29 ms·

I implemented passkeys @ $WORK, and we rolled it out to our tech department only first. Nobody could make it work reliably, and troubleshooting it was basically

by zie 1y ago

I implemented passkeys @ $WORK, and we rolled it out to our tech department only first. Nobody could make it work reliably, and troubleshooting it was basically impossible. The best you could do was just wipe their passkeys and have them try again. I've since disabled passkey support and we have no plans to attempt a new rollout anytime soon. As far as I can tell the only people that have "successfully" rolled out passkeys are the companies with effectively zero user support and they just refuse to support passkeys at all, so if they don't work for a particular user: whatever. TOTP is fully rolled out and well supported. Troubleshooting it is "hard", but at least it's possible. TOTP troubleshooting basically boils down to 3 things: * Server time * User Phone/device time(most users opt to use their phone to generate TOTP, but we don't care) * More than one TOTP saved for a given site(i.e. they didn't replace the old and created a new TOTP shared key) or not saved at all. Our tech/user support helpdesk can handle this but it took a lot of training. We built special tools. We still get requests from them when they get overwhelmed with the complexity. Passkey troubleshooting: * Mobile network, including bluetooth * Server network connectivity * Computer/device network, including BT connectivity to mobile device. Most tech support can't handle that much complexity at once. Shoot, most developers and tech "whiz" people can't either. The error messages one does get, if they are lucky, are very general and not helpful at all(last I checked). Passkeys are not currently fit for production where you have to support the users. I hope they get there. 1Password is the only client/device implementation of Passkeys that pretty much just works. It saves the passkey in the 1p vault, and the 1p vault can be synced across devices.

Spooky23 1y ago
The problem with TOTP is that it isn’t a second factor. It’s like Kerberos for the web. Passkeys are similar, only allow hardware devices with PIN.
- LelouBil 1y ago
  How is it not a second factor ? It's something else that is unrelated to your password that you have to provide in order to log in, is that not the definition of a factor of authentication ? Because it's phishable ?
  - jerf 1y ago
    Passwords are "something you know". TOTP is "something you know". It wanted to be "something you have", but it's not. Proof: I can put TOTP tokens into my password manager now. Anything that can go into my password manager is proved to be "something I know" by the fact I can put it into my password manager. Incidentally, passkeys go into my password manager too. You can probably work the math from there. (I'm heterodox on this matter, though. I don't believe in the existence of "things you are" and "things you have". I think it's all ultimately just "things you know" and it's all better analyzed in terms of the cost of knowing and proving knowledge, and that the 3-factor framework for authentication is wrong.)
    - maple3142 1y ago
      Isn't it the same for passkeys? I can put passkeys in password managers like Bitwarden, 1password, ...
      - shim__ 1y ago
        You can but the server can require an device attestation during registration, proving that you're actually using an Yubikey or whatever. That isn't possible with TOTP
      - jerf 1y ago
        > > Incidentally, passkeys go into my password manager too. You can probably work the math from there.
      - Spooky23 1y ago
        Yes. Passkeys help with the bad password problem. That’s a big deal but doesn’t magically solve everything. To address other security risks more comprehensively, you need to have a tight issuance process and use something key based in hardware. I’m working on a project where we deploy Yubi keys or similar, with an audit trial of which is used by who. High trust environments need things like enterprise attestation and a solid issuance process to meet the control needs. Back in the day, the NIST standards required a chain of custody log of the token - you could only use in person delivery or registered mail to send them. That’s overkill, but the point is the technology is only one part of the solution for these problems.
- zie 1y ago
  Regardless, TOTP is way better than passwords alone, or SMS as another factor. It's also the only one that can be deployed at scale that is supportable. I hope Passkeys will become deployable, but the last few times we tried public key auth over web, it hasn't really work out all that well. However nobody but the DOD has been able to support it, and they only support it by brute force. It's not really deployable by anyone else. TLS client certs were never even tried seriously the UX was never remotely good enough. I fear Passkeys will be basically the same problem. UX is fine on the happy path, but the unhappy path is littered with broken at every turn.

by zie 1y ago

Spooky23 1y ago

The problem with TOTP is that it isn’t a second factor. It’s like Kerberos for the web. Passkeys are similar, only allow hardware devices with PIN.

LelouBil 1y ago
How is it not a second factor ? It's something else that is unrelated to your password that you have to provide in order to log in, is that not the definition of a factor of authentication ? Because it's phishable ?
- jerf 1y ago
  Passwords are "something you know". TOTP is "something you know". It wanted to be "something you have", but it's not. Proof: I can put TOTP tokens into my password manager now. Anything that can go into my password manager is proved to be "something I know" by the fact I can put it into my password manager. Incidentally, passkeys go into my password manager too. You can probably work the math from there. (I'm heterodox on this matter, though. I don't believe in the existence of "things you are" and "things you have". I think it's all ultimately just "things you know" and it's all better analyzed in terms of the cost of knowing and proving knowledge, and that the 3-factor framework for authentication is wrong.)
  - maple3142 1y ago
    Isn't it the same for passkeys? I can put passkeys in password managers like Bitwarden, 1password, ...
    - shim__ 1y ago
      You can but the server can require an device attestation during registration, proving that you're actually using an Yubikey or whatever. That isn't possible with TOTP
    - jerf 1y ago
      > > Incidentally, passkeys go into my password manager too. You can probably work the math from there.
    - Spooky23 1y ago
      Yes. Passkeys help with the bad password problem. That’s a big deal but doesn’t magically solve everything. To address other security risks more comprehensively, you need to have a tight issuance process and use something key based in hardware. I’m working on a project where we deploy Yubi keys or similar, with an audit trial of which is used by who. High trust environments need things like enterprise attestation and a solid issuance process to meet the control needs. Back in the day, the NIST standards required a chain of custody log of the token - you could only use in person delivery or registered mail to send them. That’s overkill, but the point is the technology is only one part of the solution for these problems.
zie 1y ago
Regardless, TOTP is way better than passwords alone, or SMS as another factor. It's also the only one that can be deployed at scale that is supportable. I hope Passkeys will become deployable, but the last few times we tried public key auth over web, it hasn't really work out all that well. However nobody but the DOD has been able to support it, and they only support it by brute force. It's not really deployable by anyone else. TLS client certs were never even tried seriously the UX was never remotely good enough. I fear Passkeys will be basically the same problem. UX is fine on the happy path, but the unhappy path is littered with broken at every turn.