4 ms·

> I’ve avoided passkeys so far because I just don’t have a good mental model of them. OK, so the simplest way to understand is to first know about the previous

> I’ve avoided passkeys so far because I just don’t have a good mental model of them. OK, so the simplest way to understand is to first know about the previous generation. U2F keys are designed to be used alongside a username and password, as a more secure replacement for phone apps showing 6-digit codes. In U2F the key has a hardware 'secure element' where secrets can't be extracted, even if you plug it into a compromised machine. You get a separate public/private key pair for every account and website (so it can't be used to track you between websites) and that key pair can be used to authenticate with the website. A physical button has to be pressed to authenticate, keeping it secure even if an attacker has control over your keyboard and mouse. The browser integration takes care of letting the USB key know which website is asking to authenticate. U2F keys have to be used alongside a username and password. For a variety of reasons U2F keys never really took off. Partly cost, partly the 'what if I lose it' issue, partly lack of uptake by websites, partly difficulty using them on mobile, partly competition from 'log in with google' type systems. So the trade group behind U2F said "Hey, maybe we could just emulate the hardware secure element in the smartphone's OS? And while we're at it, we could save the username, and use fingerprint/faceid instead of a password, eliminate that tedious button press, and automatically back up the public/private keypairs to the cloud". They kept a USB option about for the sake of tradition, but it's on life support. So that's the mental model of a Passkey: It's like an impossible-to-clone USB hardware secure element that does challenge-response authentication to websites. Except it's emulated in OS software, and is no longer impossible to clone. Another way of thinking of it is: It's very similar to using the 'Log in with Google' / 'Log in with Apple ID' buttons you see on many websites, you're authenticating to a service by proving you have access to a cloud account. The implementation details in the background are very different, but the result is broadly the same.

chrisweekly 3y ago
> "and use fingerprint/faceid instead of a password" This is the part that makes absolutely no sense to me. An essential aspect of passwords is that they can be changed. If someone manages to fake the digital representation of my fingerprints or face, what now? Security guru Bruce Schneier has written about this w/ much more eloquence and authority.
- throwaway48476 3y ago
  The unstated value of a USB key is the functional similarity to metal keys for ordinary people.
  - c0wb0yc0d3r 3y ago
    This is exactly how I describe them to many as well. I just wish there was a USB key with the durability of a metal key.
    - vel0city 3y ago
      Somewhat personal ancedote, but I've had pretty good experiences with Yubikeys. I've had one on my daily keychain for over a decade now. Its been run through clothes washing machines too many times to count, I've left it out in rainstorms, its been baked in the sun on hot summer days multiple times, its been dropped in pools, its been run over by a car, I've dropped it some pretty significant heights while hiking. It is still working just fine. That and a PNY 16GB metal keychain flash drive have taken a ton of abuse and are still working just fine. Other than a higher melting point or ability to take high energy RF I don't imagine there is much more abuse a traditional metal key would have compared to what I've done to my Yubikey.
      - Arelius 3y ago
        Maybe it’s the old USB version? I haven’t had so much luck… I had a couple of nanos, and those broke pretty quick. More recently, I switched to a usb-c version…. And while it still works and stays attached to the key ring. The plastic housing has broken already. I got a corp branded one now, that I’m trying and seems a touch more robust
        vel0city 3y ago
        I've only had the full USB-A style ones. Every device I've had that I've needed a yubikey with has either a USB-A or supported NFC. The >1 decade device is a Yubikey NEO, I recently got a Yubikey 5 USB-A variant and also have one of those FIDO-only blue Security keys in USB-A. What kind of failures did you have for the nanos? They just became unresponsive? Did they suffer any obvious physical failure or any particular kind of event cause their failure?
NoMoreNicksLeft 3y ago
This sounds, to me, like a really bad and convoluted way of storing pub/priv in a password manager, and hoping the software implementation gets it right when it's trying to manage these things for me because I'm too dumb to manage passwords and too hobbled by bad IT policies that want to change my passwords every 4 weeks.
ryandrake 3y ago
[deleted]
red_admiral 3y ago
Yubikeys absolutely took off in certain corporate, government and tech environments. Just not so much with the general public.
- michaelt 3y ago
  Eh, somewhat. The lost key account recovery story is much better in large organisations, where you have a 24/7 helpdesk that can check your ID badge in person, a HR department with a photocopy of your passport, and suchlike. But for example if you're using Azure/AD? No U2F + Password allowed, gotta go straight to "passwordless" [1]. So they never took off far enough for Microsoft to support them. [1] https://learn.microsoft.com/en-us/entra/identity/authentication/how-to-enable-passkey-fido2 https://learn.microsoft.com/en-us/entra/identity/authenticat...
whartung 3y ago
The big question I have is are the keys device/browser specific? Seems to me I need to be able to log in with a password from any place (my phone, my machine, my office, my wifes phone, her laptop, my friends laptop, etc.). I mean, who knows when I'll want or need to get into Something. Also, my wife and I share accounts (such as Amazon). So, it needs to work seamlessly across all of her devices. Then there's always the "F-with it factor" that I loathe. At least I understand passwords. Can (mostly) always recover a password (I recall trying to recover my Apple ID password -- they bluntly said "ok, but you have to come back in 2 weeks", so I was locked out for 2 weeks). And, of course the level of patience my wife has with Technology is less than zero. I rely on my Safari auto fill, when I use another browser, I just copy the pw from Safari. And I don't use any of the cloud services. I have an iPhone, but don't use iCloud.

chrisweekly 3y ago

> "and use fingerprint/faceid instead of a password" This is the part that makes absolutely no sense to me. An essential aspect of passwords is that they can be changed. If someone manages to fake the digital representation of my fingerprints or face, what now? Security guru Bruce Schneier has written about this w/ much more eloquence and authority.

throwaway48476 3y ago
The unstated value of a USB key is the functional similarity to metal keys for ordinary people.
- c0wb0yc0d3r 3y ago
  This is exactly how I describe them to many as well. I just wish there was a USB key with the durability of a metal key.
  - vel0city 3y ago
    Somewhat personal ancedote, but I've had pretty good experiences with Yubikeys. I've had one on my daily keychain for over a decade now. Its been run through clothes washing machines too many times to count, I've left it out in rainstorms, its been baked in the sun on hot summer days multiple times, its been dropped in pools, its been run over by a car, I've dropped it some pretty significant heights while hiking. It is still working just fine. That and a PNY 16GB metal keychain flash drive have taken a ton of abuse and are still working just fine. Other than a higher melting point or ability to take high energy RF I don't imagine there is much more abuse a traditional metal key would have compared to what I've done to my Yubikey.
    - Arelius 3y ago
      Maybe it’s the old USB version? I haven’t had so much luck… I had a couple of nanos, and those broke pretty quick. More recently, I switched to a usb-c version…. And while it still works and stays attached to the key ring. The plastic housing has broken already. I got a corp branded one now, that I’m trying and seems a touch more robust
      - vel0city 3y ago
        I've only had the full USB-A style ones. Every device I've had that I've needed a yubikey with has either a USB-A or supported NFC. The >1 decade device is a Yubikey NEO, I recently got a Yubikey 5 USB-A variant and also have one of those FIDO-only blue Security keys in USB-A. What kind of failures did you have for the nanos? They just became unresponsive? Did they suffer any obvious physical failure or any particular kind of event cause their failure?

NoMoreNicksLeft 3y ago

This sounds, to me, like a really bad and convoluted way of storing pub/priv in a password manager, and hoping the software implementation gets it right when it's trying to manage these things for me because I'm too dumb to manage passwords and too hobbled by bad IT policies that want to change my passwords every 4 weeks.

ryandrake 3y ago

[deleted]

red_admiral 3y ago

Yubikeys absolutely took off in certain corporate, government and tech environments. Just not so much with the general public.

michaelt 3y ago
Eh, somewhat. The lost key account recovery story is much better in large organisations, where you have a 24/7 helpdesk that can check your ID badge in person, a HR department with a photocopy of your passport, and suchlike. But for example if you're using Azure/AD? No U2F + Password allowed, gotta go straight to "passwordless" [1]. So they never took off far enough for Microsoft to support them. [1] https://learn.microsoft.com/en-us/entra/identity/authentication/how-to-enable-passkey-fido2 https://learn.microsoft.com/en-us/entra/identity/authenticat...

whartung 3y ago

The big question I have is are the keys device/browser specific? Seems to me I need to be able to log in with a password from any place (my phone, my machine, my office, my wifes phone, her laptop, my friends laptop, etc.). I mean, who knows when I'll want or need to get into Something. Also, my wife and I share accounts (such as Amazon). So, it needs to work seamlessly across all of her devices. Then there's always the "F-with it factor" that I loathe. At least I understand passwords. Can (mostly) always recover a password (I recall trying to recover my Apple ID password -- they bluntly said "ok, but you have to come back in 2 weeks", so I was locked out for 2 weeks). And, of course the level of patience my wife has with Technology is less than zero. I rely on my Safari auto fill, when I use another browser, I just copy the pw from Safari. And I don't use any of the cloud services. I have an iPhone, but don't use iCloud.