4 ms·

Passwords and password managers seem good enough to me, and TOTP support is everywhere now. Passkeys just feel like a standard written by large tech companies

Passwords and password managers seem good enough to me, and TOTP support is everywhere now. Passkeys just feel like a standard written by large tech companies as a flywheel technology to keep me locked into whatever hardware and software ecosystem I'm already in since seemingly no one besides maybe Bitwarden supports exporting them. Which seems pointless, because I don't know of any platform that supports importing them. I am also getting tired of corporate white knight nerds defending trillion dollar companies telling me that portability isn't a concern.

advisedwang 1y ago
Password/TOTP does not protect you against phishing. The phishing site can forward the password and TOTP you type into the real system, gaining your access. FIDO/WebAuthn/Passkeys protect you against phishing, because of the origin binding mentioned in the article. On the phishing site, the required credential cannot be generated, and so no matter how convincing it is you can't accidentally give them a credential to forward. Phishing is what these systems were trying to defend against. Now if you were to say that the move from plain FIDO tied to a hardware key to passkeys tied to a Google account was a lock-in ploy ---- then I might be more inclined to agree.
- jgalt212 1y ago
  > The phishing site can forward the password and TOTP you type into the real system, gaining your access. To me this seems harder to pull off than a fraudulent password reset (either via social engineering, or a hacked email account). My TOTP fell in the drink a few years back, and some accounts very hard to reset and others were too easy.
  - jerf 1y ago
    If you're targeting a particular person, social engineering is probably easier. If you just want to illicitly harvest some accounts, and aren't too worried about which ones, blasting out emails linking to hacked websites that fake the login & TOTP flow is very easy.
- deleted 1y ago
  [deleted]
- andrewmcwatters 1y ago
  Considering there's an entire portion of the software industry built on accepting a user's credentials and also prompting them for their TOTP, I don't think this really matters. It's not an acceptable trade-off. And the answer isn't, "Those third-parties shouldn't be asking for your password and TOTP," because that's not a realistic premise.
pottertheotter 1y ago
A couple years ago there were several posts here about not using PassKeys, and I went along with that for a bit. But I’ve fallen in love with them. They’re so nice to use with 1Password. I suppose I might want to stop using 1Password someday, but it still has all my passwords as well so I can just fallback to those. And, honestly, only a fraction of the sites I have in 1Password have PassKeys available. What I hate much more is sites that don’t have passwords and require you to log in via email every time. It drives me NUTS.
- andrewmcwatters 1y ago
  I get the security behind email-only sign in, but waiting on mail servers is so slow!
  - SchemaLoad 1y ago
    Passkeys are honestly the most frictionless system. No more waiting for 2FA codes and having to type them in. No more getting locked out of your accounts if you lose your phone.
    - EbNar 1y ago
      With Bitwarden the 2FA codes are copied automatically to the clipboard, being thus just a "ctrl+v" away.
- eddyg 1y ago
  Passkeys are fantastic! I encourage my family and friends to utilize them as an alternative to passwords whenever possible. Compared to everything else, they are so much of a nicer experience. I despise the "click the link we just emailed you" so much. And MFA is a pain, and still has security issues: https://blog.talosintelligence.com/state-of-the-art-phishing-mfa-bypass/ https://blog.talosintelligence.com/state-of-the-art-phishing... I really don't get all the hate for Passkeys on HN...
  - recursive 1y ago
skybrian 1y ago
Passkeys are an API that requires the use of a password manager. It doesn’t lock you into any hardware any more than your password manager does already. You can’t copy a passkey to a different password manager, but you can create a new one for the same account, which is usually just as good.
deleted 1y ago
[deleted]
palata 1y ago
I use Yubikeys as my passkeys, and in terms of security it's strictly superior to passwords. > seemingly no one besides maybe Bitwarden supports exporting them. Which seems pointless, because I don't know of any platform that supports importing them That may still change in the future :-). The thing is that the technology allows it, which is good, right?

advisedwang 1y ago

Password/TOTP does not protect you against phishing. The phishing site can forward the password and TOTP you type into the real system, gaining your access. FIDO/WebAuthn/Passkeys protect you against phishing, because of the origin binding mentioned in the article. On the phishing site, the required credential cannot be generated, and so no matter how convincing it is you can't accidentally give them a credential to forward. Phishing is what these systems were trying to defend against. Now if you were to say that the move from plain FIDO tied to a hardware key to passkeys tied to a Google account was a lock-in ploy ---- then I might be more inclined to agree.

jgalt212 1y ago
> The phishing site can forward the password and TOTP you type into the real system, gaining your access. To me this seems harder to pull off than a fraudulent password reset (either via social engineering, or a hacked email account). My TOTP fell in the drink a few years back, and some accounts very hard to reset and others were too easy.
- jerf 1y ago
  If you're targeting a particular person, social engineering is probably easier. If you just want to illicitly harvest some accounts, and aren't too worried about which ones, blasting out emails linking to hacked websites that fake the login & TOTP flow is very easy.
deleted 1y ago
[deleted]
andrewmcwatters 1y ago
Considering there's an entire portion of the software industry built on accepting a user's credentials and also prompting them for their TOTP, I don't think this really matters. It's not an acceptable trade-off. And the answer isn't, "Those third-parties shouldn't be asking for your password and TOTP," because that's not a realistic premise.

pottertheotter 1y ago

A couple years ago there were several posts here about not using PassKeys, and I went along with that for a bit. But I’ve fallen in love with them. They’re so nice to use with 1Password. I suppose I might want to stop using 1Password someday, but it still has all my passwords as well so I can just fallback to those. And, honestly, only a fraction of the sites I have in 1Password have PassKeys available. What I hate much more is sites that don’t have passwords and require you to log in via email every time. It drives me NUTS.

andrewmcwatters 1y ago
I get the security behind email-only sign in, but waiting on mail servers is so slow!
- SchemaLoad 1y ago
  Passkeys are honestly the most frictionless system. No more waiting for 2FA codes and having to type them in. No more getting locked out of your accounts if you lose your phone.
  - EbNar 1y ago
    With Bitwarden the 2FA codes are copied automatically to the clipboard, being thus just a "ctrl+v" away.
eddyg 1y ago
Passkeys are fantastic! I encourage my family and friends to utilize them as an alternative to passwords whenever possible. Compared to everything else, they are so much of a nicer experience. I despise the "click the link we just emailed you" so much. And MFA is a pain, and still has security issues: https://blog.talosintelligence.com/state-of-the-art-phishing-mfa-bypass/ https://blog.talosintelligence.com/state-of-the-art-phishing... I really don't get all the hate for Passkeys on HN...
- recursive 1y ago

skybrian 1y ago

Passkeys are an API that requires the use of a password manager. It doesn’t lock you into any hardware any more than your password manager does already. You can’t copy a passkey to a different password manager, but you can create a new one for the same account, which is usually just as good.

deleted 1y ago

[deleted]

palata 1y ago

I use Yubikeys as my passkeys, and in terms of security it's strictly superior to passwords. > seemingly no one besides maybe Bitwarden supports exporting them. Which seems pointless, because I don't know of any platform that supports importing them That may still change in the future :-). The thing is that the technology allows it, which is good, right?