3 ms·

My thoughts too, resident keys don't have real advantages and only complicate things for users and developers.

by dandanua 3y ago

IshKebab 3y ago
Don't they still have the advantage of not leaking passwords when sites are hacked?
- deleted 3y ago
  [deleted]
- layer8 3y ago
  Not if users use reasonably strong passwords (such as generated from a password manager) and sites only store hashes.
  - IshKebab 3y ago
    Sure but sites don't only store strong hashes. Fair point about password managers though.
    - layer8 3y ago
      Sites that store plain-text passwords and don’t move to storing hashes won’t move to passkeys either.
      - IshKebab 3y ago
        Yes but the point is you don't know which sites are storing plain text passwords.
        layer8 3y ago
        Yes. So you mean the end user can choose to never use any password-based sites, and only use passkey-based site. I guess that’s fair.
        IshKebab 3y ago
        I mean in a hypothetical world where all sites supported passkeys you would then know that your secret information wouldn't be leaked. But I agree it's much simpler to achieve that just by using a password manager.
bostik 3y ago
Resident keys are good for SSH (I've done my part to make their use more accessible: https://bostik.iki.fi/aivoituksia/projects/yubikey-ssh.html https://bostik.iki.fi/aivoituksia/projects/yubikey-ssh.html), although the overall usability can still be improved. We are at an early stage of a new type of technology and people are still finding out what it can be even used for in realistic settings. They are also good for enterprise deployments, where you can justify 2 (or 3) keys per user, and where you have a dedicated IT team to take care of account resets. But resident keys for general website logins are a terrible idea. As other posters have already pointed out, the relevant security keys have a fixed number of key slots. Current best-of-breed hardware can store 25 resident keys. With only a small fraction of websites using WebAuthn, that limit is not an immediate concern - but considering the average user has about 100 online accounts[0], those slots will run out. Now consider that to have them be secure, the keys really can't be exportable. And in order to account for hardware failures and/or misplacements, you'd need a minimum of two such devices enrolled for each account. The most depressing part of this all is that while passkeys are under the hood FIDO2 credentials, and their communication protocol is the same as with hardware devices, having a passkey support can indeed rule out physical devices. As the article points out, the transport specifier is different, and there is nothing that prevents an implementation to flat out reject anything other than "internal". 0: https://tech.co/password-managers/how-many-passwords-average-person https://tech.co/password-managers/how-many-passwords-average...
- crote 3y ago
  With Yubikeys there's also the option of using the GPG smart card functionality for SSH keys. It's quite a bit of a hassle client-side, but it's completely transparent to the server.

My thoughts too, resident keys don't have real advantages and only complicate things for users and developers.

IshKebab 3y ago

Don't they still have the advantage of not leaking passwords when sites are hacked?

deleted 3y ago
[deleted]
layer8 3y ago
Not if users use reasonably strong passwords (such as generated from a password manager) and sites only store hashes.
- IshKebab 3y ago
  Sure but sites don't only store strong hashes. Fair point about password managers though.
  - layer8 3y ago
    Sites that store plain-text passwords and don’t move to storing hashes won’t move to passkeys either.
    - IshKebab 3y ago
      Yes but the point is you don't know which sites are storing plain text passwords.
      - layer8 3y ago
        Yes. So you mean the end user can choose to never use any password-based sites, and only use passkey-based site. I guess that’s fair.
        IshKebab 3y ago
        I mean in a hypothetical world where all sites supported passkeys you would then know that your secret information wouldn't be leaked. But I agree it's much simpler to achieve that just by using a password manager.

bostik 3y ago

Resident keys are good for SSH (I've done my part to make their use more accessible: https://bostik.iki.fi/aivoituksia/projects/yubikey-ssh.html https://bostik.iki.fi/aivoituksia/projects/yubikey-ssh.html), although the overall usability can still be improved. We are at an early stage of a new type of technology and people are still finding out what it can be even used for in realistic settings. They are also good for enterprise deployments, where you can justify 2 (or 3) keys per user, and where you have a dedicated IT team to take care of account resets. But resident keys for general website logins are a terrible idea. As other posters have already pointed out, the relevant security keys have a fixed number of key slots. Current best-of-breed hardware can store 25 resident keys. With only a small fraction of websites using WebAuthn, that limit is not an immediate concern - but considering the average user has about 100 online accounts[0], those slots will run out. Now consider that to have them be secure, the keys really can't be exportable. And in order to account for hardware failures and/or misplacements, you'd need a minimum of two such devices enrolled for each account. The most depressing part of this all is that while passkeys are under the hood FIDO2 credentials, and their communication protocol is the same as with hardware devices, having a passkey support can indeed rule out physical devices. As the article points out, the transport specifier is different, and there is nothing that prevents an implementation to flat out reject anything other than "internal". 0: https://tech.co/password-managers/how-many-passwords-average-person https://tech.co/password-managers/how-many-passwords-average...

crote 3y ago
With Yubikeys there's also the option of using the GPG smart card functionality for SSH keys. It's quite a bit of a hassle client-side, but it's completely transparent to the server.