3 ms·
The technology that passkeys are built on is well understood, and the deployments are building on a tech stack that's been getting deployed in browsers for well
by jsnell 3y ago
The technology that passkeys are built on is well understood, and the deployments are building on a tech stack that's been getting deployed in browsers for well more than a decade. I don't remember hearing about any zero-day phishing vulnerabilities in FIDO or WebAuthn during all that time. But even if there had been any, zero-days have both a limited lifetime (these things get fixed quickly after being used in the wild) and a limited reach (only the most sophisticated attackers would have access to them).
There are a small number of people in the world who might need to worry about being the target of a spearphishing campaign that a state-sponsored attacker is going to waste a once in a decade zero-day on. I'm fairly confident nobody in this thread, nor anyone I know in real life, is one of those people.
Even taking hypothetical future zero-days into account, the reduction in specifically phishing risk is going to be absurdly large, the risk will be reduced at least by a factor of millions. That's very different from your original thinking that it was just some minor technical impediment that the attackers would automatically and irrevocably catch up to.
- namaria 3y agoI might be wrong. But I think the position "this technology is unassailable" is much less tenable then "we might see future ways of breaching it and allowing for mass scale phishing that we are not anticipating". edit: as someone pointed out elsewhere in this thread, SIM swapping can defeat this, so much for security.
- jsnell 3y agoExcept that your initial claim was actually: > phisher can and absolutely will catch up to this technically That's not you saying that "there might be future ways of breaching it". That's you saying that it will absolutely and permanently be breached. And that's not a tenable statement at all. I already went into some detail on the probability and impact of a zero-day in the technical implementation, and you engaged with none of it, so I don't think there's much point in going to those details again.
- namaria 3y agoWow yeah I didn't write a bulletproof paper in a forum. You chose 2 tiny details of what I wrote and 100% ignored the fact that you are trying to argue that some technology will be safe against social engineering against the user (phishing) in perpetuity, which is illogical.
- jsnell 3y agoI replied to every point you made in the original message, it wasn't cherrypicking just couple of details. That's because everything in your initial post was wrong. (But I also explained why passkeys wouldn't solve all security problems, and why it's still useful to just make things incrementally better rather than solving everything at once). You then tried to argue zero-days. While zero-days are possible, I replied in detail why they would not be a scalable long-term threat, and your response was to start lying about your original claim. Note that you have provided absolutely nothing to back up your claims about how passkeys will eventually become phishable. Nor have you admitted that your theory about it happening is wrong, just complained that it's unfair to be called out on such a tiny detail. But it's not a tiny detail! Being unphishable is the entire core design goal of passkeys. You're just claiming that they don't actually have that property, while not being able to give any concrete details about why it would be so.