5 ms·

So it adds no value over the long, randomly generated passwords from a password manager besides making a new standard and giving Microsoft a reason to push a ne

So it adds no value over the long, randomly generated passwords from a password manager besides making a new standard and giving Microsoft a reason to push a new dark pattern on users to force higher uptake rates of this new, bespoke standard with limited support?

Scion9066 2y ago
It's a standard supported by multiple parties, not just Microsoft, including multiple open source password managers. And it does provide some benefits: phishing protection (no shared secret that can be intercepted or given to the wrong party) and the service does not need to store as much sensitive information (don't need password hashes that could be leaked and cracked, just a public key).
- ndriscoll 2y ago
  Passwords are also a standard supported by pretty much everyone, and password managers (including those built into browsers) already generate long, unique, phishing resistant (it only prompts on the matching domain) passwords. The main difference I see with passkeys from a usability standpoint is that Firefox doesn't have built-in support for a software implementation, making them literally unusable for me.
  - TheNewsIsHere 2y ago
    Firefox does support passkeys but their native implementation is behind a feature flag. Beyond that Firefox add-ons (such as those for password managers) can enable support for their own purposes. For example 1Password can be used for passkeys in Firefox.
    - ndriscoll 2y ago
      I can't find that option's documentation. Do you have a link? The only documentation I've seen indicates that they only support hardware devices, and I don't own one.
- reginald78 2y ago
  Don't forgot the anti-features of: No ability to export your credentials.* Device attestation to allow blocking "undesirable" devices from authenticating and lock in purposes. *keypass was working on an export feature and there were already threats to use the attestation club to ban them from the landscape for not falling in line https://github.com/keepassxreboot/keepassxc/issues/10407#issuecomment-1994299617 https://github.com/keepassxreboot/keepassxc/issues/10407#iss...
  - UltraSane 2y ago
    creds that can't be exported can't be stolen. It is a tricky tradeoff.
    - calamity_elf 2y ago
      my credentials aren't mine if I can't securely back them up and secure them in a platform independent way. That attack on KeepassXC is despicable.
      - UltraSane 2y ago
        If you own the device the credits are stored on then they are yours.
        nullfield 2y ago
        This very much falls into the same box as “not your keys, not your crypto”: if you’re forced to trust someone else to manage the keys for you then they have them - necessarily, in order to permit “transfer” (under this scheme, not everything) to another party - in plaintext, while you’re not allowed to “for your own good”, then you’ve lost it all. They can: 1. Impersonate you, gaining access to anything your keys unlock 1.a. Impersonate you, claiming to be you in a violation of “key use enables non-repudiation” 2. Deny you the ability to use your keys 2.a. Change any of your keys, locking you out of things 3. Deny you the ability to transfer your keys to anyone they “don’t like” 3. Provide your keys to anyone else, e.g. “with a court order” 3.a. Anyone “benefitting” under (3) can then do (1(a)) …and surely more Bad Things. Every single time “passkeys” seems to like “okay, maybe”… some fucktards pull another one of these. Then I go, “okay, ssh keys, PIV, or whatever else is Just Fine, and these people who are either state agents, idiots, or power hungry idiots working to advance total control over humans with lack of freedom and no way back can go die, or as an alternative be sentenced to serious computer-things-reeducation”. …and I kinda mean it. There are certain things you just don’t come back from, as a society, etc. and I just won’t support it. You only get one chance not to.
vel0city 2y ago
When you log into a site with a password, you're needing to transmit your actual password over the wire. Sure, you'll hopefully have encryption when sending that credential over, but in the end you'll be exchanging your actual password with some remote service. That remote service might be misconfigured, it might be misdesigned, it might be under attacker control. Now they have your whole credential. A passkey doesn't transmit your actual, full, repeatable credential over the wire. It's a challenge-response protocol, so only that one authenticated session would be intercepted. Kill all questionable sessions and you're good, they're not reusing it.
jon-wood 2y ago
Passkeys include a key that the website you're logging in to holds, if a site can't present that key then the passkey doesn't work, meaning phishing attacks no longer work because 0utlook.com doesn't have the key that outlook.com holds.
UltraSane 2y ago
Passkeys are tied to a specific website and can only be used for signing in on the website they were created for.
Ajedi32 2y ago
> randomly generated passwords from a password manager are impossible to enforce. If you present users with password field, a sizable percentage of them will just manually type in the same weak, compromised password that they've used on every other site they've ever created an account on in their life. Passkeys are much harder to misuse. That's where 99% of their value is. Yes there are also other advantages, like the fact that passkeys use public key cryptography, but those are tiny compared to the human factors improvements.

Scion9066 2y ago

It's a standard supported by multiple parties, not just Microsoft, including multiple open source password managers. And it does provide some benefits: phishing protection (no shared secret that can be intercepted or given to the wrong party) and the service does not need to store as much sensitive information (don't need password hashes that could be leaked and cracked, just a public key).

ndriscoll 2y ago
Passwords are also a standard supported by pretty much everyone, and password managers (including those built into browsers) already generate long, unique, phishing resistant (it only prompts on the matching domain) passwords. The main difference I see with passkeys from a usability standpoint is that Firefox doesn't have built-in support for a software implementation, making them literally unusable for me.
- TheNewsIsHere 2y ago
  Firefox does support passkeys but their native implementation is behind a feature flag. Beyond that Firefox add-ons (such as those for password managers) can enable support for their own purposes. For example 1Password can be used for passkeys in Firefox.
  - ndriscoll 2y ago
    I can't find that option's documentation. Do you have a link? The only documentation I've seen indicates that they only support hardware devices, and I don't own one.
reginald78 2y ago
Don't forgot the anti-features of: No ability to export your credentials.* Device attestation to allow blocking "undesirable" devices from authenticating and lock in purposes. *keypass was working on an export feature and there were already threats to use the attestation club to ban them from the landscape for not falling in line https://github.com/keepassxreboot/keepassxc/issues/10407#issuecomment-1994299617 https://github.com/keepassxreboot/keepassxc/issues/10407#iss...
- UltraSane 2y ago
  creds that can't be exported can't be stolen. It is a tricky tradeoff.
  - calamity_elf 2y ago
    my credentials aren't mine if I can't securely back them up and secure them in a platform independent way. That attack on KeepassXC is despicable.
    - UltraSane 2y ago
      If you own the device the credits are stored on then they are yours.
      - nullfield 2y ago
        This very much falls into the same box as “not your keys, not your crypto”: if you’re forced to trust someone else to manage the keys for you then they have them - necessarily, in order to permit “transfer” (under this scheme, not everything) to another party - in plaintext, while you’re not allowed to “for your own good”, then you’ve lost it all. They can: 1. Impersonate you, gaining access to anything your keys unlock 1.a. Impersonate you, claiming to be you in a violation of “key use enables non-repudiation” 2. Deny you the ability to use your keys 2.a. Change any of your keys, locking you out of things 3. Deny you the ability to transfer your keys to anyone they “don’t like” 3. Provide your keys to anyone else, e.g. “with a court order” 3.a. Anyone “benefitting” under (3) can then do (1(a)) …and surely more Bad Things. Every single time “passkeys” seems to like “okay, maybe”… some fucktards pull another one of these. Then I go, “okay, ssh keys, PIV, or whatever else is Just Fine, and these people who are either state agents, idiots, or power hungry idiots working to advance total control over humans with lack of freedom and no way back can go die, or as an alternative be sentenced to serious computer-things-reeducation”. …and I kinda mean it. There are certain things you just don’t come back from, as a society, etc. and I just won’t support it. You only get one chance not to.

vel0city 2y ago

When you log into a site with a password, you're needing to transmit your actual password over the wire. Sure, you'll hopefully have encryption when sending that credential over, but in the end you'll be exchanging your actual password with some remote service. That remote service might be misconfigured, it might be misdesigned, it might be under attacker control. Now they have your whole credential. A passkey doesn't transmit your actual, full, repeatable credential over the wire. It's a challenge-response protocol, so only that one authenticated session would be intercepted. Kill all questionable sessions and you're good, they're not reusing it.

jon-wood 2y ago

Passkeys include a key that the website you're logging in to holds, if a site can't present that key then the passkey doesn't work, meaning phishing attacks no longer work because 0utlook.com doesn't have the key that outlook.com holds.

UltraSane 2y ago

Passkeys are tied to a specific website and can only be used for signing in on the website they were created for.

Ajedi32 2y ago

> randomly generated passwords from a password manager are impossible to enforce. If you present users with password field, a sizable percentage of them will just manually type in the same weak, compromised password that they've used on every other site they've ever created an account on in their life. Passkeys are much harder to misuse. That's where 99% of their value is. Yes there are also other advantages, like the fact that passkeys use public key cryptography, but those are tiny compared to the human factors improvements.