4 ms·

100% of the arguments against using passkeys for e2ee data apply to using passkeys as credentials. (Unless they are not credentials, and you can loose them the

by hedora 8mo ago

100% of the arguments against using passkeys for e2ee data apply to using passkeys as credentials. (Unless they are not credentials, and you can loose them then do a password reset via a phishing prone channel like email and SMS. Supporting this eliminates any possible user benefit of passkeys.) In addition to the arguments in the article, when used as credentials, they are an obvious trojan horse allowing large websites to completely hijack your operating system. Don’t believe me? Try logging into a bank or using rideshare/parking/ev charging with degoogled android. This is where passkeys are taking PCs, and it is their only purpose. So, “Don’t use passkeys” would be a better title.

inkysigma 8mo ago
Passkeys are an open standard? You might as well argue against SSH keys.
- hedora 8mo ago
  The standard includes a hardware attestation path. That’s the backdoor allowing the eventual takeover of your OS. First people use passkeys, and they become standard. Then they become required for important accounts for security. Then the important accounts require the attestation bit. At that point, you cannot run web browsers on open source operating systems. This is all boring and predictable. It is exactly what they did with Android, and exactly the same organizations are pushing passkeys. Note: If they had good intentions, the operating system would manage any attestation, and not allow websites to query for or require attestation support.
  - johncolanduoni 8mo ago
    The attestation actually has nothing to do with the browser, only the holder of the passkey's key material. You can satisfy the attestation by having a passkey on your Android device and doing the normal Bluetooth flow with your Firefox browser on your Framework laptop. So this mechanism is totally useless for enacting this plan. The operating system doesn't manage attestation because that's totally useless for the stated goal of the attestation system. Enterprises don't want their SaaS vendors to accept passkeys from some random employee's BitWarden, instead of the hardware keys they issued the employee. If the OS manages attestation and doesn't send anything to the relying party, then it doesn't solve anybody's problem at all.
    - doubled112 8mo ago
      Does Firefox support the Bluetooth flow on Linux at this time?
      - johncolanduoni 8mo ago
        That's a matter of implementing an open standard. Google hasn't done anything to prevent open source browsers and OSes from implementing it, and nothing in the spec makes it difficult for Firefox/Linux specifically AFAICT.
    - hedora 8mo ago
      It seems like it will only be a matter of time before consumer sites start requiring a patched OS with an attestation bit set in the key. Also, as I understand it, sites can whitelist credential hardware. If not, then the attestation is security theater. I (or an attacker on your machine), can just make a sw emulator of a hw attestation device, and use that to protect my choice of OS, (and skim your credentials). If a whitelist exists, then my “hijack your OS” plan works: Require the builtin macos/windows/signed chrome on signed os password managers. That’s 90% of the market (and dropping) right now.
      - johncolanduoni 8mo ago
        As I said, the attestation structurally does NOT attest to your OS or your browser that are displaying the website performing the authentication. It attests to the device that holds the passkey's key material, which is usually not your desktop computer.
        Borealid 8mo ago
        The attestation is in fact readable by the FIDO Platform (the browser/OS). It is not encrypted to be readable only by the RP (web site). It talks about whatever you used to authenticate and the platform can manipulate (or omit) it.
        8mo ago
  - lxgr 8mo ago
    > The standard includes a hardware attestation path. Yes, and iOS and Android's Passkey implementation does not support it, since doing so would be lying about a given credential being hardware-backend when it's actually not (due to being cloud-synced and often recoverable via some process). Attestation is only for hardware authenticators, either dedicated ones like Yubikeys or non-synchronized Android WebAuthN credentials. (iOS only supports them in MDM contexts anymore, I believe.)
lxgr 8mo ago
> Don’t believe me? Try logging into a bank or using rideshare/parking/ev charging with degoogled android. What does root detection and other device attestation have to do with passkeys? Passkeys (at least Google's and Apple's) don't support device attestation.

by hedora 8mo ago

inkysigma 8mo ago

Passkeys are an open standard? You might as well argue against SSH keys.

hedora 8mo ago
The standard includes a hardware attestation path. That’s the backdoor allowing the eventual takeover of your OS. First people use passkeys, and they become standard. Then they become required for important accounts for security. Then the important accounts require the attestation bit. At that point, you cannot run web browsers on open source operating systems. This is all boring and predictable. It is exactly what they did with Android, and exactly the same organizations are pushing passkeys. Note: If they had good intentions, the operating system would manage any attestation, and not allow websites to query for or require attestation support.
- johncolanduoni 8mo ago
  The attestation actually has nothing to do with the browser, only the holder of the passkey's key material. You can satisfy the attestation by having a passkey on your Android device and doing the normal Bluetooth flow with your Firefox browser on your Framework laptop. So this mechanism is totally useless for enacting this plan. The operating system doesn't manage attestation because that's totally useless for the stated goal of the attestation system. Enterprises don't want their SaaS vendors to accept passkeys from some random employee's BitWarden, instead of the hardware keys they issued the employee. If the OS manages attestation and doesn't send anything to the relying party, then it doesn't solve anybody's problem at all.
  - doubled112 8mo ago
    Does Firefox support the Bluetooth flow on Linux at this time?
    - johncolanduoni 8mo ago
      That's a matter of implementing an open standard. Google hasn't done anything to prevent open source browsers and OSes from implementing it, and nothing in the spec makes it difficult for Firefox/Linux specifically AFAICT.
  - hedora 8mo ago
    It seems like it will only be a matter of time before consumer sites start requiring a patched OS with an attestation bit set in the key. Also, as I understand it, sites can whitelist credential hardware. If not, then the attestation is security theater. I (or an attacker on your machine), can just make a sw emulator of a hw attestation device, and use that to protect my choice of OS, (and skim your credentials). If a whitelist exists, then my “hijack your OS” plan works: Require the builtin macos/windows/signed chrome on signed os password managers. That’s 90% of the market (and dropping) right now.
    - johncolanduoni 8mo ago
      As I said, the attestation structurally does NOT attest to your OS or your browser that are displaying the website performing the authentication. It attests to the device that holds the passkey's key material, which is usually not your desktop computer.
      - Borealid 8mo ago
        The attestation is in fact readable by the FIDO Platform (the browser/OS). It is not encrypted to be readable only by the RP (web site). It talks about whatever you used to authenticate and the platform can manipulate (or omit) it.
        8mo ago
- lxgr 8mo ago
  > The standard includes a hardware attestation path. Yes, and iOS and Android's Passkey implementation does not support it, since doing so would be lying about a given credential being hardware-backend when it's actually not (due to being cloud-synced and often recoverable via some process). Attestation is only for hardware authenticators, either dedicated ones like Yubikeys or non-synchronized Android WebAuthN credentials. (iOS only supports them in MDM contexts anymore, I believe.)

lxgr 8mo ago

> Don’t believe me? Try logging into a bank or using rideshare/parking/ev charging with degoogled android. What does root detection and other device attestation have to do with passkeys? Passkeys (at least Google's and Apple's) don't support device attestation.