device by the user and backed up.
    - growse 3y ago
      Why is #2 important? Passkeys break the 1:1 relationship between credentials and accounts, so just register multiple passkeys. If it can be extracted, it can be stolen. Better to stick your secret material in a HSM that takes the key with it when it dies.
  - timr 3y ago
    > My password manager is still protected by a good password + 2FA. So yeah...your second factor is an actual second factor. I completely get the argument that passkeys are an improvement for most people. But if you're already using password + pw manager + 2FA, it seems to me that you're a good bit more secure than a passkey alone.
ezfe 3y ago
I've used it a bunch already, very useful for signing into my Apple ID on non-personal devices

timr 3y ago

The big problem I have with passkeys is that, as currently implemented by ~everyone, they eliminate true second-factor authentication. I haven't seen an implementation yet that allows me to have something I know, and something I possess. That, to me, is less secure.

whatshisface 3y ago
The ability to send SMSes or authenticate from your phone are both things you know.
- tunesmith 3y ago
  No they aren't; not unless access to that phone (including accessing the 2FA functionality) is in turn protected by a passcode/passphrase that you "know".
  - whatshisface 3y ago
    Anyone with the right information can do either one. Including send SMSes: phone company customer support can let other people use your phone number.
    - tunesmith 3y ago
      Your comment isn't clear enough to make sense... it sounds like you are agreeing with me, but I'm guessing since you are replying you disagree.
  - cchance 3y ago
    From what i've seen every passkey implementation requires the device + a password or touchid or faceid to actually unlock the passkey authenticator... thats 2 things... the device key vault + your face
    - whatshisface 3y ago
      An image of your face is something you know. It's also a password that you can't change, and that is written down on a sticky note... on your face.
      - tunesmith 3y ago
        "Something you know" means something in your head that other people can't access, and that is protected by the 5th amendment. The image of your face is not; it's something other people see every day. So it's not "something you know".
    - tunesmith 3y ago
      The whole point is to not equate "password" with "touchid/faceid". The former is "something you know", and the latter are not. In the US, it's legal to get access to someone's finger or face. It's not legal to torture someone to reveal a thought.
- aftbit 3y ago
  Agreed - if you want true "thing you have", it needs to be a standalone hardware token, and it needs to be fundamentally impossible to extract the key from it. Otherwise, its key just becomes another "thing you know".
marcosdumay 3y ago
You can usually password-protect your keys. That's 2 factors by itself. That "usually" may exclude the two implementations that most people will use (but I doubt it), but it's a quite standard feature.
the_snooze 3y ago
Passkeys are effectively SSH keys under the hood. All implementions I've seen are two-factor as far as the user is concerned: the server challenges the client to prove they own a private key, and the private key is encrypted client-side under a password, PIN, or biometric.
- timr 3y ago
  > Passkeys are effectively SSH keys under the hood. Yes, that's the common rebuttal. It's resistant to MITM and phishing, but it's still not two-factor. If you store your passkey on a yubikey with PIN, I suppose it's two-factor in the sense that you need the key and a PIN, but you can only store so many passkeys that way.
  - illiac786 3y ago
    But why is 2FA superior? I understand that a yubikey seems more secure than the secure enclave of a computer, but that's a very specific factor (yubikey could incidentally be a single factor actually). Is it just that more is better?
    - timr 3y ago
      The advantage of a physical second factor is that you need the physical second factor. Put all of your passkeys in a single repo (as most people will), and you're literally putting all of your eggs in a single basket. Better hope nobody gets ahold of that basket.
      - illiac786 3y ago
        non-physical second factors have no benefit in your view? I don't think either, just curious to know if that's your position as well.
    - mindprism 3y ago
      It's not so much that it's "more" in the sense of more of the same, like, e.g. requiring 2 different passwords. That's a waste of time. But 2FA makes the attackers job much more difficult. If someone steals my password or compromises a key, then they still need to hijack my SIM for SMS or steal my phone to get a code from my authenticator app. That's 2 completely different kinds of shenanigans that need to be successful.
cchance 3y ago
All the implementations i've seen do both, you "HAVE" your phone, and you "ARE" yourself because touchid, faceid, passkey was used to unlock the key on the phone/bitwarden/whatever your using the passkey on, you still have to unlock the vault on the device you have to use the passkey
- hedora 3y ago
  "Thing you are" is not a replacement for "thing you know" because it can't be rotated (except surgically, and... nope)
  - the_snooze 3y ago
    There's really no need to rotate it because the biometric is only used locally. Your private key is kept encrypted at rest on your device, and a biometric (or PIN or password) is used to decrypt it during the passkey "do you have the correct private key?" authentication challenge. The remote server only sees the result of the "do you have the correct private key?" challenge, not the biometric/PIN/password unlocking the private key that happens locally.
  - growse 3y ago
    No-one's forcing you to use biometrics. Stick a strong password on your device and now it's guarded by something you know.
snailmailman 3y ago
The “something you know” is what handicaps passwords into being weak - they have to be easy to remember. And they have to be unique per service- because the website has to know the password too and websites get hacked. Because of this people basically have to use password managers. Because otherwise they set every password to “cat123” or “spring2024” etc. And if people are generating good passwords and storing them anyway- we may as well store digital keys instead. My password manager is still protected by a good password + 2FA. Passkeys will be protected by this as well. On my phone there is biometric that can replace the password as well. How secure your passkeys are comes down to how protect them. But it’s definitely an improvement over passwords.
- jksflkjl3jk3 3y ago
  It's an improvement over passwords as long as two things are true: 1. Open source implementations will be indistinguishable to a 3rd party from the big tech versions (so that services can't refuse to authenticate devices that haven't been locked down), and 2. The private key can be extracted from the device by the user and backed up.
  - growse 3y ago
    Why is #2 important? Passkeys break the 1:1 relationship between credentials and accounts, so just register multiple passkeys. If it can be extracted, it can be stolen. Better to stick your secret material in a HSM that takes the key with it when it dies.
- timr 3y ago
  > My password manager is still protected by a good password + 2FA. So yeah...your second factor is an actual second factor. I completely get the argument that passkeys are an improvement for most people. But if you're already using password + pw manager + 2FA, it seems to me that you're a good bit more secure than a passkey alone.

ezfe 3y ago

I've used it a bunch already, very useful for signing into my Apple ID on non-personal devices