3 ms·

Passkeys? Why hasn't it taken off yet?

• deleted 2y ago
  [deleted]
• talldayo 2y ago
  Passkeys were designed with cross-platform and enterprise applications as an afterthought. Professional B2B products aren't integrating it because they have OAuth, regular users aren't using it because they're familiar with passwords and/or already use a password manager, and developers are mostly cautious about the whole thing. People that want secure and battle-tested cryptography use PGP. Passkeys is kinda like a Google/Apple Trojan Horse of lock-in potential and people are rightfully skeptical of the whole thing.
  • riya_hawcx 2y ago
    The lock-in potential with major tech players is definitely a concern for many. The reliance on OS providers and as a result the interoperability challenges can create significant hurdles for Enterprises and users, especially if they encounter issues with device loss or failure. I think a passwordless solution ( not magic links/OTPs - dont even get me started on how insecure they are) that does not depend on the OS is what will make a secure passwordless world a reality for enterprises, developers and end users. Thoughts?
• damnesian 2y ago
  having the lynchpin of so much security an easily broken device like a phone is a real problem for me. Phones are ephemeral. They break. One of the top search results I saw when researching Google Password Manager is not being able to get back into the account if their phone is broken or stolen. That is the same reason I don't like physical passkeys. They can be lost or damaged. Some passkey managers may have taken this into account but that involves research and the major players want to insert themselves into every conversation about it so it takes extra research to find the provider for you. That may be too difficult for someone with only middling tech skills.
  • riya_hawcx 2y ago
    You raise very valid points about the fragility of devices and the challenges with recovery options for passkeys. It’s crucial that any passwordless solution addresses these vulnerabilities. I also don't like that Passkeys are dependent on the OS providers ( Apple, Google and MSFT). If the solution is OS dependent, with an ability to do seamless device recovery/ account recovery, that does make it more adoptable.
    • riya_hawcx 2y ago
      OS independent*
• josephcsible 2y ago
  My biggest hurdle is that attestation exists, which lets organizations like Okta make credible threats to ban open source implementations like KeePassXC, for not having enough restrictions on what users can do with their own data. To be clear, I'm not speaking hypothetically: https://github.com/keepassxreboot/keepassxc/issues/10407#issuecomment-1994673954 https://github.com/keepassxreboot/keepassxc/issues/10407#iss...
  • riya_hawcx 2y ago
    You are absolutely right that attestation introduces challenges, especially for open-source implementations like KeePassXC. While it’s meant to ensure software integrity, it can end up restricting how users interact with their own data, forcing them into locked ecosystems. The issue with traditional approaches, including many that rely on the operating system or hardware for private key storage, is that they limit flexibility and raise concerns over user control and interoperability. There is a growing need for solutions that don’t depend on specific devices or platforms, offering both security and true portability without relying on OS-dependent storage.
• jqpabc123 2y ago
  TOTP is a much simpler, more universal solution --- easily transferable and totally independent of any OS or device. Too many poorly addressed problems with passkeys. For example, what happens if my device is lost/stolen or simply breaks/dies? With TOTP, backups are easy and can even be done on paper if desired.
  • riya_hawcx 2y ago
    TOTP is simple, universal, and relatively easy to back up, even on paper as you mentioned. However, it does have its limitations, particularly in terms of security. One of the main issues with TOTP is that it still relies on shared secrets, which are vulnerable to being stolen or intercepted if the database storing those secrets is compromised. Phishing attacks are on a significant rise and can also trick users into sharing their OTPs, especially with advanced social engineering tactics. Plus, if someone gains access to your phone or authenticator app, they can bypass the OTP altogether. Passkeys, on the other hand, eliminate the need for shared secrets entirely by relying on asymmetric cryptography (public-private keys). Even if a hacker intercepts part of the communication, they can't do much without the private key, which never leaves the user's device. The main challenge with passkeys right now is OS dependency and device/account recovery.
    • jqpabc123 2y ago
      However, it does have its limitations, particularly in terms of security. Is this a problem that actually needs fixing in the real world? Most "real world" exploits I am aware of regarding TOTP center around SMS vulnerabilities. For which there is a simple and obvious fix --- don't use SMS. Instead, generate codes locally. If TOTP is too difficult, will passkeys be any better?
• JohnFen 2y ago
  I gave up on passkeys because they're a fair bit more inconvenient for me than passwords, and since I'm rigorous about proper password generation and use, passkeys give limited security benefits. But if I were to make a recommendation to someone who isn't so rigorous, I'd probably recommend they use passkeys (depending on their exact situation).