5 ms·

> That's incorrect. I use passkeys to login automagically with many services, but nothing precludes me from logging in with my (20 character) passwords. That i

by mort96 2y ago

> That's incorrect. I use passkeys to login automagically with many services, but nothing precludes me from logging in with my (20 character) passwords. That is not the world which passkey advocates envision. In the case of those services you mention, passkeys are nothing but convenience; they provide no extra security. In the world passkey advocates envision, passkeys improve security, meaning the removal of password authentication options. I've already been temporarily locked out by one such service, because a Firefox update made the passkeys I store in Bitwarden inaccessible (Firefox would pop up a macOS Touch ID modal rather than the Bitwarden passkey). That is the world which passkey advocates want, because it "improves security".

Dylan16807 2y ago
> That is the world which passkey advocates want Okay, you don't have to take the hyperbole so far it's obviously wrong. They don't want your login to break, and a password vault could also break if you only had a password.
- deleted 2y ago
  [deleted]
- mort96 2y ago
  I'm saying that the world which passkey advocates want is a world where if, for any reason, you can't log in with your passkey (due to a lost/broken device, a software bug, whatever), you'll be locked out of your account. I'm saying that to contrast with my parent comment, which claims that the world passkey advocates want is one in which passkeys offer some slight convenience advantages but no security advantages because they'll be an alternative to passwords. Obviously they don't want the software bugs, but we know bugs happen.
  - brookst 2y ago
    I'm not sure who these "passkey advocates" are, but are you really positive they are unanimous and completely homogeneous as a group?
    - mort96 2y ago
      No group is unanimous and completely homogeneous. But judging by how often the security benefits gets brought up by those in favor of passkeys in these kinds of discussions (including this thread), my impression is that most of its advocates view it as a security benefit. Which means they need to replace passwords, not be an optional extra.
      - macrolime 2y ago
        For important sites like your email you'll add multiple passkeys. On less important ones you can just reset which passkey you use to login, using your email, if you lose one of your passkeys.
        mort96 2y ago
        That doesn't help with the posited example of "I lost my phone and need to borrow someone else's computer".
        vel0city 2y ago
        It does. You just use one of your other passkeys, like a hardware token.
  - Dylan16807 2y ago
    > I'm saying that the world which passkey advocates want is a world where if, for any reason, you can't log in with your passkey (due to a lost/broken device, a software bug, whatever), you'll be locked out of your account. And a world where people only use passwords has the same problem if you can't log in with your password. Moving from one single point of failure to another isn't great, but it's not a downgrade. (And just like it's possible to back up a password, it's possible to back up a passkey. And I know passwords can be memorized, but in practice it's bad passwords that get memorized.)
    - mort96 2y ago
      How do I back up my passkeys? How do I get them out of iOS and into some file I control and can sync?
      - Dylan16807 2y ago
        If you're using the iOS built-in storage then it backs up to icloud and syncs to your other iOS devices. If you specifically want a file you can control you need to use other passkey software, like bitwarden. Which you already mentioned? Huh.
        mort96 2y ago
        So I can't back them up in a way I control, so that I can transfer them to non-Apple devices? That's what I thought.
        Dylan16807 2y ago
        You are describing a problem with a single implementation, not passkeys in general. It's a really ineffective gotcha. And extra transparent because you talked about bitwarden first.
        mort96 2y ago
        I use Bitwarden for critical passkeys. Most people do not. Passkeys, as currently implemented, for the vast majority of people, do not allow for effective back-ups in ways the user controls. You can't back up the keys from your iCloud and then use them on your friend's Windows PC to access something when you lost your iPhone. You can do that with passwords.
  - CharlesW 2y ago
    > I'm saying that the world which passkey advocates want is a world where if, for any reason, you can't log in with your passkey (due to a lost/broken device, a software bug, whatever), you'll be locked out of your account. Can you point me to a citation or two where passkeys advocates claim that passwords must go away and/or account recovery mechanisms must be abolished?
    - mort96 2y ago
      If passwords remain, passkeys don't provide better security, only convenience.
      - CharlesW 2y ago
        Passkeys provide better security regardless of whether passwords continue to be supported. Two reasons off the top of my head: • Passkeys stop phishing. Using your passkey instead of a password (when both are available) ensures you're actually signing in to the site/service you expect. • Passkeys have zero value when leaked. Users' private keys remains secret and safe even when public keys are stolen and distributed. That said, passwords aren't going extinct anytime soon. It will likely become more popular to require 2FA for password users in the meantime, as it should.
        mort96 2y ago
        Passkeys don't stop phishing. If the user has both a password and a passkey to a service, a phishing site needs to just ask for a password and not mention passkeys and people will just enter their password.
        jesseendahl 2y ago
        >It will likely become more popular to require 2FA for password users in the meantime, as it should. A lot of folks/services/engineers mistakenly think that layering 2FA on top of passwords will help defend against phishing attacks. But attackers have been phishing 2FA codes since at least 2012 and it's gone from an advanced attack to bog-standard. The only way to defend against phishing attacks in 2024 is to use phishing-resistant credentials like passkeys.
ylk 2y ago
> In the case of those services you mention, passkeys are nothing but convenience; they provide no extra security. They do provide extra security, in that they ensure that you're on the correct domain instead of a phishing site.
- mort96 2y ago
  The phishing site will just ask you for a password, maaaaybe with some text explaining some BS reason why you can't use your passkeys but if it's a website which the user knows they have a password to, the kind of person who's prone to non-targeted phishing attacks likely won't even think to question why the passkey thing didn't trigger.
  - ylk 2y ago
    Honestly don’t care to spend time on looking up the various states of 2fa proxies. But I’ve learnt so far that attackers don’t build/use the most advanced tooling you can think of at all times. They often use the simplest thing that gets the job done. If it’s not targeted, it’s fine to not get the credentials of people with a passkey. Up until a significant portion of targets use passkeys, which I highly doubt to be the case as of now. Additionally, “the kind of person who's prone to non-targeted phishing attacks” is actually everyone — including infosec professionals spending lots of time on phishing campaigns for red team engagements. You just need to be lucky enough to reach them at the right (emotional, stressful, …) moment. Getting grammar and spelling correct and even potentially even slightly customising each email is made much easier by AI. Knowledgeable users might, however, stop once their passkey doesn’t work and try to understand why.
    - mort96 2y ago
      Okay? What relevance is this, if the phishing site just asks for a password then some users will enter their passwords even if they also have a passkey for that service. They aren't "not getting the credentials of people with a passkey", they are "not getting the credentials of some of the people who remember that they have a passkey and get extra suspicious because the passkey thing doesn't pop up".

by mort96 2y ago

Dylan16807 2y ago

> That is the world which passkey advocates want Okay, you don't have to take the hyperbole so far it's obviously wrong. They don't want your login to break, and a password vault could also break if you only had a password.

deleted 2y ago
[deleted]
mort96 2y ago
I'm saying that the world which passkey advocates want is a world where if, for any reason, you can't log in with your passkey (due to a lost/broken device, a software bug, whatever), you'll be locked out of your account. I'm saying that to contrast with my parent comment, which claims that the world passkey advocates want is one in which passkeys offer some slight convenience advantages but no security advantages because they'll be an alternative to passwords. Obviously they don't want the software bugs, but we know bugs happen.
- brookst 2y ago
  I'm not sure who these "passkey advocates" are, but are you really positive they are unanimous and completely homogeneous as a group?
  - mort96 2y ago
    No group is unanimous and completely homogeneous. But judging by how often the security benefits gets brought up by those in favor of passkeys in these kinds of discussions (including this thread), my impression is that most of its advocates view it as a security benefit. Which means they need to replace passwords, not be an optional extra.
    - macrolime 2y ago
      For important sites like your email you'll add multiple passkeys. On less important ones you can just reset which passkey you use to login, using your email, if you lose one of your passkeys.
      - mort96 2y ago
        That doesn't help with the posited example of "I lost my phone and need to borrow someone else's computer".
        vel0city 2y ago
        It does. You just use one of your other passkeys, like a hardware token.
- Dylan16807 2y ago
  > I'm saying that the world which passkey advocates want is a world where if, for any reason, you can't log in with your passkey (due to a lost/broken device, a software bug, whatever), you'll be locked out of your account. And a world where people only use passwords has the same problem if you can't log in with your password. Moving from one single point of failure to another isn't great, but it's not a downgrade. (And just like it's possible to back up a password, it's possible to back up a passkey. And I know passwords can be memorized, but in practice it's bad passwords that get memorized.)
  - mort96 2y ago
    How do I back up my passkeys? How do I get them out of iOS and into some file I control and can sync?
    - Dylan16807 2y ago
      If you're using the iOS built-in storage then it backs up to icloud and syncs to your other iOS devices. If you specifically want a file you can control you need to use other passkey software, like bitwarden. Which you already mentioned? Huh.
      - mort96 2y ago
        So I can't back them up in a way I control, so that I can transfer them to non-Apple devices? That's what I thought.
        Dylan16807 2y ago
        You are describing a problem with a single implementation, not passkeys in general. It's a really ineffective gotcha. And extra transparent because you talked about bitwarden first.
        mort96 2y ago
        I use Bitwarden for critical passkeys. Most people do not. Passkeys, as currently implemented, for the vast majority of people, do not allow for effective back-ups in ways the user controls. You can't back up the keys from your iCloud and then use them on your friend's Windows PC to access something when you lost your iPhone. You can do that with passwords.
- CharlesW 2y ago
  > I'm saying that the world which passkey advocates want is a world where if, for any reason, you can't log in with your passkey (due to a lost/broken device, a software bug, whatever), you'll be locked out of your account. Can you point me to a citation or two where passkeys advocates claim that passwords must go away and/or account recovery mechanisms must be abolished?
  - mort96 2y ago
    If passwords remain, passkeys don't provide better security, only convenience.
    - CharlesW 2y ago
      Passkeys provide better security regardless of whether passwords continue to be supported. Two reasons off the top of my head: • Passkeys stop phishing. Using your passkey instead of a password (when both are available) ensures you're actually signing in to the site/service you expect. • Passkeys have zero value when leaked. Users' private keys remains secret and safe even when public keys are stolen and distributed. That said, passwords aren't going extinct anytime soon. It will likely become more popular to require 2FA for password users in the meantime, as it should.
      - mort96 2y ago
        Passkeys don't stop phishing. If the user has both a password and a passkey to a service, a phishing site needs to just ask for a password and not mention passkeys and people will just enter their password.
      - jesseendahl 2y ago
        >It will likely become more popular to require 2FA for password users in the meantime, as it should. A lot of folks/services/engineers mistakenly think that layering 2FA on top of passwords will help defend against phishing attacks. But attackers have been phishing 2FA codes since at least 2012 and it's gone from an advanced attack to bog-standard. The only way to defend against phishing attacks in 2024 is to use phishing-resistant credentials like passkeys.

ylk 2y ago

> In the case of those services you mention, passkeys are nothing but convenience; they provide no extra security. They do provide extra security, in that they ensure that you're on the correct domain instead of a phishing site.

mort96 2y ago
The phishing site will just ask you for a password, maaaaybe with some text explaining some BS reason why you can't use your passkeys but if it's a website which the user knows they have a password to, the kind of person who's prone to non-targeted phishing attacks likely won't even think to question why the passkey thing didn't trigger.
- ylk 2y ago
  Honestly don’t care to spend time on looking up the various states of 2fa proxies. But I’ve learnt so far that attackers don’t build/use the most advanced tooling you can think of at all times. They often use the simplest thing that gets the job done. If it’s not targeted, it’s fine to not get the credentials of people with a passkey. Up until a significant portion of targets use passkeys, which I highly doubt to be the case as of now. Additionally, “the kind of person who's prone to non-targeted phishing attacks” is actually everyone — including infosec professionals spending lots of time on phishing campaigns for red team engagements. You just need to be lucky enough to reach them at the right (emotional, stressful, …) moment. Getting grammar and spelling correct and even potentially even slightly customising each email is made much easier by AI. Knowledgeable users might, however, stop once their passkey doesn’t work and try to understand why.
  - mort96 2y ago
    Okay? What relevance is this, if the phishing site just asks for a password then some users will enter their passwords even if they also have a passkey for that service. They aren't "not getting the credentials of people with a passkey", they are "not getting the credentials of some of the people who remember that they have a passkey and get extra suspicious because the passkey thing doesn't pop up".