3 ms·

> I don't give a fuck if other people can't manage secure passwords. I infer that you use a password manager. Consider passkeys as a standardized interface fo

> I don't give a fuck if other people can't manage secure passwords. I infer that you use a password manager. Consider passkeys as a standardized interface for password managers.

OtomotO 2y ago
I do, so I have a working solution. I am not migrating to something just because it's new. My solution works for me. If it doesn't anymore, I'll see what I'll do. Depending on the service I'll swallow the bitter pill and use another solution or simply not use the service anymore. Every and any decision has consequences, on any side.
- paulddraper 2y ago
  https://f8n-ipfs-production.imgix.net/QmaangUFNxGD6vRjnqzVnL2DaFgx4QX38F2LkxZY8WJqkK/nft.jpg https://f8n-ipfs-production.imgix.net/QmaangUFNxGD6vRjnqzVnL...
  - OtomotO 2y ago
    Thank you, this made my day :)
sam_lowry_ 2y ago
> Consider passkeys as a standardized interface for password managers. I have not followed WebAuthn spec for a while but I vaguely remember that the spec discouraged software-only authenticators. Which made me feel like WebAuthn is yet another attempt to take the power from users and even states and concentrate it in the hands of a few multinationals controlled by US government. Pretty much what happened to Certificate Authorities and the push to use HTTPS everywhere. Of course there are benefits to HTTPS Everywhere and to passwordless authentication. But they do not outweight concerns over the digital autonomy of my country.
- paulddraper 2y ago
  1Password supports passkeys, and I am sure that others do as well. Given the convenience factor (no extra install), I imagine that device/platform passkeys to be the most popular, but there should be no problem with using alternatives.
- aseipp 2y ago
  For ordinary websites none of the existing platforms support WebAuthn attestation AFAIK, because the spec for attestation was not designed with key synchronization in mind, which is a key use case; otherwise, basic features like Keychain synchronization via iCloud would not work and the whole thing would be DOA. Synchronization is widely considered to be a core necessity to match the functionality of existing password managers. I believe you can enforce attestation using MDM and a custom app as far as I'm aware. But for general people using Safari or whatever, you can't request any kind of device attestation.
dheera 2y ago
Passkeys and 2FA recovery codes are all just shitty replacements for passwords. Fight me. Grandmas and Joes end up putting these recovery codes in a Google doc because they don't know what the hell else to do with them. That is NOT more secure. Hell, even try explaining the difference between the "secret key" and the "password" in 1password to a non-technical person. It's impossible.
- paulddraper 2y ago
  > That is NOT more secure. "More" implies a comparison to something. Given that Grandmas+Joes were using "passw0rd!" for all their passwords, I would argue their GDoc of backup codes is considerably more secure.
josephcsible 2y ago
If the passkey protocol didn't support attestation, then that would be true. But since it does, passkeys aren't as good, since I can't make my own backups of them.
- Scion9066 2y ago
  Generally attestation is not supported outside of enterprise contexts and Apple for example doesn't support it without mobile device management policies being applied to the device. You can make your own backups of passkeys from your password manager. I believe you are confusing ones that are stored in software or syncable (Passkeys) with the hardware backed credentials (platform authenticators).
  - josephcsible 2y ago
    > I believe you are confusing ones that are stored in software or syncable (Passkeys) with the hardware backed credentials (platform authenticators). The problem is that the protocol allows websites to require use of the latter. If the two were indistinguishable to the website, then passkeys would be a good thing.
- madeofpalk 2y ago
  I don't believe there's any (public, stable) implementations of it yet, but Secure Credentials Exchange will let you export, transfer, and backup passkeys https://fidoalliance.org/specifications-credential-exchange-specifications https://fidoalliance.org/specifications-credential-exchange-... https://fidoalliance.org/specs/cx/cxp-v1.0-wd-20241003.html https://fidoalliance.org/specs/cx/cxp-v1.0-wd-20241003.html
  - josephcsible 2y ago
    That lets the megacorps make backups for me, but it doesn't let me make my own backups, because they'll only encrypt them to each others' public keys, not mine.
- aseipp 2y ago

> I don't give a fuck if other people can't manage secure passwords. I infer that you use a password manager. Consider passkeys as a standardized interface for password managers.

OtomotO 2y ago

I do, so I have a working solution. I am not migrating to something just because it's new. My solution works for me. If it doesn't anymore, I'll see what I'll do. Depending on the service I'll swallow the bitter pill and use another solution or simply not use the service anymore. Every and any decision has consequences, on any side.

paulddraper 2y ago
https://f8n-ipfs-production.imgix.net/QmaangUFNxGD6vRjnqzVnL2DaFgx4QX38F2LkxZY8WJqkK/nft.jpg https://f8n-ipfs-production.imgix.net/QmaangUFNxGD6vRjnqzVnL...
- OtomotO 2y ago
  Thank you, this made my day :)

sam_lowry_ 2y ago

> Consider passkeys as a standardized interface for password managers. I have not followed WebAuthn spec for a while but I vaguely remember that the spec discouraged software-only authenticators. Which made me feel like WebAuthn is yet another attempt to take the power from users and even states and concentrate it in the hands of a few multinationals controlled by US government. Pretty much what happened to Certificate Authorities and the push to use HTTPS everywhere. Of course there are benefits to HTTPS Everywhere and to passwordless authentication. But they do not outweight concerns over the digital autonomy of my country.

paulddraper 2y ago
1Password supports passkeys, and I am sure that others do as well. Given the convenience factor (no extra install), I imagine that device/platform passkeys to be the most popular, but there should be no problem with using alternatives.
aseipp 2y ago
For ordinary websites none of the existing platforms support WebAuthn attestation AFAIK, because the spec for attestation was not designed with key synchronization in mind, which is a key use case; otherwise, basic features like Keychain synchronization via iCloud would not work and the whole thing would be DOA. Synchronization is widely considered to be a core necessity to match the functionality of existing password managers. I believe you can enforce attestation using MDM and a custom app as far as I'm aware. But for general people using Safari or whatever, you can't request any kind of device attestation.

dheera 2y ago

Passkeys and 2FA recovery codes are all just shitty replacements for passwords. Fight me. Grandmas and Joes end up putting these recovery codes in a Google doc because they don't know what the hell else to do with them. That is NOT more secure. Hell, even try explaining the difference between the "secret key" and the "password" in 1password to a non-technical person. It's impossible.

paulddraper 2y ago
> That is NOT more secure. "More" implies a comparison to something. Given that Grandmas+Joes were using "passw0rd!" for all their passwords, I would argue their GDoc of backup codes is considerably more secure.

josephcsible 2y ago

If the passkey protocol didn't support attestation, then that would be true. But since it does, passkeys aren't as good, since I can't make my own backups of them.

Scion9066 2y ago
Generally attestation is not supported outside of enterprise contexts and Apple for example doesn't support it without mobile device management policies being applied to the device. You can make your own backups of passkeys from your password manager. I believe you are confusing ones that are stored in software or syncable (Passkeys) with the hardware backed credentials (platform authenticators).
- josephcsible 2y ago
  > I believe you are confusing ones that are stored in software or syncable (Passkeys) with the hardware backed credentials (platform authenticators). The problem is that the protocol allows websites to require use of the latter. If the two were indistinguishable to the website, then passkeys would be a good thing.
madeofpalk 2y ago
I don't believe there's any (public, stable) implementations of it yet, but Secure Credentials Exchange will let you export, transfer, and backup passkeys https://fidoalliance.org/specifications-credential-exchange-specifications https://fidoalliance.org/specifications-credential-exchange-... https://fidoalliance.org/specs/cx/cxp-v1.0-wd-20241003.html https://fidoalliance.org/specs/cx/cxp-v1.0-wd-20241003.html
- josephcsible 2y ago
  That lets the megacorps make backups for me, but it doesn't let me make my own backups, because they'll only encrypt them to each others' public keys, not mine.
aseipp 2y ago