5 ms·

Magic links have rough edges, Passkeys have black holes. > On this blog I speak only for myself as someone experienced in usable security and website authentic

by cco 2y ago

Magic links have rough edges, Passkeys have black holes. > On this blog I speak only for myself as someone experienced in usable security and website authentication. This caveat near the top speaks to my point, if you're a developer and you understand what an SSH key is, you'll take to Passkeys no problem. But if you aren't, there are many foot guns abound and vendor lock-in you won't notice until it bites you. I work for an auth company, I use a Yubikey and Passkeys all the time, in a business context where there is an IT admin to go to when there is a problem, I think Passkeys will do great. They'll really improve the average security posture of an organization. But I would dread having to try and recover a Passkey with Google, who would I even talk to? I just had to explain what a VPN was to my parents, I would not be excited to try and explain to them how Passkeys work.

pilif 2y ago
> But I would dread having to try and recover a Passkey with Google, who would I even talk to same as trying to recover a password: You go through the account recovery workflow. My opinion on passkey is that they are a wonderful tool to speed up the authentication process with sites in some cases (which turns out to be most cases). Rather than typing your password (hopefully on the correct site...) and then sometimes confirming with a magic link or a 2FA code, all you do is use your platform native's authentication conformation method (face recognition, fingerprint, PIN code, whatever) and you're done. This works independently of which site you're on. Just as with password managers: If you use the OS built-in solution, you're locked into a specific platform (though I admit that with passwords it's at least possible to move them manually, albeit super painful if the passwords are secure), so if you're using multiple platforms concurrently use a password manager that supports all your platforms - most if not all password managers these days support passkeys. For all breakages related to passkeys, the same applies as with passwords: You use the account recovery flow (which often is the weakest link on any site). As such, passkeys feel like a wonderful shortcut with even slightly improved security (you can't present a passkey to the wrong site) in the default case.
- alisonatwork 2y ago
  Except you don't just have the vendor lock-in of your password manager, you also have the vendor lock-in of a web browser too. Or you are forced to use a password manager that works as a web browser extension instead of a standalone application. This is so much worse than OTP, which already was incredibly user unfriendly, because at least with OTP you still had the freedom to type or paste the secret from wherever you wanted to get it generated.
  - pilif 2y ago
    > you also have the vendor lock-in of a web browser too 1Password allows me to authenticate with my passkey in Safari (my default browser), Chrome and Firefox on macOS and Windows.
    - 1oooqooq 2y ago
      you know this is temporary, right? the site knows the key provider, and it's a matter of time the only accept the three big ones "for security".
hresvelgr 2y ago
> I use a Yubikey and Passkeys all the time, in a business context where there is an IT admin to go to when there is a problem, I think Passkeys will do great. They'll really improve the average security posture of an organization. The average user of a service will be worse off for passkeys. Something as innocent and common as losing a phone could result in complete account lockout. Magic links offer the best compromise between security posture, effort to implement for developers, and easiness for users. It's not the perfect solution, but its the best at the moment across all dimensions.
- jesseendahl 2y ago
  >Something as innocent and common as losing a phone could result in complete account lockout. This is the biggest misconception I see repeated about passkeys constantly. Account recovery flows generally do not change at all. Passkeys replace passwords, they change nothing at all about account recovery. If you forget/lose your password or your passkey, you go through the reset flow and create a new one.
  - saagarjha 2y ago
    If you lose your phone you may also have lost access to your email, if you used a passkey to sign into that.
    - deleted 2y ago
      [deleted]
    - pilif 2y ago
      If you lose your phone and you only have your phone to access your email, then you also have lost access to your password if you're using a strong password and a password manager. Or do you remember a 20+ random character string for each site and thus do not need a password manager?
      - Macha 2y ago
        My email and password manager are actually the two unique passwords I do remember (the rest are in my password manager). So losing my phone does not mean I lose access to them. I _have_ actually lost all my electronic devices in a house fire, so this is from experience. 2FA does make this more complicated and in my case my password manager did not have 2FA, but TOTP with backup codes does let you store those backup codes somewhere else, while none of the passkey implementations I have seen (Fastmail, Amazon and Toggl) have an equivalent to the backup codes for TOTP. The fact that they still support password auth is probably their failsafe here, but this assumes that password auth continues to exist, which is contrary to to the goals of passkeys.
jesseendahl 2y ago
FWIW people don’t actually understand how passwords work either (password hashing etc.), and I am not sure it’s important for most people to understand how passkeys actually work. Also, majority of people reuse the same (extremely weak) password, or they go through an account recovery flow every time they login anywhere. This is why you saw the “magic link” pattern take off in the first place — users were already going through essentially the same flow before. Now at least they can sign in with biometric authentication on a regular basis, using passkeys. And if they do get locked out of their account for some reason, they go through the account recovery flow — same as they did when using their password before. But at least they won’t get phished anymore! That’s a huge win.
- deleted 2y ago
  [deleted]
- TeMPOraL 2y ago
  > people don’t actually understand how passwords work either (password hashing etc.) Those are implementation details that they need not to care about. Password hashing is about mitigating the consequences of you the account provider screwing up. I know, technology and finance are special, in that the more a service provider fucks up, the more it is your fault somehow (see: "identity theft") - but most people didn't get that memo.
  - jesseendahl 2y ago
    Indeed — I am arguing that 99% of normal everyday folks using passkeys also do not need to understand passkeys.
    - TeMPOraL 2y ago
      Difference is, passwords break like normal things people are used to. Passkeys break like some alien technology from fifth dimension, there is no reference to everyday experience for the one thing people need to understand, which is how to not mishandle auth on their end, and how to recover when they invariably do mishandle it.
dfabulich 2y ago
> But I would dread having to try and recover a Passkey with Google, who would I even talk to? That's not what this blog post is about. This blog post is not about using a passkey to login to your email. This blog post is about using a passkey to login to a website (404 Media) that currently supports login via "magic links," i.e. instead of passwords, they always send you a "forgot my password" link, which you click on in your email. If you currently login to 404 Media with a magic link, and then decide to login to 404 Media via passkey, and you lose your passkey, you can just get a new magic link sent you via email and reset your passkey, or, if you want, you could just skip the passkeys and go back to always using magic links. Using passkeys to login to your email itself is a whole different ball of wax. Gmail does not have a simple "forgot my password" email that it sends. (That would be pointless if Gmail is your only email address!) The "forgot my password" flow for Google/Gmail can involve a bunch of factors, including backup email addresses, backup recovery codes, recovery contacts, SMS, push notification to other apps you've logged into. Google doesn't document all of the factors they consider, and neither do any of the other major email providers. I get it: it would be scary to login to Google via passkey if Google is your passkey manager, especially because there's no way to export a passkey from one passkey manager to another. Can you trust Google's recovery system? That's a hard problem for Google, but it's a trivial problem for 404 Media. They just send you a magic link, and rely on Google to keep your email secure. And, let's face it, most of us run sites that are much more like 404 Media than they are like Google.
- 1oooqooq 2y ago
  basically "passkey is a good session cache when you already have a password or a magic link" an entitled dev from apple who shops at Albertsons just like passkey with password-reset-as-login-flow. nothing to see here.
figassis 2y ago
Problem with auth methods is the protocol fatigue for the average user. And that even includes some tech savvy people. I have been in the process of teaching my family to use password managers. I subscribed to 1Password family, added everyone and then added the app to their devices, setup their Face IDs/Touch IDs, set the app as default password manager on their devices, added it to their browsers, etc, just to make it as simple as possible for them to just be safe. They’re still having a hard time grasping the concept of 1 password per site. Or that password do not need to be memorable or the name of their pet plus their birth date. So they fight it. Often they call me saying some service is broken, emails aren’t working, etc, and I ask for their password and they show me a list of account passwords in their notepad app, bc they were trying to replicate 1 password in their minds, because they absolutely do not trust what they do not understand. I for one do not like magic links, prefer regular otp, especially because I can add it to my 1Password. I don’t like magic links because it adds an extra step of opening my email app, clicking a link and opening a new tab. It breaks my flow, so I tend to avoid services with magic links unless it’s only for account recovery. Passkeys, I have skimmed the implementation, and flows, but I can’t get over the lock in and lock out potential. So going back to fatigue, if my relatives are still in the password manager training phase, I’m definitely not going to confuse them with magic links, much less with passkeys. I will wait, and wait, and wait, until this all settles down and we have a gold standard, and everyone falls in line. Average users do not need the latest, “safe enough” is enough for them.
- 1oooqooq 2y ago
  a text file on the desktop for sites like these are better than any alternative to be honest. at least they aren't reusing their bank password everywhere.

by cco 2y ago

pilif 2y ago

> But I would dread having to try and recover a Passkey with Google, who would I even talk to same as trying to recover a password: You go through the account recovery workflow. My opinion on passkey is that they are a wonderful tool to speed up the authentication process with sites in some cases (which turns out to be most cases). Rather than typing your password (hopefully on the correct site...) and then sometimes confirming with a magic link or a 2FA code, all you do is use your platform native's authentication conformation method (face recognition, fingerprint, PIN code, whatever) and you're done. This works independently of which site you're on. Just as with password managers: If you use the OS built-in solution, you're locked into a specific platform (though I admit that with passwords it's at least possible to move them manually, albeit super painful if the passwords are secure), so if you're using multiple platforms concurrently use a password manager that supports all your platforms - most if not all password managers these days support passkeys. For all breakages related to passkeys, the same applies as with passwords: You use the account recovery flow (which often is the weakest link on any site). As such, passkeys feel like a wonderful shortcut with even slightly improved security (you can't present a passkey to the wrong site) in the default case.

alisonatwork 2y ago
Except you don't just have the vendor lock-in of your password manager, you also have the vendor lock-in of a web browser too. Or you are forced to use a password manager that works as a web browser extension instead of a standalone application. This is so much worse than OTP, which already was incredibly user unfriendly, because at least with OTP you still had the freedom to type or paste the secret from wherever you wanted to get it generated.
- pilif 2y ago
  > you also have the vendor lock-in of a web browser too 1Password allows me to authenticate with my passkey in Safari (my default browser), Chrome and Firefox on macOS and Windows.
  - 1oooqooq 2y ago
    you know this is temporary, right? the site knows the key provider, and it's a matter of time the only accept the three big ones "for security".

hresvelgr 2y ago

> I use a Yubikey and Passkeys all the time, in a business context where there is an IT admin to go to when there is a problem, I think Passkeys will do great. They'll really improve the average security posture of an organization. The average user of a service will be worse off for passkeys. Something as innocent and common as losing a phone could result in complete account lockout. Magic links offer the best compromise between security posture, effort to implement for developers, and easiness for users. It's not the perfect solution, but its the best at the moment across all dimensions.

jesseendahl 2y ago
>Something as innocent and common as losing a phone could result in complete account lockout. This is the biggest misconception I see repeated about passkeys constantly. Account recovery flows generally do not change at all. Passkeys replace passwords, they change nothing at all about account recovery. If you forget/lose your password or your passkey, you go through the reset flow and create a new one.
- saagarjha 2y ago
  If you lose your phone you may also have lost access to your email, if you used a passkey to sign into that.
  - deleted 2y ago
    [deleted]
  - pilif 2y ago
    If you lose your phone and you only have your phone to access your email, then you also have lost access to your password if you're using a strong password and a password manager. Or do you remember a 20+ random character string for each site and thus do not need a password manager?
    - Macha 2y ago
      My email and password manager are actually the two unique passwords I do remember (the rest are in my password manager). So losing my phone does not mean I lose access to them. I _have_ actually lost all my electronic devices in a house fire, so this is from experience. 2FA does make this more complicated and in my case my password manager did not have 2FA, but TOTP with backup codes does let you store those backup codes somewhere else, while none of the passkey implementations I have seen (Fastmail, Amazon and Toggl) have an equivalent to the backup codes for TOTP. The fact that they still support password auth is probably their failsafe here, but this assumes that password auth continues to exist, which is contrary to to the goals of passkeys.

jesseendahl 2y ago

FWIW people don’t actually understand how passwords work either (password hashing etc.), and I am not sure it’s important for most people to understand how passkeys actually work. Also, majority of people reuse the same (extremely weak) password, or they go through an account recovery flow every time they login anywhere. This is why you saw the “magic link” pattern take off in the first place — users were already going through essentially the same flow before. Now at least they can sign in with biometric authentication on a regular basis, using passkeys. And if they do get locked out of their account for some reason, they go through the account recovery flow — same as they did when using their password before. But at least they won’t get phished anymore! That’s a huge win.

deleted 2y ago
[deleted]
TeMPOraL 2y ago
> people don’t actually understand how passwords work either (password hashing etc.) Those are implementation details that they need not to care about. Password hashing is about mitigating the consequences of you the account provider screwing up. I know, technology and finance are special, in that the more a service provider fucks up, the more it is your fault somehow (see: "identity theft") - but most people didn't get that memo.
- jesseendahl 2y ago
  Indeed — I am arguing that 99% of normal everyday folks using passkeys also do not need to understand passkeys.
  - TeMPOraL 2y ago
    Difference is, passwords break like normal things people are used to. Passkeys break like some alien technology from fifth dimension, there is no reference to everyday experience for the one thing people need to understand, which is how to not mishandle auth on their end, and how to recover when they invariably do mishandle it.

dfabulich 2y ago

> But I would dread having to try and recover a Passkey with Google, who would I even talk to? That's not what this blog post is about. This blog post is not about using a passkey to login to your email. This blog post is about using a passkey to login to a website (404 Media) that currently supports login via "magic links," i.e. instead of passwords, they always send you a "forgot my password" link, which you click on in your email. If you currently login to 404 Media with a magic link, and then decide to login to 404 Media via passkey, and you lose your passkey, you can just get a new magic link sent you via email and reset your passkey, or, if you want, you could just skip the passkeys and go back to always using magic links. Using passkeys to login to your email itself is a whole different ball of wax. Gmail does not have a simple "forgot my password" email that it sends. (That would be pointless if Gmail is your only email address!) The "forgot my password" flow for Google/Gmail can involve a bunch of factors, including backup email addresses, backup recovery codes, recovery contacts, SMS, push notification to other apps you've logged into. Google doesn't document all of the factors they consider, and neither do any of the other major email providers. I get it: it would be scary to login to Google via passkey if Google is your passkey manager, especially because there's no way to export a passkey from one passkey manager to another. Can you trust Google's recovery system? That's a hard problem for Google, but it's a trivial problem for 404 Media. They just send you a magic link, and rely on Google to keep your email secure. And, let's face it, most of us run sites that are much more like 404 Media than they are like Google.

1oooqooq 2y ago
basically "passkey is a good session cache when you already have a password or a magic link" an entitled dev from apple who shops at Albertsons just like passkey with password-reset-as-login-flow. nothing to see here.

figassis 2y ago

Problem with auth methods is the protocol fatigue for the average user. And that even includes some tech savvy people. I have been in the process of teaching my family to use password managers. I subscribed to 1Password family, added everyone and then added the app to their devices, setup their Face IDs/Touch IDs, set the app as default password manager on their devices, added it to their browsers, etc, just to make it as simple as possible for them to just be safe. They’re still having a hard time grasping the concept of 1 password per site. Or that password do not need to be memorable or the name of their pet plus their birth date. So they fight it. Often they call me saying some service is broken, emails aren’t working, etc, and I ask for their password and they show me a list of account passwords in their notepad app, bc they were trying to replicate 1 password in their minds, because they absolutely do not trust what they do not understand. I for one do not like magic links, prefer regular otp, especially because I can add it to my 1Password. I don’t like magic links because it adds an extra step of opening my email app, clicking a link and opening a new tab. It breaks my flow, so I tend to avoid services with magic links unless it’s only for account recovery. Passkeys, I have skimmed the implementation, and flows, but I can’t get over the lock in and lock out potential. So going back to fatigue, if my relatives are still in the password manager training phase, I’m definitely not going to confuse them with magic links, much less with passkeys. I will wait, and wait, and wait, until this all settles down and we have a gold standard, and everyone falls in line. Average users do not need the latest, “safe enough” is enough for them.

1oooqooq 2y ago
a text file on the desktop for sites like these are better than any alternative to be honest. at least they aren't reusing their bank password everywhere.