8 ms·

I think you’re letting your emotions distract from the larger picture where millions of people are compromised on a regular basis because they use systems desig

by acdha 2y ago

I think you’re letting your emotions distract from the larger picture where millions of people are compromised on a regular basis because they use systems designed the way you want. Knowledge-based access is inherently problematic: if you don’t police passwords, most people will be compromised because they use weak and/or shared passwords. If you use strong passwords, you’re also screwed if you lose your phone so you’re in the same reset game with trivia questions which are increasingly weak because they can be answered from information on Facebook/LinkedIn or from breaches from other companies which used the same question. New logins from previously unused devices in a new part of the world shouldn’t work anyway because that’s indistinguishable from a successful attack. Passkeys avoid all of that, but you need backups either in the form of a Yubikey or a recovery code in your wallet. Yes, that’s annoying but there is no world where nobody is annoyed, so it should be a question of whether more people are inconvenienced by their accounts being breached versus traveling and losing all of their devices but still being able to remember their strong passwords.

dboreham 2y ago
Of you have a Yubikey why do you need to use passkeys (which are essentially software emulation of a Yubikey).
- superfrank 2y ago
  Because the vast majority of users don't want to bring a yubikey with them everywhere they go.
  - nijave 2y ago
    I'm curious if that's really true. I've had a Yubikey in my keyring for years and it's pretty convenient. It's smaller than my car key and isn't very noticeable. I have the NFC enabled variant so it can be used with a mobile phone
    - mebizzle 2y ago
      I don't have a keyring or a car key anymore so any additional physical object to carry is less convenient.
    - dymk 2y ago
      Yes, it's really true. How many of your friends and family members carry around a yubikey?
      - nijave 2y ago
        The technically savvy do. The others don't but not because they don't want to--they don't know they exist. Everyone I know carries around NFC devices--either work badges or credit cards. I don't see how having an extra NFC device in addition to the multiple ones you already have is a burden.
        doublerabbit 2y ago
        I'm technically savvy. I don't nor want to own one. Why should I be forced to pay for a YubiKey? €60 is a fair chunk of money. Maybe buy me one I'll consider it otherwise I'm not convinced. I will once corporate gives me free open-source hardware.
        superfrank 2y ago
        I'm an EM at a large tech company. Spent a decade as a developer. I have a Yubikey for work and I hate it. I understand why I need it and the value it provides, but I hate having to cary around one more thing. The fact that this user thinks the average person would be happy to have to cary one around is wildly out of touch.
        dymk 2y ago
        > The technically savvy do. That's my point. Yubikey doesn't pass the grandma test. Your everyday user isn't going to be carrying one around anytime soon.
  - lxgr 2y ago
    The much bigger problem is that you also need to enroll a second Yubikey into every service you use, but also safely store that backup key somewhere, ideally outside your own house. That's just not realistic. Yubico had some ideas around "paired Yubikeys" which shared the same root secret, but I believe that model won't work anymore with FIDO/CTAP2 due to some counter value that was added there over U2F. (It might be possible for them to just not have a security counter; I'm not sure.)
  - wkat4242 2y ago
    I have mine on my keyring. Not sure what the big problem is there. The bigger issue with yubikeys is that you need more than one in case you lose one. And most sites only allow one passkey per account because all the mobile implementations can sync the private key. Yubikeys can't and that's actually a good thing because it makes them unique and eliminates the whole sync mechanism as an attack plane.
    - iggldiggl 2y ago
      > And most sites only allow one passkey per account because all the mobile implementations can sync the private key. Even when/if sites do allow multipe passkeys per account, the fundamental contradiction remains: Your backup key(s) are supposed to be kept somewhere secure where they won't get lost, stolen or destroyed, which ideally means some sort of off-site backup (at your bank or whereever), but at the same time every time you register for a new service you do need to register all your backup keys, too.
      - wkat4242 2y ago
        True. That is a problem. Especially because with Webauthn you can't just enrol a public key. It's one of the reasons I like openpgp for authentication e.g. over SSH. I can just give it a list of public keys to accept without having all those keys actually to hand.
- acdha 2y ago
  Backups are good. If some guy grabs my phone, he doesn’t automatically get the Yubikey at the same time. The same is true if my phone is damaged.
- pseudosavant 2y ago
  Because I already have a device in my pocket that can easily do that "software emulation" that I'm less likely to lose, and it has a tracking ability?
seethishat 2y ago
Knowledge-based access (something only stored in your head) has Constitutional protection in the United States. The same is probably not true for physical things such as phones and YubiKeys stored in your pocket. Not that I worry about that, but it is worth pointing out that you may lose some legal protections when you use physical things rather than your knowledge.
- acdha 2y ago
  I have the most amazing coincidence to report about what protects my phone and Yubikeys.
  - seethishat 2y ago
    Unfortunately, the forensic devices that easily extract data from your phone, can't be plugged into your head.
    - acdha 2y ago
      According to the manufacturers, those forensic devices also don’t work on my iPhone unless it’s unlocked with a password, but this is also irrelevant because they can get the stored passwords from the same phone in any scenario where they can access the passkey. More to the point, this is also not what the average computer user is worried about. It assumes that they’re targeted by police, have something they need to keep secret, and that those police can compel physical access but scrupulously obey civil rights protections.
- nijave 2y ago
  Do you have a source for this? As far as I know, it's at best a legal gray area. I believe in most cases you'll still be held in contempt of court for not producing secrets needed to access information which the authorities have a warrant for. Additionally, it's a bit silly in the context of email since the authorities will obtain it from the service provider anyway. That said, you can still add an encryption key to your phone and you're back to "knowledge based" with the additional caveat a thief would also need the hardware as well.
mort96 2y ago
Locking people out of their accounts is pretty much a worst case scenario. It's so bad that services with passkeys generally don't want to risk it, hence the knowledge-based recovery options. Which makes passkeys mere convenience rather than extra security.
lolinder 2y ago
> Passkeys avoid all of that, but you need backups either in the form of a Yubikey or a recovery code in your wallet. Yes, that’s annoying but there is no world where nobody is annoyed... We're not talking about annoyance here, we're talking about data breaches on the one hand and permanent account lockouts on the other. There is no world where the majority of people remember distinct passwords for each service, and there's likewise no world where the majority of users carry a Yubikey or even download their recovery codes at all, much less carry them with them. So we're left really with two choices at the extremes: do we go for the failure mode where people reuse passwords and lose money and data that way, or the failure mode where a company is physically incapable of restoring a customer's account? Given the choice between these extremes, companies will always choose the former. Now, these extremes aren't the only choices, but then you get to the crux of OP's argument: passkeys stored in a password manager aren't any more secure in practical terms than random passwords stored in a password manager. Your auth system is only as secure as its recovery mechanism (which is the observation that led Slack to initially not bother with passwords at all). There's one way in which I disagree with op, which is that passkeys prevent users from typing in a password and storing it in the password manager, which many users do—they effectively enforce random passwords rather than it being just a best practice that needs to be taught.
- jt2190 2y ago
  > [D]o we go for the failure mode where people reuse passwords and lose money and data that way, or the failure mode where a company is physically incapable of restoring a customer's account? Are you sure that Microsoft’s solution means that they are “physically incapable of restoring a customer’s account?” Apple’s system keeps copies of recovery keys in their cloud [1], unless you explicitly tell them not to do this. It seems like a reasonable compromise for most people’s security needs. [1] Or effectively something like that.
  - lolinder 2y ago
    I get to that, but as I said above you've now compromised the security of the passkey system, which means your passkeys are actually only as secure as your recovery mechanism, and for convenience sake that recovery mechanism is usually quite insecure.
OptionX 2y ago
So passwords are bad because users can't be trusted to chose strong passwords but for passkeys they suddenly are trusted to keep secure, comprehensive, backups?
- dsego 2y ago
  Passwords can be phished, all you need is a convincing fake login form.
- acdha 2y ago
  Passwords are bad because normal people can’t remember strong passwords AND because they can be phished or leaked. Phishing is the most commonly-mentioned benefit for passkeys because it’s widespread and cannot be eliminated from a password-based system. “Secure, comprehensive backups” sounds scary until you remember that it’s only ever meant not disabling a checkbox for iCloud, Google, or Microsoft users.
  - 0cf8612b2e1e 2y ago
    What if my house burns down? How do I convince Google it’s me, please give me my passkeys back? Call customer support? Any solution which does not allow me full autonomy to maintain a backup is not acceptable.
    - kbelder 2y ago
      This is it. Any security solution has to be under control of the individual. Otherwise it's just another insecurity. Not from the company's perspective, from the individual's.
    - XorNot 2y ago
      The glee with which people say "and it's on your phone!" is what gets me. Right: it's on the small device I take everywhere and use for everything. The one most likely to get lost, stolen or completely destroyed, and absolutely has to be replaced in about 5 years. That device. You want to permanently lock data to that thing? (My phone is basically disposable in terms of my expectations for it's future survival, and man do I not like the Android recovery options still)
wao0uuno 2y ago
Why should everything be dumbed down and idiotproofed these days? Why not educate people instead? Blame people not passwords. Passwords managers are good and free and every new phone has one built in. There is no excuse for using weak passwords anymore.
- tptacek 2y ago
  Over years of trials security teams at places like Google have managed to successfully phish even people on those security teams. The verdict is in on whether this UX provides acceptable security.
- zelon88 2y ago
  I agree that enabling stupid people to keep being stupid is just kicking the can down the road. However I think we should blame identity providers, not passwords and not users. Passwords work when the identity provider doesn't have ALL of them, and users shouldn't be expected to be trustworthy. We just consolidated everybody's login into one platform. One monolithic database that contains the PII of EVERYONE.... What could present a bigger, better target than that? It's literally too good to pass up. Previously an attacker would have to compromise half a dozen vendors in order to completely pwn someone. Now they just need access to one. Additionally, password managers are dangerous. Not a single one or them has been able to go more than 12 months without reporting a significant hack. Just another consolidated attack vector. Like VPN providers. Why would I scourge the internet to gather browsing history of a target when the user has already consolidated that information into once place for me?
- lxgr 2y ago
  Because even I, somebody that cares about all of this a ton, sometimes copy paste passwords out of my password manager because nothing else works. Because temporary read-only backend compromises shouldn't lead to catastrophic and persistent security breaches (because passwords are provided in plaintext inside TLS, and TLS is often terminated at the edge). Because educating people for a complex and moving target like the details of authentication seems like a losing proposition at best, and like victim blaming at worst. So no, please don't blame people, blame bad authentication mechanisms (including passwords) and those that hang on to them despite better alternatives. > There is no excuse for using weak passwords anymore. Weak passwords are only a small part of the problem. You can get phished with even a 256-bit equivalent random string.
donmcronald 2y ago
> Knowledge-based access is inherently problematic: if you don’t police passwords, most people will be compromised because they use weak and/or shared passwords. I don't like it that the solution is to usurp control from the user and gate authentication through what will, in my opinion, ultimately be a small number of big tech companies. We'll eventually be dependent on having an Android phone, an iPhone, a Microsoft account, or similar. It'll be a world of "trust me bro" credential managers and you'll have to hope you never get banned by the big tech companies because it'll have a life altering impact if that means losing access to all of your accounts. The reality is that big tech has proven we can trust them because we're nothing more than 1 of a billion customers as far as they're concerned. > Passkeys avoid all of that, but you need backups either in the form of a Yubikey or a recovery code in your wallet. Passkeys create a huge burden in the context of managing devices and recovery codes. To start with, I'm not a fan of recovery codes. I have so many accounts that it's almost impossible to keep track of all the recovery codes. I have to organize them well enough that anyone who would happen to get access to my file cabinet would own my life. To mitigate that, I need a system for tracking which recovery codes I have in my file cabinet and I need a plan for rotating / revoking them if anyone gains access to them. Even worse, printed recovery codes are observable without altering the owner (aka me). Someone could photocopy all my recovery codes and I wouldn't know I've lost control of them. As for devices, I use Yubikeys for my high-value accounts and managing them is a huge pain in the ass. I have 5 sitting beside me. One is old, two are v4, two are v5. I didn't keep a list of all the accounts I used them for from day 1, so now I have to keep all of them. Forever. Just in case. The only way Passkeys will solve those problems is by taking complete control of authentication and treating it like a managed service. You'll be giving up control of your ability to prove your identity and, eventually, you're going to be paying a subscription fee for it. In my opinion it's almost a guarantee that Passkeys are going to be used as leverage against users, not to benefit them. The sad thing is that once 99% of oblivious users are fooled, the rest of us are going to get the choice of using them or being shut out of everything.
arcbyte 2y ago
I helped a family member set up an account on a state website which involved also creating an account on id.me. The amount of text message codes and email codes and usernames and passwords was ridiculous and incredibly difficult for them to follow. Passkeys would make it impossible
- lxgr 2y ago
  Have you actually tried passkeys there? I find the implementation pretty straightforward to use: I enter a username, password (unfortunately no passwordless passkey support yet), and then click "ok" when prompted to use my passkey by my browser.
- jesseendahl 2y ago
  >Passkeys would make it impossible This is so incredibly wrong that it makes me think you've never actually experienced signing in with a passkey. Passkeys would eliminate all the text message codes, email codes, and passwords. The flow is literally just: Face ID or Touch ID (or equivalent on Android/Windows), and you're done. It's both a faster/easier user experience than what you're describing and it's way more secure than any of the things you described, because the resulting credential is domain-bound and therefore can't be phished.
prmoustache 2y ago
> but you need backups You have lost 99.99% of the population.
frogsRnice 2y ago
Ive also seen some pretty terrible implementations that don’t even allow end users to manage enrolled devices; so if someone steals your authenticator they have access to your account indefinitely. Personally I like the benefits passkeys offer but some work still needs to be done around management of enrolled devices
- jesseendahl 2y ago
  >so if someone steals your authenticator they have access to your account indefinitely. If a user's device is compromised, an attacker can also install a keylogger and steal all their passwords, or better yet steal all their cookies/sessions. Once a device is compromised, it doesn't really matter what type of credential you're using to authenticate/login with. But also, if device compromise is what it takes to steal a user's credential, then that would be amazing becuse it would mean that the goal posts have been moved dramatically in terms of attacker effort. Today, attackers only have to focus on either hacking/attacking 1 service or spin up a single phishing page, and they can mount attacks targeting hundreds of thousands of users with minimal effort. If passkeys mean that all of a sudden the attackers need to try to compromise hundreds of thousands of unique endpoints/devices, then the amount of resources and effort they need to expend to compromise the same number of users will be raised astronomically. That's a win.
  - frogsRnice 2y ago
    Fair enough on the device compromise point, that said the implementation is still terrible and illustrates what I would be worried about- Maybe more succinctly put, how a credential is initially enrolled, managed and finally removed is an implementation detail which leaves room for funky implementations like the above. I do agree that it is an improvement over passwords though. Furthermore I guess the same applies to password based logins where everybody just kind of wings it anyway.

by acdha 2y ago

dboreham 2y ago

Of you have a Yubikey why do you need to use passkeys (which are essentially software emulation of a Yubikey).

superfrank 2y ago
Because the vast majority of users don't want to bring a yubikey with them everywhere they go.
- nijave 2y ago
  I'm curious if that's really true. I've had a Yubikey in my keyring for years and it's pretty convenient. It's smaller than my car key and isn't very noticeable. I have the NFC enabled variant so it can be used with a mobile phone
  - mebizzle 2y ago
    I don't have a keyring or a car key anymore so any additional physical object to carry is less convenient.
  - dymk 2y ago
    Yes, it's really true. How many of your friends and family members carry around a yubikey?
    - nijave 2y ago
      The technically savvy do. The others don't but not because they don't want to--they don't know they exist. Everyone I know carries around NFC devices--either work badges or credit cards. I don't see how having an extra NFC device in addition to the multiple ones you already have is a burden.
      - doublerabbit 2y ago
        I'm technically savvy. I don't nor want to own one. Why should I be forced to pay for a YubiKey? €60 is a fair chunk of money. Maybe buy me one I'll consider it otherwise I'm not convinced. I will once corporate gives me free open-source hardware.
        superfrank 2y ago
        I'm an EM at a large tech company. Spent a decade as a developer. I have a Yubikey for work and I hate it. I understand why I need it and the value it provides, but I hate having to cary around one more thing. The fact that this user thinks the average person would be happy to have to cary one around is wildly out of touch.
      - dymk 2y ago
        > The technically savvy do. That's my point. Yubikey doesn't pass the grandma test. Your everyday user isn't going to be carrying one around anytime soon.
- lxgr 2y ago
  The much bigger problem is that you also need to enroll a second Yubikey into every service you use, but also safely store that backup key somewhere, ideally outside your own house. That's just not realistic. Yubico had some ideas around "paired Yubikeys" which shared the same root secret, but I believe that model won't work anymore with FIDO/CTAP2 due to some counter value that was added there over U2F. (It might be possible for them to just not have a security counter; I'm not sure.)
- wkat4242 2y ago
  I have mine on my keyring. Not sure what the big problem is there. The bigger issue with yubikeys is that you need more than one in case you lose one. And most sites only allow one passkey per account because all the mobile implementations can sync the private key. Yubikeys can't and that's actually a good thing because it makes them unique and eliminates the whole sync mechanism as an attack plane.
  - iggldiggl 2y ago
    > And most sites only allow one passkey per account because all the mobile implementations can sync the private key. Even when/if sites do allow multipe passkeys per account, the fundamental contradiction remains: Your backup key(s) are supposed to be kept somewhere secure where they won't get lost, stolen or destroyed, which ideally means some sort of off-site backup (at your bank or whereever), but at the same time every time you register for a new service you do need to register all your backup keys, too.
    - wkat4242 2y ago
      True. That is a problem. Especially because with Webauthn you can't just enrol a public key. It's one of the reasons I like openpgp for authentication e.g. over SSH. I can just give it a list of public keys to accept without having all those keys actually to hand.
acdha 2y ago
Backups are good. If some guy grabs my phone, he doesn’t automatically get the Yubikey at the same time. The same is true if my phone is damaged.
pseudosavant 2y ago
Because I already have a device in my pocket that can easily do that "software emulation" that I'm less likely to lose, and it has a tracking ability?

seethishat 2y ago

Knowledge-based access (something only stored in your head) has Constitutional protection in the United States. The same is probably not true for physical things such as phones and YubiKeys stored in your pocket. Not that I worry about that, but it is worth pointing out that you may lose some legal protections when you use physical things rather than your knowledge.

acdha 2y ago
I have the most amazing coincidence to report about what protects my phone and Yubikeys.
- seethishat 2y ago
  Unfortunately, the forensic devices that easily extract data from your phone, can't be plugged into your head.
  - acdha 2y ago
    According to the manufacturers, those forensic devices also don’t work on my iPhone unless it’s unlocked with a password, but this is also irrelevant because they can get the stored passwords from the same phone in any scenario where they can access the passkey. More to the point, this is also not what the average computer user is worried about. It assumes that they’re targeted by police, have something they need to keep secret, and that those police can compel physical access but scrupulously obey civil rights protections.
nijave 2y ago
Do you have a source for this? As far as I know, it's at best a legal gray area. I believe in most cases you'll still be held in contempt of court for not producing secrets needed to access information which the authorities have a warrant for. Additionally, it's a bit silly in the context of email since the authorities will obtain it from the service provider anyway. That said, you can still add an encryption key to your phone and you're back to "knowledge based" with the additional caveat a thief would also need the hardware as well.

mort96 2y ago

Locking people out of their accounts is pretty much a worst case scenario. It's so bad that services with passkeys generally don't want to risk it, hence the knowledge-based recovery options. Which makes passkeys mere convenience rather than extra security.

lolinder 2y ago

> Passkeys avoid all of that, but you need backups either in the form of a Yubikey or a recovery code in your wallet. Yes, that’s annoying but there is no world where nobody is annoyed... We're not talking about annoyance here, we're talking about data breaches on the one hand and permanent account lockouts on the other. There is no world where the majority of people remember distinct passwords for each service, and there's likewise no world where the majority of users carry a Yubikey or even download their recovery codes at all, much less carry them with them. So we're left really with two choices at the extremes: do we go for the failure mode where people reuse passwords and lose money and data that way, or the failure mode where a company is physically incapable of restoring a customer's account? Given the choice between these extremes, companies will always choose the former. Now, these extremes aren't the only choices, but then you get to the crux of OP's argument: passkeys stored in a password manager aren't any more secure in practical terms than random passwords stored in a password manager. Your auth system is only as secure as its recovery mechanism (which is the observation that led Slack to initially not bother with passwords at all). There's one way in which I disagree with op, which is that passkeys prevent users from typing in a password and storing it in the password manager, which many users do—they effectively enforce random passwords rather than it being just a best practice that needs to be taught.

jt2190 2y ago
> [D]o we go for the failure mode where people reuse passwords and lose money and data that way, or the failure mode where a company is physically incapable of restoring a customer's account? Are you sure that Microsoft’s solution means that they are “physically incapable of restoring a customer’s account?” Apple’s system keeps copies of recovery keys in their cloud [1], unless you explicitly tell them not to do this. It seems like a reasonable compromise for most people’s security needs. [1] Or effectively something like that.
- lolinder 2y ago
  I get to that, but as I said above you've now compromised the security of the passkey system, which means your passkeys are actually only as secure as your recovery mechanism, and for convenience sake that recovery mechanism is usually quite insecure.

OptionX 2y ago

So passwords are bad because users can't be trusted to chose strong passwords but for passkeys they suddenly are trusted to keep secure, comprehensive, backups?

dsego 2y ago
Passwords can be phished, all you need is a convincing fake login form.
acdha 2y ago
Passwords are bad because normal people can’t remember strong passwords AND because they can be phished or leaked. Phishing is the most commonly-mentioned benefit for passkeys because it’s widespread and cannot be eliminated from a password-based system. “Secure, comprehensive backups” sounds scary until you remember that it’s only ever meant not disabling a checkbox for iCloud, Google, or Microsoft users.
- 0cf8612b2e1e 2y ago
  What if my house burns down? How do I convince Google it’s me, please give me my passkeys back? Call customer support? Any solution which does not allow me full autonomy to maintain a backup is not acceptable.
  - kbelder 2y ago
    This is it. Any security solution has to be under control of the individual. Otherwise it's just another insecurity. Not from the company's perspective, from the individual's.
  - XorNot 2y ago
    The glee with which people say "and it's on your phone!" is what gets me. Right: it's on the small device I take everywhere and use for everything. The one most likely to get lost, stolen or completely destroyed, and absolutely has to be replaced in about 5 years. That device. You want to permanently lock data to that thing? (My phone is basically disposable in terms of my expectations for it's future survival, and man do I not like the Android recovery options still)

wao0uuno 2y ago

Why should everything be dumbed down and idiotproofed these days? Why not educate people instead? Blame people not passwords. Passwords managers are good and free and every new phone has one built in. There is no excuse for using weak passwords anymore.

tptacek 2y ago
Over years of trials security teams at places like Google have managed to successfully phish even people on those security teams. The verdict is in on whether this UX provides acceptable security.
zelon88 2y ago
I agree that enabling stupid people to keep being stupid is just kicking the can down the road. However I think we should blame identity providers, not passwords and not users. Passwords work when the identity provider doesn't have ALL of them, and users shouldn't be expected to be trustworthy. We just consolidated everybody's login into one platform. One monolithic database that contains the PII of EVERYONE.... What could present a bigger, better target than that? It's literally too good to pass up. Previously an attacker would have to compromise half a dozen vendors in order to completely pwn someone. Now they just need access to one. Additionally, password managers are dangerous. Not a single one or them has been able to go more than 12 months without reporting a significant hack. Just another consolidated attack vector. Like VPN providers. Why would I scourge the internet to gather browsing history of a target when the user has already consolidated that information into once place for me?
lxgr 2y ago
Because even I, somebody that cares about all of this a ton, sometimes copy paste passwords out of my password manager because nothing else works. Because temporary read-only backend compromises shouldn't lead to catastrophic and persistent security breaches (because passwords are provided in plaintext inside TLS, and TLS is often terminated at the edge). Because educating people for a complex and moving target like the details of authentication seems like a losing proposition at best, and like victim blaming at worst. So no, please don't blame people, blame bad authentication mechanisms (including passwords) and those that hang on to them despite better alternatives. > There is no excuse for using weak passwords anymore. Weak passwords are only a small part of the problem. You can get phished with even a 256-bit equivalent random string.

donmcronald 2y ago

> Knowledge-based access is inherently problematic: if you don’t police passwords, most people will be compromised because they use weak and/or shared passwords. I don't like it that the solution is to usurp control from the user and gate authentication through what will, in my opinion, ultimately be a small number of big tech companies. We'll eventually be dependent on having an Android phone, an iPhone, a Microsoft account, or similar. It'll be a world of "trust me bro" credential managers and you'll have to hope you never get banned by the big tech companies because it'll have a life altering impact if that means losing access to all of your accounts. The reality is that big tech has proven we can trust them because we're nothing more than 1 of a billion customers as far as they're concerned. > Passkeys avoid all of that, but you need backups either in the form of a Yubikey or a recovery code in your wallet. Passkeys create a huge burden in the context of managing devices and recovery codes. To start with, I'm not a fan of recovery codes. I have so many accounts that it's almost impossible to keep track of all the recovery codes. I have to organize them well enough that anyone who would happen to get access to my file cabinet would own my life. To mitigate that, I need a system for tracking which recovery codes I have in my file cabinet and I need a plan for rotating / revoking them if anyone gains access to them. Even worse, printed recovery codes are observable without altering the owner (aka me). Someone could photocopy all my recovery codes and I wouldn't know I've lost control of them. As for devices, I use Yubikeys for my high-value accounts and managing them is a huge pain in the ass. I have 5 sitting beside me. One is old, two are v4, two are v5. I didn't keep a list of all the accounts I used them for from day 1, so now I have to keep all of them. Forever. Just in case. The only way Passkeys will solve those problems is by taking complete control of authentication and treating it like a managed service. You'll be giving up control of your ability to prove your identity and, eventually, you're going to be paying a subscription fee for it. In my opinion it's almost a guarantee that Passkeys are going to be used as leverage against users, not to benefit them. The sad thing is that once 99% of oblivious users are fooled, the rest of us are going to get the choice of using them or being shut out of everything.

arcbyte 2y ago

I helped a family member set up an account on a state website which involved also creating an account on id.me. The amount of text message codes and email codes and usernames and passwords was ridiculous and incredibly difficult for them to follow. Passkeys would make it impossible

lxgr 2y ago
Have you actually tried passkeys there? I find the implementation pretty straightforward to use: I enter a username, password (unfortunately no passwordless passkey support yet), and then click "ok" when prompted to use my passkey by my browser.
jesseendahl 2y ago
>Passkeys would make it impossible This is so incredibly wrong that it makes me think you've never actually experienced signing in with a passkey. Passkeys would eliminate all the text message codes, email codes, and passwords. The flow is literally just: Face ID or Touch ID (or equivalent on Android/Windows), and you're done. It's both a faster/easier user experience than what you're describing and it's way more secure than any of the things you described, because the resulting credential is domain-bound and therefore can't be phished.

prmoustache 2y ago

> but you need backups You have lost 99.99% of the population.

frogsRnice 2y ago

Ive also seen some pretty terrible implementations that don’t even allow end users to manage enrolled devices; so if someone steals your authenticator they have access to your account indefinitely. Personally I like the benefits passkeys offer but some work still needs to be done around management of enrolled devices

jesseendahl 2y ago
>so if someone steals your authenticator they have access to your account indefinitely. If a user's device is compromised, an attacker can also install a keylogger and steal all their passwords, or better yet steal all their cookies/sessions. Once a device is compromised, it doesn't really matter what type of credential you're using to authenticate/login with. But also, if device compromise is what it takes to steal a user's credential, then that would be amazing becuse it would mean that the goal posts have been moved dramatically in terms of attacker effort. Today, attackers only have to focus on either hacking/attacking 1 service or spin up a single phishing page, and they can mount attacks targeting hundreds of thousands of users with minimal effort. If passkeys mean that all of a sudden the attackers need to try to compromise hundreds of thousands of unique endpoints/devices, then the amount of resources and effort they need to expend to compromise the same number of users will be raised astronomically. That's a win.
- frogsRnice 2y ago
  Fair enough on the device compromise point, that said the implementation is still terrible and illustrates what I would be worried about- Maybe more succinctly put, how a credential is initially enrolled, managed and finally removed is an implementation detail which leaves room for funky implementations like the above. I do agree that it is an improvement over passwords though. Furthermore I guess the same applies to password based logins where everybody just kind of wings it anyway.