4 ms·

I'm hesitant about embracing passkeys. I think passkeys are poorly implemented at this point because of the inability to move them around like passwords - I don

by oidar 2y ago

I'm hesitant about embracing passkeys. I think passkeys are poorly implemented at this point because of the inability to move them around like passwords - I don't want to be locked in. But I don't think what he is explaining is forcing an automatic upgrade for passwords, he is explaining that it can happen at the request of the user or application prompt. Notice that the diagram - The user in the app requests to upgrade (sure, let's call it an upgrade) from a password to a passkey.

JakaJancar 2y ago
The lack of export scares me too, but is it really a problem? If I were to switch to Linux, I guess it just means that I'd have to go through the forgotten pass(key) flow on every site on first login?
- bigiain 2y ago
  Yeah. For a while when I was mostly working on mobile apps, I'd switch between iOS and Android every year. I've almost like clockwork switched between macOS and Windows with every job change. I'm very much leaning into going all Linux for personal stuff based on MS and Apple's pushing Gen AI into the OS. I'll stick to Yubikeys and TOTP 2FA for as long as I can instead of jumping into passkeys.
faeriechangling 2y ago
I'm using exportable passkeys in .kdbx format right now. There's no reason conceptually why passkeys have to be non-exportable. Regular keys are only seldom implemented in that way.
stpn 2y ago
It doesn't seem like it will i.e. _delete_ your username/password, but the behavior is actually automatic without user prompt. See 1:10-ish[0] for the demo - I found this at least somewhat surprising, though I submit this as a passkey advocate (for a while, my side business only-supported passkeys, but we backed away from that). [0]: https://developer.apple.com/videos/play/wwdc2024/10125/?time=70 https://developer.apple.com/videos/play/wwdc2024/10125/?time...
thought_alarm 2y ago
The inability to move them is a feature, not a bug. If you can't move them you can't accidentally give them to the wrong person. A passkey only authenticates a device (or group of devices). All passkey providers must provide secondary methods for validating the identity of their users so that additional passkeys can be issued when a device is lost. But if that secondary validation is garbage then the passkey is also garbage, but that problem is not unique to passkeys. (Strong passwords have the same problem, they're only as strong as the reset mechanism).
- tomjen3 2y ago
  Hard disagree on that being a feature. It’s why I don’t want to use them.
  - thought_alarm 2y ago
    From the perspective of the security experts who designed the system, it's a feature and a requirement.
    - aledalgrande 2y ago
      Security that is too hard and inconvenient to use is not security any more, because users are going to get around it.
    - ndriscoll 2y ago
      And those experts have designed something entirely inappropriate for non-corporate users (who can't just have IT reset their credentials) largely solving problems no one has while introducing real problems (e.g. accidental self-DOS and backdooring device attestation into the web again). Browser generated strong passwords with auto fill exists today, pretty much solves all security concerns, and doesn't have the same pitfalls.
    - romwell 2y ago
      >From the perspective of the security experts who designed the system, it's a feature and a requirement. Great, all day I dream of making someone else's job easier by adding hassles to my life. What's next from the "security experts", booby-trapping front door entrances to deter thieves? Oh, I have another idea. Let's restrict the number of accounts people can have to, like, two, so that they don't have to struggle with remembering passwords! From the perspective of IT helpdesk, it's a feature and a requirement.
bigiain 2y ago
Same. I have a pair of Yubikeys that I have a quite strict process of management that I'm confident enough in. One lives in a "fireproof" lockbox, the other on my keyring - and I make decisions about whether to get the locked one out when activating 2FA immediately or wait til later based on the nature of the login I';m protecting. I will keep using this as long as needed until time and social media outrage (or lack of) proves out the effectiveness of passkeys over time. A second Yubikey in a safe is a lower cost option than a second passkey compatible device...
- HeatrayEnjoyer 2y ago
  What happens if both are lost? Homeless people often lose/are robbed of their possessions. Many people have abusive partners. Sudden destructive emergencies occur (house fire, night tornadoes, unfortunate simultaneous emergencies). What is the recovery process and what prevents it from being gamed itself?
  - bigiain 2y ago
    Sure, that's a risk. But I bet those scenarios you've posited apply equally to the devices with your passkeys on em, right? I'm confident enough that between the one on my keyring in my pocket and the one in my lockbox at home, if I've somehow lost access to _both_ of those I've got more problems in my life than my gmail/github/whatever logins. And the recovery process and gaming thereof questions apply equally to the passkey protected accounts as well, no?
    - romwell 2y ago
      Yes, the question is: what's a person to do in that case? Particularly if they only have one device (a phone), and they lose it.
    - HeatrayEnjoyer 2y ago
      You rephrased my question, but didn't answer it.
DeepYogurt 2y ago
This is largely mitigated so long as services allow for more than one passkey
deleted 2y ago
[deleted]

by oidar 2y ago

JakaJancar 2y ago

The lack of export scares me too, but is it really a problem? If I were to switch to Linux, I guess it just means that I'd have to go through the forgotten pass(key) flow on every site on first login?

bigiain 2y ago
Yeah. For a while when I was mostly working on mobile apps, I'd switch between iOS and Android every year. I've almost like clockwork switched between macOS and Windows with every job change. I'm very much leaning into going all Linux for personal stuff based on MS and Apple's pushing Gen AI into the OS. I'll stick to Yubikeys and TOTP 2FA for as long as I can instead of jumping into passkeys.

faeriechangling 2y ago

I'm using exportable passkeys in .kdbx format right now. There's no reason conceptually why passkeys have to be non-exportable. Regular keys are only seldom implemented in that way.

stpn 2y ago

It doesn't seem like it will i.e. _delete_ your username/password, but the behavior is actually automatic without user prompt. See 1:10-ish[0] for the demo - I found this at least somewhat surprising, though I submit this as a passkey advocate (for a while, my side business only-supported passkeys, but we backed away from that). [0]: https://developer.apple.com/videos/play/wwdc2024/10125/?time=70 https://developer.apple.com/videos/play/wwdc2024/10125/?time...

thought_alarm 2y ago

The inability to move them is a feature, not a bug. If you can't move them you can't accidentally give them to the wrong person. A passkey only authenticates a device (or group of devices). All passkey providers must provide secondary methods for validating the identity of their users so that additional passkeys can be issued when a device is lost. But if that secondary validation is garbage then the passkey is also garbage, but that problem is not unique to passkeys. (Strong passwords have the same problem, they're only as strong as the reset mechanism).

tomjen3 2y ago
Hard disagree on that being a feature. It’s why I don’t want to use them.
- thought_alarm 2y ago
  From the perspective of the security experts who designed the system, it's a feature and a requirement.
  - aledalgrande 2y ago
    Security that is too hard and inconvenient to use is not security any more, because users are going to get around it.
  - ndriscoll 2y ago
    And those experts have designed something entirely inappropriate for non-corporate users (who can't just have IT reset their credentials) largely solving problems no one has while introducing real problems (e.g. accidental self-DOS and backdooring device attestation into the web again). Browser generated strong passwords with auto fill exists today, pretty much solves all security concerns, and doesn't have the same pitfalls.
  - romwell 2y ago
    >From the perspective of the security experts who designed the system, it's a feature and a requirement. Great, all day I dream of making someone else's job easier by adding hassles to my life. What's next from the "security experts", booby-trapping front door entrances to deter thieves? Oh, I have another idea. Let's restrict the number of accounts people can have to, like, two, so that they don't have to struggle with remembering passwords! From the perspective of IT helpdesk, it's a feature and a requirement.

bigiain 2y ago

Same. I have a pair of Yubikeys that I have a quite strict process of management that I'm confident enough in. One lives in a "fireproof" lockbox, the other on my keyring - and I make decisions about whether to get the locked one out when activating 2FA immediately or wait til later based on the nature of the login I';m protecting. I will keep using this as long as needed until time and social media outrage (or lack of) proves out the effectiveness of passkeys over time. A second Yubikey in a safe is a lower cost option than a second passkey compatible device...

HeatrayEnjoyer 2y ago
What happens if both are lost? Homeless people often lose/are robbed of their possessions. Many people have abusive partners. Sudden destructive emergencies occur (house fire, night tornadoes, unfortunate simultaneous emergencies). What is the recovery process and what prevents it from being gamed itself?
- bigiain 2y ago
  Sure, that's a risk. But I bet those scenarios you've posited apply equally to the devices with your passkeys on em, right? I'm confident enough that between the one on my keyring in my pocket and the one in my lockbox at home, if I've somehow lost access to _both_ of those I've got more problems in my life than my gmail/github/whatever logins. And the recovery process and gaming thereof questions apply equally to the passkey protected accounts as well, no?
  - romwell 2y ago
    Yes, the question is: what's a person to do in that case? Particularly if they only have one device (a phone), and they lose it.
  - HeatrayEnjoyer 2y ago
    You rephrased my question, but didn't answer it.

DeepYogurt 2y ago

This is largely mitigated so long as services allow for more than one passkey

deleted 2y ago

[deleted]