6 ms·

Something that is not clear to me about passkeys and makes me uneasy to start using them: Are passkeys replacing passwords, 2FA, or both? What if I created a

Something that is not clear to me about passkeys and makes me uneasy to start using them: Are passkeys replacing passwords, 2FA, or both? What if I created a passkey on some device, lost that device, and my passkeys aren't cloud-backed-up? Would I be able to recover my account, or it's doomed? Or does it depend on how a given website implemented it?

rootusrootus 2y ago
If the passkey is all you have, then you're doomed (at least to the extent of whatever alternative recovery procedures the vendor is making available to you). That's why it's pretty universal to provide backup codes to put in your safe when setting up a passkey.
- create-username 2y ago
  you should have passkeys on at least two or three devices
  - EvanAnderson 2y ago
    Having one more thing to remember to do when I create a new account seems like the kind of tedious make-work computers should be automating.
    - rootusrootus 2y ago
      I agree. The better answer from my view is to handle passkeys like passwords and manage them the same way.
  - hedora 2y ago
    How do you keep those devices synced? I have over 500 accounts in my password manager. Do I need to manually set up 500 * 3 devices?
    - klausa 2y ago
      You use your password manager to sync them.
    - create-username 2y ago
      I sync them manually, like a medieval peasant
- lxgr 2y ago
  Unfortunately that pattern negates many benefits of WebAuthN: That recovery code is phishable, can be captured by malware on the client or server etc.
- jesseendahl 2y ago
  Account recovery flows are generally entirely unaffected by the move from password to passkey. It’s just your login credential. If you lose either a password or a passkey, you do the same thing: set a new one via email recovery.
- CatWChainsaw 2y ago
  A backup code is a password made of numbers.
lovethevoid 2y ago
Two things: You kind of have to go out of your way to not have your keys backed up. By default, the easiest route is using your android or iphone and both of them back the keys up using icloud Keychain or google password manager. 1Password, bitwarden, all support syncing. Chrome will allow saving it to icloud or your google account. Keepass can be manually synced. Windows is adding sync in the next update for windows hello. List goes on. The other thing is that multiple keys can be created. Easiest way to see this in action is google's account security settings. Log in (if you have an account), hit create passkey, see your options and play around with them. You'll also see you can add a hardware security key too, which isn't nothing new but if you have one that's another key that doesn't rely on a mobile device! If all else fails, the usual account recovery process applies. Much like it would if you forgot your password.
- Fire-Dragon-DoL 2y ago
  So we still need a passkey + second factor, isn't that the case? And if my google account gets banned, I lose access to a trillion things instead of just one. I was hoping passkeys would work on 1password,but chrome/brave don't support that yet. It seems like a passkey is just a password though
  - sitharus 2y ago
    It depends on your security risk profile and the type of passkey provided. The passkey's response describes if the credential is transferrable or not, and if the user has been positively verified as present. They're as secure as having your password + 2FA in a password manager.
    - prophesi 2y ago
      Should be noted that there's still debate on user presence, to the point that someone submitted a CVE[0][1] on KeePassXC for not abiding by this part of the protocol (and which I take Keepass's side). [0] https://github.com/keepassxreboot/keepassxc/issues/9339 https://github.com/keepassxreboot/keepassxc/issues/9339 [1] https://keepassxc.org/blog/2023-06-20-cve-202335866/ https://keepassxc.org/blog/2023-06-20-cve-202335866/ edit: This actually might be a better thread to hear some of the debate between an Okta dev and the KeepassXC team: https://github.com/keepassxreboot/keepassxc/issues/10406 https://github.com/keepassxreboot/keepassxc/issues/10406
lisper 2y ago
> Are passkeys replacing passwords, 2FA, or both? They are advertised as a replacement for passwords, but the truth is that they are orthogonal to both passwords and 2FA. They are a completely different kind of authentication. Both passwords and passkeys work by proving that you know a secret. The difference is that with a password, the way you prove that you know the secret is by revealing it, which leaves you open to phishing. The other problem with passwords is that the secret is generally one that you are expected to type and remember, which limits how long and random it can be. With passkeys, the secret is a public key (EDIT: in the sense of public-key encryption. The secret is actually the secret part of a public-private keypair), that is, a long string of random bits that a normal human could not remember even if they wanted to, and the way you prove that you know it is using that key to produce a digital signature for a random challenge. You never reveal your key during normal operation, and that makes it more resistant against phishing. > What if I created a passkey on some device, lost that device, and my passkeys aren't cloud-backed-up? Would I be able to recover my account, or it's doomed? Or does it depend on how a given website implemented it? It depends on how a web site implements it, but keep in mind that everything that makes it easier to recover from a lost key also makes your account more vulnerable to attack. So having backups of your passkey keys is a really good idea. But those backups don't have to be in the cloud. You could keep local copies on your own devices, or even print the key on a sheet of paper and keep that in a safe.
- scherlock 2y ago
  I don't see how passkeys do anything to prevent phishing.
  - sitharus 2y ago
    Phishing relies on visual confusion to get people to enter their passwords on a site that isn't the one they think it is. WebAuthn credentials are bound to the issuing domain, so the user agent will not supply a passkey to a domain other than the one it should go to.
  - bastawhiz 2y ago
    How exactly do you get someone to give their passkey private key to a bad actor?
dwaite 2y ago
> Are passkeys replacing passwords, 2FA, or both? The minimum bar is replacing passwords with something more secure for the user. If the site wants more specific factors or characteristics of authentication (such as a non-cloneable possession factor) then only some authenticators provide that today themselves. For someone using a synced software provider, they will need to do an additional step to meet this sort of requirement. Factors aren't nearly as solid as they are made out to be - my SMS OTP is synched to all my devices, my TOTP keys come from a software implementation right alongside my password - which isn't a true knowledge factor because it was auto-generated for me. Password managers and other software have long put us on the path of sites leveraging externalized authentication processes and policies, similar to how they might do this explicitly by accepting federation. > What if I created a passkey on some device, lost that device, and my passkeys aren't cloud-backed-up? Would I be able to recover my account, or it's doomed? Or does it depend on how a given website implemented it? The syncing is meant to make it harder to lose the passkey. Sites still ultimately have to have a recovery process when someone does lose access.
- ForHackernews 2y ago
  > Sites still ultimately have to have a recovery process when someone does lose access. Do they? Is that legally mandated somewhere, or can they just say "You're stuffed, make a new account if you want"?
  - jesseendahl 2y ago
    Account recovery flows are generally entirely unaffected by the move from password to passkey. It’s just your login credential. If you lose either a password or a passkey, you do the same thing: reset and set a new one via email recovery.
    - jakub_g 2y ago
      This exactly where my distinction about "what the passkey actually is" is important: if it's only a password, then I assume I can do the recovery. Whereas if it's 2FA, I assume I can't.
gre345t34 2y ago
A FIDO2 credential can be used for passwordless authentication, so long as the authenticator performs user verification (e.g. requires a PIN). This counts as 2FA because it's something you have (the authenticator) plus something you know/are (PIN/biometric). It can also be used as an second factor for traditional username/password auth (with or without user verification). Losing a passkey is no different to losing any other credential: you need another method to authenticate or recover your account.
deleted 2y ago
[deleted]

rootusrootus 2y ago

If the passkey is all you have, then you're doomed (at least to the extent of whatever alternative recovery procedures the vendor is making available to you). That's why it's pretty universal to provide backup codes to put in your safe when setting up a passkey.

create-username 2y ago
you should have passkeys on at least two or three devices
- EvanAnderson 2y ago
  Having one more thing to remember to do when I create a new account seems like the kind of tedious make-work computers should be automating.
  - rootusrootus 2y ago
    I agree. The better answer from my view is to handle passkeys like passwords and manage them the same way.
- hedora 2y ago
  How do you keep those devices synced? I have over 500 accounts in my password manager. Do I need to manually set up 500 * 3 devices?
  - klausa 2y ago
    You use your password manager to sync them.
  - create-username 2y ago
    I sync them manually, like a medieval peasant
lxgr 2y ago
Unfortunately that pattern negates many benefits of WebAuthN: That recovery code is phishable, can be captured by malware on the client or server etc.
jesseendahl 2y ago
Account recovery flows are generally entirely unaffected by the move from password to passkey. It’s just your login credential. If you lose either a password or a passkey, you do the same thing: set a new one via email recovery.
CatWChainsaw 2y ago
A backup code is a password made of numbers.

lovethevoid 2y ago

Two things: You kind of have to go out of your way to not have your keys backed up. By default, the easiest route is using your android or iphone and both of them back the keys up using icloud Keychain or google password manager. 1Password, bitwarden, all support syncing. Chrome will allow saving it to icloud or your google account. Keepass can be manually synced. Windows is adding sync in the next update for windows hello. List goes on. The other thing is that multiple keys can be created. Easiest way to see this in action is google's account security settings. Log in (if you have an account), hit create passkey, see your options and play around with them. You'll also see you can add a hardware security key too, which isn't nothing new but if you have one that's another key that doesn't rely on a mobile device! If all else fails, the usual account recovery process applies. Much like it would if you forgot your password.

Fire-Dragon-DoL 2y ago
So we still need a passkey + second factor, isn't that the case? And if my google account gets banned, I lose access to a trillion things instead of just one. I was hoping passkeys would work on 1password,but chrome/brave don't support that yet. It seems like a passkey is just a password though
- sitharus 2y ago
  It depends on your security risk profile and the type of passkey provided. The passkey's response describes if the credential is transferrable or not, and if the user has been positively verified as present. They're as secure as having your password + 2FA in a password manager.
  - prophesi 2y ago
    Should be noted that there's still debate on user presence, to the point that someone submitted a CVE[0][1] on KeePassXC for not abiding by this part of the protocol (and which I take Keepass's side). [0] https://github.com/keepassxreboot/keepassxc/issues/9339 https://github.com/keepassxreboot/keepassxc/issues/9339 [1] https://keepassxc.org/blog/2023-06-20-cve-202335866/ https://keepassxc.org/blog/2023-06-20-cve-202335866/ edit: This actually might be a better thread to hear some of the debate between an Okta dev and the KeepassXC team: https://github.com/keepassxreboot/keepassxc/issues/10406 https://github.com/keepassxreboot/keepassxc/issues/10406

lisper 2y ago

> Are passkeys replacing passwords, 2FA, or both? They are advertised as a replacement for passwords, but the truth is that they are orthogonal to both passwords and 2FA. They are a completely different kind of authentication. Both passwords and passkeys work by proving that you know a secret. The difference is that with a password, the way you prove that you know the secret is by revealing it, which leaves you open to phishing. The other problem with passwords is that the secret is generally one that you are expected to type and remember, which limits how long and random it can be. With passkeys, the secret is a public key (EDIT: in the sense of public-key encryption. The secret is actually the secret part of a public-private keypair), that is, a long string of random bits that a normal human could not remember even if they wanted to, and the way you prove that you know it is using that key to produce a digital signature for a random challenge. You never reveal your key during normal operation, and that makes it more resistant against phishing. > What if I created a passkey on some device, lost that device, and my passkeys aren't cloud-backed-up? Would I be able to recover my account, or it's doomed? Or does it depend on how a given website implemented it? It depends on how a web site implements it, but keep in mind that everything that makes it easier to recover from a lost key also makes your account more vulnerable to attack. So having backups of your passkey keys is a really good idea. But those backups don't have to be in the cloud. You could keep local copies on your own devices, or even print the key on a sheet of paper and keep that in a safe.

scherlock 2y ago
I don't see how passkeys do anything to prevent phishing.
- sitharus 2y ago
  Phishing relies on visual confusion to get people to enter their passwords on a site that isn't the one they think it is. WebAuthn credentials are bound to the issuing domain, so the user agent will not supply a passkey to a domain other than the one it should go to.
- bastawhiz 2y ago
  How exactly do you get someone to give their passkey private key to a bad actor?

dwaite 2y ago

> Are passkeys replacing passwords, 2FA, or both? The minimum bar is replacing passwords with something more secure for the user. If the site wants more specific factors or characteristics of authentication (such as a non-cloneable possession factor) then only some authenticators provide that today themselves. For someone using a synced software provider, they will need to do an additional step to meet this sort of requirement. Factors aren't nearly as solid as they are made out to be - my SMS OTP is synched to all my devices, my TOTP keys come from a software implementation right alongside my password - which isn't a true knowledge factor because it was auto-generated for me. Password managers and other software have long put us on the path of sites leveraging externalized authentication processes and policies, similar to how they might do this explicitly by accepting federation. > What if I created a passkey on some device, lost that device, and my passkeys aren't cloud-backed-up? Would I be able to recover my account, or it's doomed? Or does it depend on how a given website implemented it? The syncing is meant to make it harder to lose the passkey. Sites still ultimately have to have a recovery process when someone does lose access.

ForHackernews 2y ago
> Sites still ultimately have to have a recovery process when someone does lose access. Do they? Is that legally mandated somewhere, or can they just say "You're stuffed, make a new account if you want"?
- jesseendahl 2y ago
  Account recovery flows are generally entirely unaffected by the move from password to passkey. It’s just your login credential. If you lose either a password or a passkey, you do the same thing: reset and set a new one via email recovery.
  - jakub_g 2y ago
    This exactly where my distinction about "what the passkey actually is" is important: if it's only a password, then I assume I can do the recovery. Whereas if it's 2FA, I assume I can't.

gre345t34 2y ago

A FIDO2 credential can be used for passwordless authentication, so long as the authenticator performs user verification (e.g. requires a PIN). This counts as 2FA because it's something you have (the authenticator) plus something you know/are (PIN/biometric). It can also be used as an second factor for traditional username/password auth (with or without user verification). Losing a passkey is no different to losing any other credential: you need another method to authenticate or recover your account.

deleted 2y ago

[deleted]