3 ms·

Passkeys won't fully replace passwords. There's one glaring reason why: theft or seizure. You do not currently need to unlock your phone, computer, or internet

Passkeys won't fully replace passwords. There's one glaring reason why: theft or seizure. You do not currently need to unlock your phone, computer, or internet accounts for law enforcement though the legality is fluid. But with a passkey I cannot imagine law enforcement exercising any restraint. The same goes for any one else seeking access to your accounts or computer. Sure, there are other ways to get that information but I'd imagine it's better to let them use those.

microtonal 2y ago
I am not sure what you are saying. If you use Apple's passkey implementation, you need to unlock your computer and when using a passkey confirm with Touch ID (or Face ID on iPhone). So, if you don't need to unlock your phone, computer, or internet accounts for law enforcement, they also can't get your passkeys. Using a USB stick as a passkey without authentication is just a bad idea. Ps. passkeys are end-to-end encrypted on Apple devices using iCloud keychain. Sure, Apple could push a software update that exfiltrates your passkeys, but in the end you need a trust anchor somewhere in the chain.
- TeMPOraL 2y ago
  I think what they're saying is that when someone wants to use your password-locked device, they can threaten you with jail/obstruction of justice/beating/bullet, depending on where on the Law vs Chaos axis of the alignment chart they fall; you will then give them your password, and escape the extremely dangerous situation you found yourself in. With passkeys, unfortunately, they'll have to keep you around for all their exploits, and may need to regularly re-threaten/beat you into submission. In certain scenarios, there's such thing as too much security.
- NewJazz 2y ago
  Legally, you may not be compelled to provide a password. But the same is not quite as true for biometric attestations. First, a cop can physically use your face or finger to unlock your device without your consent. Second, legally they are allowed to compel you to unlock devices with these measures. https://reason.com/2024/04/19/appeals-court-rules-that-cops-can-physically-make-you-unlock-your-phone/ https://reason.com/2024/04/19/appeals-court-rules-that-cops-... https://www.eff.org/press/releases/eff-supreme-court-fifth-amendment-protects-people-being-forced-enter-or-hand-over https://www.eff.org/press/releases/eff-supreme-court-fifth-a...
- jvanderbot 2y ago
  Pointing out one good passkey implementation does not mean we should remove memorized secret non-physical passwords as security. A physical pass key can have all the biometrics in the world and be completely unprotected from law enforcement. Requiring multiple devices is useless if all devices can be unlocked with things I can see you carrying.
- withinboredom 2y ago
  On iPhones, simply holding the volume up and power button for five seconds disables Face ID just like a reboot. If you have that long, it’s all you need to do.
cyberax 2y ago
Passkeys are just fancy passwords and a password manager. So the security totally depends on how the password manager is implemented. Mine uses storage that is encrypted by a long password.
- AnotherGoodName 2y ago
  I prefer to describe them as a USB security key. Everyone knows how USB security keys work and now we have a slightly newer standard that new USB security keys use but also we can use devices with a TPM such as phones to avoid having to plug in a separate USB key. And now everyone's acting confused about it since there's also an optional ability to skip entering a password and just use the passkey in some circumstances but that part is not what a passkey is.
mPReDiToR 2y ago
https://onlykey.io/ https://onlykey.io/ Three PINs. One gives stored records (including auto-typing) and 2FA. One gives a second bank of records et al. The third is a duress key which wipes the device. Also, you can reflash your data to it from an encrypted backup in case you do use the duress PIN or lose the device. I think it's pretty cool to put the key in, type an eight digit code, then press a button to type my Amazon/GMail login page into a browser bar, enter username, enter password, wait for the page to load, then enter the 2FA. All automatically. Big love for this thing I wear as a dogtag 24/7.
- withinboredom 2y ago
  It says it is “open source”? Does that mean the firmware can be updated? One of the best things about yubikeys is that they cannot be updated. A physical device like this that can be updated seems like you are one exploit away.
raxxorraxor 2y ago
Agreed. I don't want my credentials tied to a device if that device isn't small and robust. The lifetime of my Yubikeys is at least 3 times that of my usual phone as well. And if they fail, I have recovery options. Apples/Googles ecosystems are intransparent and not really portable. Personally I am not really a fan of passkeys. Sure, login is hassle-free, but I am used to remember several passwords and their variants.

microtonal 2y ago

I am not sure what you are saying. If you use Apple's passkey implementation, you need to unlock your computer and when using a passkey confirm with Touch ID (or Face ID on iPhone). So, if you don't need to unlock your phone, computer, or internet accounts for law enforcement, they also can't get your passkeys. Using a USB stick as a passkey without authentication is just a bad idea. Ps. passkeys are end-to-end encrypted on Apple devices using iCloud keychain. Sure, Apple could push a software update that exfiltrates your passkeys, but in the end you need a trust anchor somewhere in the chain.

TeMPOraL 2y ago
I think what they're saying is that when someone wants to use your password-locked device, they can threaten you with jail/obstruction of justice/beating/bullet, depending on where on the Law vs Chaos axis of the alignment chart they fall; you will then give them your password, and escape the extremely dangerous situation you found yourself in. With passkeys, unfortunately, they'll have to keep you around for all their exploits, and may need to regularly re-threaten/beat you into submission. In certain scenarios, there's such thing as too much security.
NewJazz 2y ago
Legally, you may not be compelled to provide a password. But the same is not quite as true for biometric attestations. First, a cop can physically use your face or finger to unlock your device without your consent. Second, legally they are allowed to compel you to unlock devices with these measures. https://reason.com/2024/04/19/appeals-court-rules-that-cops-can-physically-make-you-unlock-your-phone/ https://reason.com/2024/04/19/appeals-court-rules-that-cops-... https://www.eff.org/press/releases/eff-supreme-court-fifth-amendment-protects-people-being-forced-enter-or-hand-over https://www.eff.org/press/releases/eff-supreme-court-fifth-a...
jvanderbot 2y ago
Pointing out one good passkey implementation does not mean we should remove memorized secret non-physical passwords as security. A physical pass key can have all the biometrics in the world and be completely unprotected from law enforcement. Requiring multiple devices is useless if all devices can be unlocked with things I can see you carrying.
withinboredom 2y ago
On iPhones, simply holding the volume up and power button for five seconds disables Face ID just like a reboot. If you have that long, it’s all you need to do.

cyberax 2y ago

Passkeys are just fancy passwords and a password manager. So the security totally depends on how the password manager is implemented. Mine uses storage that is encrypted by a long password.

AnotherGoodName 2y ago
I prefer to describe them as a USB security key. Everyone knows how USB security keys work and now we have a slightly newer standard that new USB security keys use but also we can use devices with a TPM such as phones to avoid having to plug in a separate USB key. And now everyone's acting confused about it since there's also an optional ability to skip entering a password and just use the passkey in some circumstances but that part is not what a passkey is.

mPReDiToR 2y ago

https://onlykey.io/ https://onlykey.io/ Three PINs. One gives stored records (including auto-typing) and 2FA. One gives a second bank of records et al. The third is a duress key which wipes the device. Also, you can reflash your data to it from an encrypted backup in case you do use the duress PIN or lose the device. I think it's pretty cool to put the key in, type an eight digit code, then press a button to type my Amazon/GMail login page into a browser bar, enter username, enter password, wait for the page to load, then enter the 2FA. All automatically. Big love for this thing I wear as a dogtag 24/7.

withinboredom 2y ago
It says it is “open source”? Does that mean the firmware can be updated? One of the best things about yubikeys is that they cannot be updated. A physical device like this that can be updated seems like you are one exploit away.

raxxorraxor 2y ago

Agreed. I don't want my credentials tied to a device if that device isn't small and robust. The lifetime of my Yubikeys is at least 3 times that of my usual phone as well. And if they fail, I have recovery options. Apples/Googles ecosystems are intransparent and not really portable. Personally I am not really a fan of passkeys. Sure, login is hassle-free, but I am used to remember several passwords and their variants.