5 ms·

One big selling point of passkeys is that almost every workaround is impossible, whether that is good security or bad UX or both seems to be under discussion

• lolinder 2y ago
  If that's one of the big selling points then that's a problem, because workarounds are totally possible and actively implemented in the real world. As an obvious example: syncing passkeys is a workaround for their terrible UX that takes them further from the original design in ways that compromise some of the original security guarantees.
  • wglb 2y ago
    Can you illustrate how workarounds to passkeys are being actively implemented?
    • fragmede 2y ago
      Password manager support. If my password manager running on my desktop can provision and access the passkey for use on another device like my phone, then so can malicious code running on my desktop, and exfiltrate it to hackers. The original design, where the private key only exists on a TPM and the private key never leaves the TPM doesn't have that flaw.
      • lxgr 2y ago
        Passkeys were always designed as being synchronizable and not necessarily be secure hardware backed. I think there’s a place for both of them in WebAuthN based on the security/availability/convenience tradeoff which will be different for every application. If you care about your users only using the trusted hardware, non-synchronizing kind, you have to use attestation anyway (or malware running on their device could create credentials that only appear to be backed by secure hardware). Unfortunately both Apple and Google seem to have unshipped their attestation support without replacement (they used to support hardware backed credentials in their devices too for a while) in the interest of not confusing users about what is and isn’t synchronized – now everything is.
        • wkat4242 2y ago
          Attestation would be terrible to have in passkeys because it will allow sites to block certain implementations. PayPal does this already by only allowing safari or chrome. With bitwarden on Firefox I'm locked out.
          • lxgr 2y ago
            Yeah, as a user, I'm mostly happy about the lack of attestation. In an ideal world, only relying parties that really need it would request it, but views on who really does might obviously differ a lot between users and service providers. > PayPal does this already by only allowing safari or chrome. With bitwarden on Firefox I'm locked out. It works for me! However I do vaguely remember having to set them up on Chrome initially, but after that, they now work well even in Firefox. (Only on my computer; on my phone, I get an absurd non sequitur of "security keys only work on desktops").
            • wkat4242 2y ago
              > It works for me! However I do vaguely remember having to set them up on Chrome initially, but after that, they now work well even in Firefox. (Only on my computer; on my phone, I get an absurd non sequitur of "security keys only work on desktops"). Oh ok, I haven't tried that. I don't even have Chrome installed anymore. And yeah I get that message too on my phone, even with standard FIDO2 MFA (not full passwordless Webauthn). Stupid because it does work just fine with other sites.
          • HeatrayEnjoyer 2y ago
            > Attestation would be terrible to have in passkeys because it will allow sites to block certain implementations. Attestation is already coming. Why do you think Microsoft is pushing TPM2.0 so hard?
            • lxgr 2y ago
              How so? Not the type of attestation we're talking about here (i.e. not the early 2000s trope of "zomg Microsoft is locking down our PCs", which ironically is what Apple is now doing instead, all without any evil TPMs). Apple and Google very intentionally threw FIDO attestation out of the windows without replacement, and Microsoft frankly doesn't matter enough for non-corporate contexts at this point. (Imagine your bank only allowing passkeys on Windows, but not iOS, Android, or macOS.)
      • wglb 2y ago
        If you have malicious code running on your laptop, it is game over in any case.