6 ms·

Another option is to use a password manager that supports passkeys, such as BitWarden. You can even host it locally, behind a VPN, if you don't trust the threat

Another option is to use a password manager that supports passkeys, such as BitWarden. You can even host it locally, behind a VPN, if you don't trust the threat modelling of their hosted version. Then, it's a case of installing BitWarden on any devices you want to use to login, protected with a strong password and 2FA.

TheSpiceIsLife 2y ago
I don’t understand the benefit of using passkeys in a password manager. If the password manager is unlocked, I get logged in automatically anyways.
- ahofmann 2y ago
  1. Passkeys are unique, so no more password stuffing attacks. 2. Passkeys can't be to short, in contrast to passwords Passkeys essentially remove almost all risks for websites and moves them to the user (lost passkey, attacks on their password managers). It is not perfect, but it removes a lot of problems that we have right now (like more than a billion leaked passwords in the wild)
  - simfree 2y ago
    So it adds no value over the long, randomly generated passwords from a password manager besides making a new standard and giving Microsoft a reason to push a new dark pattern on users to force higher uptake rates of this new, bespoke standard with limited support?
    - Scion9066 2y ago
      It's a standard supported by multiple parties, not just Microsoft, including multiple open source password managers. And it does provide some benefits: phishing protection (no shared secret that can be intercepted or given to the wrong party) and the service does not need to store as much sensitive information (don't need password hashes that could be leaked and cracked, just a public key).
      - ndriscoll 2y ago
        Passwords are also a standard supported by pretty much everyone, and password managers (including those built into browsers) already generate long, unique, phishing resistant (it only prompts on the matching domain) passwords. The main difference I see with passkeys from a usability standpoint is that Firefox doesn't have built-in support for a software implementation, making them literally unusable for me.
        TheNewsIsHere 2y ago
        Firefox does support passkeys but their native implementation is behind a feature flag. Beyond that Firefox add-ons (such as those for password managers) can enable support for their own purposes. For example 1Password can be used for passkeys in Firefox.
        ndriscoll 2y ago
        I can't find that option's documentation. Do you have a link? The only documentation I've seen indicates that they only support hardware devices, and I don't own one.
      - reginald78 2y ago
        Don't forgot the anti-features of: No ability to export your credentials.* Device attestation to allow blocking "undesirable" devices from authenticating and lock in purposes. *keypass was working on an export feature and there were already threats to use the attestation club to ban them from the landscape for not falling in line https://github.com/keepassxreboot/keepassxc/issues/10407#issuecomment-1994299617 https://github.com/keepassxreboot/keepassxc/issues/10407#iss...
        UltraSane 2y ago
        creds that can't be exported can't be stolen. It is a tricky tradeoff.
        2y ago
    - vel0city 2y ago
      When you log into a site with a password, you're needing to transmit your actual password over the wire. Sure, you'll hopefully have encryption when sending that credential over, but in the end you'll be exchanging your actual password with some remote service. That remote service might be misconfigured, it might be misdesigned, it might be under attacker control. Now they have your whole credential. A passkey doesn't transmit your actual, full, repeatable credential over the wire. It's a challenge-response protocol, so only that one authenticated session would be intercepted. Kill all questionable sessions and you're good, they're not reusing it.
    - jon-wood 2y ago
      Passkeys include a key that the website you're logging in to holds, if a site can't present that key then the passkey doesn't work, meaning phishing attacks no longer work because 0utlook.com doesn't have the key that outlook.com holds.
    - UltraSane 2y ago
      Passkeys are tied to a specific website and can only be used for signing in on the website they were created for.
    - Ajedi32 2y ago
      > randomly generated passwords from a password manager are impossible to enforce. If you present users with password field, a sizable percentage of them will just manually type in the same weak, compromised password that they've used on every other site they've ever created an account on in their life. Passkeys are much harder to misuse. That's where 99% of their value is. Yes there are also other advantages, like the fact that passkeys use public key cryptography, but those are tiny compared to the human factors improvements.
  - hulitu 2y ago
    > Passkeys are unique, so no more password stuffing attacks. Just like passwords. What is the difference ? > Passkeys can't be to short, in contrast to passwords So a "long password" is a "passkey" ?
    - TheNewsIsHere 2y ago
      >> Passkeys are unique, so no more password stuffing attacks. > Just like passwords. What is the difference ? >> Passkeys can't be to short, in contrast to passwords > So a "long password" is a "passkey" ? Of course not. Passkeys are effectively just key pairs defined by a FIDO standard. It’s much more productive to think of passkeys as mutual certificate authentication designed for use by the masses. If you’ve ever used a Yubikey for primary authentication, you’ve already used a passkey.
      - skydhash 2y ago
        The issue is tying it to a device that can be easily lost. Yubikeys can be easily hidden and are not thief magnets.
        TheNewsIsHere 2y ago
        Yep, you ideally don’t have your only key/copy of the key on any one device. That’s why the mainstream implementations are synced. Or why you have an extra Yubikey.
    - ahofmann 2y ago
      I really don't know how you're able to come up with the idea, that passwords are unique. They are in no aspect whatsoever unique. You as a user can try to use passwords, that are unique to you. That doesn't (can't and shouldn't) mean, that those passwords are unique against the database of a website, or other services.
  - keybored 2y ago
    > 1. Passkeys are unique, so no more password stuffing attacks. Not really relevant for password manager users. > 2. Passkeys can't be to short, in contrast to passwords Not really relevant for password manager users.
    - Ajedi32 2y ago
      ~90% of people who are presented with a password input field are not and never will be "password manager users". 100% of people presented with a passkey prompt are, because the very nature of passkeys is that they're stored in what is effectively a password manager.
      - keybored 2y ago
        > > I don’t understand the benefit of using passkeys in a password manager. Echoed in his ears.
        Ajedi32 2y ago
        Ah, I think I misunderstood that comment. From a global perspective "the benefit" compared to using passwords in a password manager is indeed exactly what I said, but I guess that user was asking more about the personal benefit on an individual level. From that perspective it just makes the UX slightly smoother and makes it impossible for the site to screw up and leak your plaintext creds. Other than that yeah there's not a big difference compared to using an autofilled, unique, randomly generated password. Which is good, because eventually sites are going to start phasing out that latter option for the exact reasons I outlined in my previous comment.
    - growse 2y ago
      Ah yes, the good old "only an issue for people who are holding it wrong" argument. The thing about good design is that it makes it impossible to "hold it wrong".
      - keybored 2y ago
- stetrain 2y ago
  With a password manager storing unique passwords, your password is still being sent over the network to that website each time you log in. With a password manager storing passkeys, your private passkey is not transmitted as part of the website request. It can't be intercepted or accidentally/negligently stored in plaintext in a database or server logs. You still have to trust the secure syncing of your passkeys, just like you do with passwords, but there are still fewer threat vectors than with passwords.
  - maeil 2y ago
    This covers a negligible percentage of all hacked accounts and is at best a tiny part of what passkeys are supposed to solve.
    - w0m 2y ago
      same argument/logic works to justify not wearing seat belts or hell, not outlawing murder. "Won't stop/save everyone so not worth doing".
    - acdha 2y ago
      It’s more than you think: if I can convince you to type in your Google password at g00gl3.com I can turn around and use that password for the real server. Passkeys block that attack.
      - happymellon 2y ago
        So they couldn't convince everyone to give up their privacy and use Facebook or Google to track our logins to other websites via "Login With", and this is a new way?
        acdha 2y ago
        If by new you mean a completely different mechanism which does not share the privacy considerations of a single sign on service, yes. If you care about privacy, passkeys are a much better option.

TheSpiceIsLife 2y ago

I don’t understand the benefit of using passkeys in a password manager. If the password manager is unlocked, I get logged in automatically anyways.

ahofmann 2y ago
1. Passkeys are unique, so no more password stuffing attacks. 2. Passkeys can't be to short, in contrast to passwords Passkeys essentially remove almost all risks for websites and moves them to the user (lost passkey, attacks on their password managers). It is not perfect, but it removes a lot of problems that we have right now (like more than a billion leaked passwords in the wild)
- simfree 2y ago
  So it adds no value over the long, randomly generated passwords from a password manager besides making a new standard and giving Microsoft a reason to push a new dark pattern on users to force higher uptake rates of this new, bespoke standard with limited support?
  - Scion9066 2y ago
    It's a standard supported by multiple parties, not just Microsoft, including multiple open source password managers. And it does provide some benefits: phishing protection (no shared secret that can be intercepted or given to the wrong party) and the service does not need to store as much sensitive information (don't need password hashes that could be leaked and cracked, just a public key).
    - ndriscoll 2y ago
      Passwords are also a standard supported by pretty much everyone, and password managers (including those built into browsers) already generate long, unique, phishing resistant (it only prompts on the matching domain) passwords. The main difference I see with passkeys from a usability standpoint is that Firefox doesn't have built-in support for a software implementation, making them literally unusable for me.
      - TheNewsIsHere 2y ago
        Firefox does support passkeys but their native implementation is behind a feature flag. Beyond that Firefox add-ons (such as those for password managers) can enable support for their own purposes. For example 1Password can be used for passkeys in Firefox.
        ndriscoll 2y ago
        I can't find that option's documentation. Do you have a link? The only documentation I've seen indicates that they only support hardware devices, and I don't own one.
    - reginald78 2y ago
      Don't forgot the anti-features of: No ability to export your credentials.* Device attestation to allow blocking "undesirable" devices from authenticating and lock in purposes. *keypass was working on an export feature and there were already threats to use the attestation club to ban them from the landscape for not falling in line https://github.com/keepassxreboot/keepassxc/issues/10407#issuecomment-1994299617 https://github.com/keepassxreboot/keepassxc/issues/10407#iss...
      - UltraSane 2y ago
        creds that can't be exported can't be stolen. It is a tricky tradeoff.
        2y ago
  - vel0city 2y ago
    When you log into a site with a password, you're needing to transmit your actual password over the wire. Sure, you'll hopefully have encryption when sending that credential over, but in the end you'll be exchanging your actual password with some remote service. That remote service might be misconfigured, it might be misdesigned, it might be under attacker control. Now they have your whole credential. A passkey doesn't transmit your actual, full, repeatable credential over the wire. It's a challenge-response protocol, so only that one authenticated session would be intercepted. Kill all questionable sessions and you're good, they're not reusing it.
  - jon-wood 2y ago
    Passkeys include a key that the website you're logging in to holds, if a site can't present that key then the passkey doesn't work, meaning phishing attacks no longer work because 0utlook.com doesn't have the key that outlook.com holds.
  - UltraSane 2y ago
    Passkeys are tied to a specific website and can only be used for signing in on the website they were created for.
  - Ajedi32 2y ago
    > randomly generated passwords from a password manager are impossible to enforce. If you present users with password field, a sizable percentage of them will just manually type in the same weak, compromised password that they've used on every other site they've ever created an account on in their life. Passkeys are much harder to misuse. That's where 99% of their value is. Yes there are also other advantages, like the fact that passkeys use public key cryptography, but those are tiny compared to the human factors improvements.
- hulitu 2y ago
  > Passkeys are unique, so no more password stuffing attacks. Just like passwords. What is the difference ? > Passkeys can't be to short, in contrast to passwords So a "long password" is a "passkey" ?
  - TheNewsIsHere 2y ago
    >> Passkeys are unique, so no more password stuffing attacks. > Just like passwords. What is the difference ? >> Passkeys can't be to short, in contrast to passwords > So a "long password" is a "passkey" ? Of course not. Passkeys are effectively just key pairs defined by a FIDO standard. It’s much more productive to think of passkeys as mutual certificate authentication designed for use by the masses. If you’ve ever used a Yubikey for primary authentication, you’ve already used a passkey.
    - skydhash 2y ago
      The issue is tying it to a device that can be easily lost. Yubikeys can be easily hidden and are not thief magnets.
      - TheNewsIsHere 2y ago
        Yep, you ideally don’t have your only key/copy of the key on any one device. That’s why the mainstream implementations are synced. Or why you have an extra Yubikey.
  - ahofmann 2y ago
    I really don't know how you're able to come up with the idea, that passwords are unique. They are in no aspect whatsoever unique. You as a user can try to use passwords, that are unique to you. That doesn't (can't and shouldn't) mean, that those passwords are unique against the database of a website, or other services.
- keybored 2y ago
  > 1. Passkeys are unique, so no more password stuffing attacks. Not really relevant for password manager users. > 2. Passkeys can't be to short, in contrast to passwords Not really relevant for password manager users.
  - Ajedi32 2y ago
    ~90% of people who are presented with a password input field are not and never will be "password manager users". 100% of people presented with a passkey prompt are, because the very nature of passkeys is that they're stored in what is effectively a password manager.
    - keybored 2y ago
      > > I don’t understand the benefit of using passkeys in a password manager. Echoed in his ears.
      - Ajedi32 2y ago
        Ah, I think I misunderstood that comment. From a global perspective "the benefit" compared to using passwords in a password manager is indeed exactly what I said, but I guess that user was asking more about the personal benefit on an individual level. From that perspective it just makes the UX slightly smoother and makes it impossible for the site to screw up and leak your plaintext creds. Other than that yeah there's not a big difference compared to using an autofilled, unique, randomly generated password. Which is good, because eventually sites are going to start phasing out that latter option for the exact reasons I outlined in my previous comment.
  - growse 2y ago
    Ah yes, the good old "only an issue for people who are holding it wrong" argument. The thing about good design is that it makes it impossible to "hold it wrong".
    - keybored 2y ago
stetrain 2y ago
With a password manager storing unique passwords, your password is still being sent over the network to that website each time you log in. With a password manager storing passkeys, your private passkey is not transmitted as part of the website request. It can't be intercepted or accidentally/negligently stored in plaintext in a database or server logs. You still have to trust the secure syncing of your passkeys, just like you do with passwords, but there are still fewer threat vectors than with passwords.
- maeil 2y ago
  This covers a negligible percentage of all hacked accounts and is at best a tiny part of what passkeys are supposed to solve.
  - w0m 2y ago
    same argument/logic works to justify not wearing seat belts or hell, not outlawing murder. "Won't stop/save everyone so not worth doing".
  - acdha 2y ago
    It’s more than you think: if I can convince you to type in your Google password at g00gl3.com I can turn around and use that password for the real server. Passkeys block that attack.
    - happymellon 2y ago
      So they couldn't convince everyone to give up their privacy and use Facebook or Google to track our logins to other websites via "Login With", and this is a new way?
      - acdha 2y ago
        If by new you mean a completely different mechanism which does not share the privacy considerations of a single sign on service, yes. If you care about privacy, passkeys are a much better option.