4 ms·

Most implementations sync passkeys to the respective clouds.

hulitu 2y ago
> Most implementations sync passkeys to the respective clouds. So, in the end, the old Microsoft mantra: "Your security is very important for us". Besides Microsoft, NSA, CIA, the five eyes and friends, no one has access to your passkey, this means is secure.
- acdha 2y ago
  No. If you read the documentation, they only synchronize encrypted data.
ghusto 2y ago
Do the keys need passwords to work, or is the key itself sufficient? i.e. Is it like an SSH key without or with a password?
- TheNewsIsHere 2y ago
  The key itself, but the standard explicitly supports platforms, browsers, or password managers handling authentication to permit key use. For example you can have a passkey where the private key is on a security token protected with a PIN or biometry. You can have a private key live in a secure element on an endpoint too. You could make a browser plugin that requires no auth whatsoever if you wished.
- WorldMaker 2y ago
  It depends on who is running your keys for you. Most of the vendors (Apple, Google, Microsoft) are using device-specific (hardware) keys to unlock the passkeys, which generally means that transitively you've first logged in with Face ID, Touch ID, Android Gesture, Windows Hello, PIN or one of the other names or brand names for "device-specific pass code or biometric" that unlocks your device's hardware security enclave. In your analogy terms it is akin to an SSH key stored on a hardware device like a Yubikey that you have to "push the button" to unlock. It is more secure than just an SSH key without a password, but depending on a lot of factors, including your personal threat model, may be more or less secure than an SSH key with a strong password. (You'd assume the Yubikey's unexportable hardware key is a lot stronger to break than any password, so it is potentially far more secure from brute force attacks, especially remote attacks with no physical access to try to export an unexportable key. It's reliant on physical device security so it is far more weak to "in the room"/"over the shoulder" attacks. At the end of the day most people's threat model is somewhere in the middle of the two extremes.) Of course if you decide to use a password manager like 1Password or BitWarden those passkeys are going to be locked behind your "master vault password" in a similar way to your other passwords.
criddell 2y ago
Is there a fallback for when the respective cloud services are unavailable?
crazygringo 2y ago
How do I log into that cloud account? Since I can't do it recursively with a passkey stored in it, can I? And what if that cloud account decides to cut off my access?
- growse 2y ago
  Buy a yubikey. Use a password manager that supports passkeys. Enroll multiple credentials with your cloud account.
  - crazygringo 2y ago
    This is sounding more and more complicated. I don't want a Yubikey. How does a password manager help my cloud account? What does enrolling multiple credentials even mean?
    - growse 2y ago
      > How does a password manager help my cloud account? It's an alternative place to store webauthn credentials, if you're worried about being locked out. > What does enrolling multiple credentials even mean? You register multiple passskeys for your account on a service. So if you lose access to one (because you yoinked your phone into orbit), you can use the other one. It's as complicated as you want to make it.
  - Pooge 2y ago
    > Use a password manager that supports passkeys If the user is, what's the point of having passkeys? One using a password manager has (strong) passwords generated for them... First time I'm hearing about removing passwords and it sounds like they're implementing an even worse idea.
    - growse 2y ago
      Password managers don't stop you pasting that password into any random textfield on any website.
prmoustache 2y ago
Anything that depends on a cloud service where your account can be destroyed any time without any recourse because support is managed by bots is a no go.
- Wowfunhappy 2y ago
  Personally, I'm comfortable with cloud services, but only if I have some sort of backup strategy. I store all my passwords in Bitwarden. One reason I use Bitwarden (as opposed to e.g. Keypass) is because it has cloud syncing. All of my passwords are synced between all of my devices. Critically, however, if Bitwarden's server was to disappear tomorrow, it wouldn't destroy my life. My passwords would still be stored locally, so I could open Bitwarden and export them, then import them into another service. Passkey by design have no solution this! That means I can't trust them! I need to be able to export all of my credentials to some type of local file, which can be transferred to a new machine or service without the cloud, as a failsafe. I don't care if this is less secure, because my Bitwarden setup is already very secure, and I am much more scared of being locked out of my own accounts than of someone else getting in.

> Most implementations sync passkeys to the respective clouds. So, in the end, the old Microsoft mantra: "Your security is very important for us". Besides Microsoft, NSA, CIA, the five eyes and friends, no one has access to your passkey, this means is secure.

acdha 2y ago
No. If you read the documentation, they only synchronize encrypted data.

ghusto 2y ago

Do the keys need passwords to work, or is the key itself sufficient? i.e. Is it like an SSH key without or with a password?

TheNewsIsHere 2y ago
The key itself, but the standard explicitly supports platforms, browsers, or password managers handling authentication to permit key use. For example you can have a passkey where the private key is on a security token protected with a PIN or biometry. You can have a private key live in a secure element on an endpoint too. You could make a browser plugin that requires no auth whatsoever if you wished.
WorldMaker 2y ago
It depends on who is running your keys for you. Most of the vendors (Apple, Google, Microsoft) are using device-specific (hardware) keys to unlock the passkeys, which generally means that transitively you've first logged in with Face ID, Touch ID, Android Gesture, Windows Hello, PIN or one of the other names or brand names for "device-specific pass code or biometric" that unlocks your device's hardware security enclave. In your analogy terms it is akin to an SSH key stored on a hardware device like a Yubikey that you have to "push the button" to unlock. It is more secure than just an SSH key without a password, but depending on a lot of factors, including your personal threat model, may be more or less secure than an SSH key with a strong password. (You'd assume the Yubikey's unexportable hardware key is a lot stronger to break than any password, so it is potentially far more secure from brute force attacks, especially remote attacks with no physical access to try to export an unexportable key. It's reliant on physical device security so it is far more weak to "in the room"/"over the shoulder" attacks. At the end of the day most people's threat model is somewhere in the middle of the two extremes.) Of course if you decide to use a password manager like 1Password or BitWarden those passkeys are going to be locked behind your "master vault password" in a similar way to your other passwords.

criddell 2y ago

Is there a fallback for when the respective cloud services are unavailable?

crazygringo 2y ago

How do I log into that cloud account? Since I can't do it recursively with a passkey stored in it, can I? And what if that cloud account decides to cut off my access?

growse 2y ago
Buy a yubikey. Use a password manager that supports passkeys. Enroll multiple credentials with your cloud account.
- crazygringo 2y ago
  This is sounding more and more complicated. I don't want a Yubikey. How does a password manager help my cloud account? What does enrolling multiple credentials even mean?
  - growse 2y ago
    > How does a password manager help my cloud account? It's an alternative place to store webauthn credentials, if you're worried about being locked out. > What does enrolling multiple credentials even mean? You register multiple passskeys for your account on a service. So if you lose access to one (because you yoinked your phone into orbit), you can use the other one. It's as complicated as you want to make it.
- Pooge 2y ago
  > Use a password manager that supports passkeys If the user is, what's the point of having passkeys? One using a password manager has (strong) passwords generated for them... First time I'm hearing about removing passwords and it sounds like they're implementing an even worse idea.
  - growse 2y ago
    Password managers don't stop you pasting that password into any random textfield on any website.

prmoustache 2y ago

Anything that depends on a cloud service where your account can be destroyed any time without any recourse because support is managed by bots is a no go.

Wowfunhappy 2y ago
Personally, I'm comfortable with cloud services, but only if I have some sort of backup strategy. I store all my passwords in Bitwarden. One reason I use Bitwarden (as opposed to e.g. Keypass) is because it has cloud syncing. All of my passwords are synced between all of my devices. Critically, however, if Bitwarden's server was to disappear tomorrow, it wouldn't destroy my life. My passwords would still be stored locally, so I could open Bitwarden and export them, then import them into another service. Passkey by design have no solution this! That means I can't trust them! I need to be able to export all of my credentials to some type of local file, which can be transferred to a new machine or service without the cloud, as a failsafe. I don't care if this is less secure, because my Bitwarden setup is already very secure, and I am much more scared of being locked out of my own accounts than of someone else getting in.