5 ms·

What I don't understand with the push for passkeys, is that for years we have been told we need at least two factors for secure authentication, something we hav

What I don't understand with the push for passkeys, is that for years we have been told we need at least two factors for secure authentication, something we have and something we know. Now with passkeys, it seems we are just throwing all those arguments overboard and are saying 1 factor (something you have, e.g. hardware device) is enough. I've not read anywhere a good argument why. Sometimes people have been arguing that the passkey should still be locked into e.g. another password manager with password, but that doesn't seem to be the case with most implementations, am I missing something?

kemotep 1y ago
Passkeys are quite disappointing in practice. I feel like they were described as ssh keys for website logins but they seem to be half-baked. Accessibility concerns and vendor lock-in are certainly an issue. Definitely stick to keeping passwords and passkeys in a password manager for portability. KeepassXC and Bitwarden (which can be self-hosted) work best for this in my opinion.
- al_borland 1y ago
  Why would I keep them separate? What does this achieve?
  - anonymars 1y ago
    Are you replying to the right post or did parent edit?
    - al_borland 1y ago
      I’m now not sure if there was an edit or if my brain inserted a word. When I replied, I thought I read that they were saying to keep passwords and passkeys in separate password managers, but maybe I’m just going crazy.
  - kemotep 1y ago
    Keep what separate?
lathiat 1y ago
There’s a slight improvement in that the passkey will only transmit to the correct website. Cannot select and fill it to the wrong domain. But other than that I agree. Especially now that these synchronise with iCloud, BitWarden, etc seems a no brainer you can just steal these and access everyone’s accounts in many cases with no extra 2nd factor. This confuses me too.
8fingerlouie 1y ago
Passkeys are basically just asymmetric encryption. When you create a passkey, you upload the public key to the website, and the private key stays on your device. That greatly reduces your risk if/when credentials gets leaked from the site in question. Public keys are meant to be public, and worthless by themselves. As for your private key, that usually ends up in a secure enclave or similar HSM, which in turn is protected by a pin code and face or fingerprints. The private key then becomes "something you know", and your biometrics are "something you have".
- pferde 1y ago
  Just an almost meaningless nitpick, but biometrics are "something you are", aka. the third of the famed three factors. :)
  - 8fingerlouie 1y ago
    Well, biometrics usually act as a proxy for PIN codes, so the PIN code is something you know, the private key is something you have, and biometrics is authentication. And yes, nitpicking :)
  - nulbyte 1y ago
    I'll never understand this. I am not a fingerprint.
    - mzajc 1y ago
      You are a human, and humans have permanent fingerprints. The difference between "something you have" and "something you are" is that you can regenerate the former, but not the latter.
      - 8fingerlouie 1y ago
        That kinda leaves (current) biometrics in a gray zone, as fingerprints and faces can be regenerated. You literally leave your fingerprint on every surface you touch, and faces can be covertly photographed.
al_borland 1y ago
My view with passkeys was basically that they force the use of a password manager (even if that manager is mostly invisible to the user). The password manager is something you have and you unlock it with something you know or something you are (biometrics). That said, I don’t like them. I don’t really understand what happens when I run into edge cases, and that makes me nervous. That’s also true for 2FA in many cases. So far my only passkey is for Amazon, I felt tricked into it, which I’m not happy about, though my password also still works. I’m opposed to this about as much as forced 2FA. I understand the security aspect, it Gmail randomly started to use their mobile app for 2FA, and now I’m afraid if I delete the app from my phone I’ll be locked out of my account, with the potential for excessive hoop jumping to get it back. I read an article a while ago with the ultimately conclusion that passkeys don’t offer a major benefit to people who already use long, complex, unique passwords in a password manager. If this is the case, it seems this whole push is designed for people with terrible password habits, who definitely don’t understand what’s going on with passkeys, and I expect will find out once they hit an edge case and end up in a bad spot.
- dchest 1y ago
  The article is wrong: users copy passwords from their password manager into the website if the autofill doesn't work => phishing. Can't do this with passkeys. Agree with your other points, the whole passkey story is undeveloped and unclear yet.
  - al_borland 1y ago
    There are many non-phishing times my password manager fails to autofill. That’s a problem, as it does lead people to get lazy. However, it will show the login, that I’m on the right site, it just won’t fill it. In these situations, I do end up copy/pasting it in. It’s my only option. If passkeys break in this way, for whatever reason, you’re just screwed. There are also times when companies change their URL. Or their app using a different URL for their auth API than the website URL. If it’s obvious, the new URL can be added to the password manager to fix this. If it’s an API the user can’t see, this is much more difficult, especially if using a 3rd party password manager, it’s basically impossible. The only thing that made me aware of this, was when Apple introduced their password management and I could see all the login data if saved from various app. All kinds of URLs that were otherwise invisible to me. What happens to a passkey in this case? Make a new account, start over?
dspillett 1y ago
> Now with passkeys, it seems we are just throwing all those arguments overboard and are saying 1 factor (something you have, e.g. hardware device) is enough. That was my initial reaction too. I think the assumption is that the second factor is what-ever you use to unlock your device (a “something you know” if that is a password/pasphrase or “something you are” if that is biometrics). I'm not convinced any of it is as more secure than user+pass as is being claimed. passkeys being device/AU dependent adds a bit of hardship to someone trying to hack your account, but people seem to be suggesting sharing passkeys between devices/AUs using their pasword managers which nullifies that effect?
burnt-resistor 1y ago
PKs are a lie and closeted 1 factor with vendor lock-in.

kemotep 1y ago

Passkeys are quite disappointing in practice. I feel like they were described as ssh keys for website logins but they seem to be half-baked. Accessibility concerns and vendor lock-in are certainly an issue. Definitely stick to keeping passwords and passkeys in a password manager for portability. KeepassXC and Bitwarden (which can be self-hosted) work best for this in my opinion.

al_borland 1y ago
Why would I keep them separate? What does this achieve?
- anonymars 1y ago
  Are you replying to the right post or did parent edit?
  - al_borland 1y ago
    I’m now not sure if there was an edit or if my brain inserted a word. When I replied, I thought I read that they were saying to keep passwords and passkeys in separate password managers, but maybe I’m just going crazy.
- kemotep 1y ago
  Keep what separate?

lathiat 1y ago

There’s a slight improvement in that the passkey will only transmit to the correct website. Cannot select and fill it to the wrong domain. But other than that I agree. Especially now that these synchronise with iCloud, BitWarden, etc seems a no brainer you can just steal these and access everyone’s accounts in many cases with no extra 2nd factor. This confuses me too.

8fingerlouie 1y ago

Passkeys are basically just asymmetric encryption. When you create a passkey, you upload the public key to the website, and the private key stays on your device. That greatly reduces your risk if/when credentials gets leaked from the site in question. Public keys are meant to be public, and worthless by themselves. As for your private key, that usually ends up in a secure enclave or similar HSM, which in turn is protected by a pin code and face or fingerprints. The private key then becomes "something you know", and your biometrics are "something you have".

pferde 1y ago
Just an almost meaningless nitpick, but biometrics are "something you are", aka. the third of the famed three factors. :)
- 8fingerlouie 1y ago
  Well, biometrics usually act as a proxy for PIN codes, so the PIN code is something you know, the private key is something you have, and biometrics is authentication. And yes, nitpicking :)
- nulbyte 1y ago
  I'll never understand this. I am not a fingerprint.
  - mzajc 1y ago
    You are a human, and humans have permanent fingerprints. The difference between "something you have" and "something you are" is that you can regenerate the former, but not the latter.
    - 8fingerlouie 1y ago
      That kinda leaves (current) biometrics in a gray zone, as fingerprints and faces can be regenerated. You literally leave your fingerprint on every surface you touch, and faces can be covertly photographed.

al_borland 1y ago

My view with passkeys was basically that they force the use of a password manager (even if that manager is mostly invisible to the user). The password manager is something you have and you unlock it with something you know or something you are (biometrics). That said, I don’t like them. I don’t really understand what happens when I run into edge cases, and that makes me nervous. That’s also true for 2FA in many cases. So far my only passkey is for Amazon, I felt tricked into it, which I’m not happy about, though my password also still works. I’m opposed to this about as much as forced 2FA. I understand the security aspect, it Gmail randomly started to use their mobile app for 2FA, and now I’m afraid if I delete the app from my phone I’ll be locked out of my account, with the potential for excessive hoop jumping to get it back. I read an article a while ago with the ultimately conclusion that passkeys don’t offer a major benefit to people who already use long, complex, unique passwords in a password manager. If this is the case, it seems this whole push is designed for people with terrible password habits, who definitely don’t understand what’s going on with passkeys, and I expect will find out once they hit an edge case and end up in a bad spot.

dchest 1y ago
The article is wrong: users copy passwords from their password manager into the website if the autofill doesn't work => phishing. Can't do this with passkeys. Agree with your other points, the whole passkey story is undeveloped and unclear yet.
- al_borland 1y ago
  There are many non-phishing times my password manager fails to autofill. That’s a problem, as it does lead people to get lazy. However, it will show the login, that I’m on the right site, it just won’t fill it. In these situations, I do end up copy/pasting it in. It’s my only option. If passkeys break in this way, for whatever reason, you’re just screwed. There are also times when companies change their URL. Or their app using a different URL for their auth API than the website URL. If it’s obvious, the new URL can be added to the password manager to fix this. If it’s an API the user can’t see, this is much more difficult, especially if using a 3rd party password manager, it’s basically impossible. The only thing that made me aware of this, was when Apple introduced their password management and I could see all the login data if saved from various app. All kinds of URLs that were otherwise invisible to me. What happens to a passkey in this case? Make a new account, start over?

dspillett 1y ago

> Now with passkeys, it seems we are just throwing all those arguments overboard and are saying 1 factor (something you have, e.g. hardware device) is enough. That was my initial reaction too. I think the assumption is that the second factor is what-ever you use to unlock your device (a “something you know” if that is a password/pasphrase or “something you are” if that is biometrics). I'm not convinced any of it is as more secure than user+pass as is being claimed. passkeys being device/AU dependent adds a bit of hardship to someone trying to hack your account, but people seem to be suggesting sharing passkeys between devices/AUs using their pasword managers which nullifies that effect?

burnt-resistor 1y ago

PKs are a lie and closeted 1 factor with vendor lock-in.