3 ms·

is it fair to say all passkey implementations have this advantage while only some password implementations can match?

by mi_lk 8mo ago

simoncion 8mo ago
It is absolutely unfair to say it. Just like passwords stored in a password manager, passkeys can be copied out of the device for safekeeping. Because you can copy them out, a user can be induced to give them to someone. I saw passkey boosters go very, very rapidly from "Passkeys are immune to phishing!" to "Passkeys are phishing resistant!" when lots of real-world people started using passkeys and demonstrated that you absolutely must have a way to back them up and move them around.
- lxgr 8mo ago
  > passkeys can be copied out of the device for safekeeping You can't copy them out on at least the iOS, Android, and (to my knowledge) Windows default implementations. > lots of real-world people started using passkeys and demonstrated that you absolutely must have a way to back them up and move them around. Millions of people use them without being able to move them around in the way you describe.
  - simoncion 8mo ago
    > You can't copy them out on at least the iOS, Android, and (to my knowledge) Windows default implementations. Pardon? The official support docs disagree with you [0][1][2]. They absolutely leave the device. Other passkey managers let them leave the device in a way that you control, but even the default ones copy them off the system they were created on. [0] <https://support.google.com/accounts/answer/6197437?hl=en&co=GENIE.Platform%3DAndroid https://support.google.com/accounts/answer/6197437?hl=en&co=...> [1] <https://support.apple.com/guide/iphone/passwords-devices-iph82d6721b2/ios https://support.apple.com/guide/iphone/passwords-devices-iph...> [2] Examine the "Can I use passkeys across multiple devices?" Q and its A here: <https://support.microsoft.com/en-us/windows/passkeys-frequently-asked-questions-faq-0782c301-4b25-4a26-b7fd-3a7637d5fdd3 https://support.microsoft.com/en-us/windows/passkeys-frequen...>
    - lxgr 8mo ago
      Yes, they're synchronized, but I wouldn't call that "copying them out", as that to me implies somehow getting access to the raw private key or root secret bytes. Both Apple and Google have pretty elaborate ceremonies for adding a new device to an existing account in a way that synchronizes over passkeys.
      - simoncion 8mo ago
        > ...as that to me implies somehow getting access to the raw private key or root secret bytes. When passkeys were first introduced, they were 100% stuck to the device that they were created. There was absolutely no real way to copy them off. This is when proponents were -correctly- making the claim that they were immune to phishing. When lots of users (who -notably- were not supported by whole-ass IT departments who set up and run systems that handle provisioning and enrolling new devices) started using passkeys, the correctness of the thing that many non-boosters were screaming ("You have to have a way to back these up and move them between devices!") became abundantly clear. Passkeys became something that could be copied off of devices, and proponents -correctly- switched to the claim "Passkeys are phishing resistant". Once things switched around so that passkeys were no longer stuck on a single device, third-party managers got the ability to manage and copy passkeys. [0] Hopefully it's now clear that the shift from "they never leave the device" to "they do leave the device" (and the consequences of this change) is what I'm talking about. [0] At least, they will for the next five, ten years until the big players decide that it's okay to use attestation to lock them out to "enhance security".
        Terr_ 8mo ago
        It sounds like part of the problem is that two rather separate standards of "phishing" are getting conflated: 1. "Hi, I'm your bank, log in just like you normally do." (Passkeys immune.) 2. "Hi, I'm your bank, do something strange I've never ever asked you to do before by uploading some special files or running this sketchy program." (Passkeys just resist.) The problem with the expansive definition is it basically starts to encompass every kind of trick or social-engineering ever.
- fc417fc802 8mo ago
  That qualifies as "immune to phishing" as far as I'm concerned. No reasonable person using a reasonable implementation will ever be successfully victimized in that manner. We need to stop pretending that padded cells for the criminally incompetent are a desirable design target. If you are too stupid to realize that you are being taken for a ride when asked to go through a manual export process and fork over sensitive information (in this case your passkeys) to a third party then you have no business managing sensitive information to begin with. Such people should not have online accounts. We should not design technology to accommodate that level of incompetence. If you can't stop driving your car into pedestrians in crosswalks you lose your license. If you can't stop handing over your bank account number to strangers who call you on the phone you lose all of your money. If you eat rotten food you get sick and possibly die. If you hop a fence and proceed to fall off of the cliff behind it you will most likely perish. To some extent the world inherently has sharp edges and we need to stop pretending that it doesn't because when we do that it makes the world a worse place.

is it fair to say all passkey implementations have this advantage while only some password implementations can match?

by mi_lk 8mo ago

is it fair to say all passkey implementations have this advantage while only some password implementations can match?

It is absolutely unfair to say it. Just like passwords stored in a password manager, passkeys can be copied out of the device for safekeeping. Because you can copy them out, a user can be induced to give them to someone. I saw passkey boosters go very, very rapidly from "Passkeys are immune to phishing!" to "Passkeys are phishing resistant!" when lots of real-world people started using passkeys and demonstrated that you absolutely must have a way to back them up and move them around.

lxgr 8mo ago
> passkeys can be copied out of the device for safekeeping You can't copy them out on at least the iOS, Android, and (to my knowledge) Windows default implementations. > lots of real-world people started using passkeys and demonstrated that you absolutely must have a way to back them up and move them around. Millions of people use them without being able to move them around in the way you describe.
- simoncion 8mo ago
  > You can't copy them out on at least the iOS, Android, and (to my knowledge) Windows default implementations. Pardon? The official support docs disagree with you [0][1][2]. They absolutely leave the device. Other passkey managers let them leave the device in a way that you control, but even the default ones copy them off the system they were created on. [0] <https://support.google.com/accounts/answer/6197437?hl=en&co=GENIE.Platform%3DAndroid https://support.google.com/accounts/answer/6197437?hl=en&co=...> [1] <https://support.apple.com/guide/iphone/passwords-devices-iph82d6721b2/ios https://support.apple.com/guide/iphone/passwords-devices-iph...> [2] Examine the "Can I use passkeys across multiple devices?" Q and its A here: <https://support.microsoft.com/en-us/windows/passkeys-frequently-asked-questions-faq-0782c301-4b25-4a26-b7fd-3a7637d5fdd3 https://support.microsoft.com/en-us/windows/passkeys-frequen...>
  - lxgr 8mo ago
    Yes, they're synchronized, but I wouldn't call that "copying them out", as that to me implies somehow getting access to the raw private key or root secret bytes. Both Apple and Google have pretty elaborate ceremonies for adding a new device to an existing account in a way that synchronizes over passkeys.
    - simoncion 8mo ago
      > ...as that to me implies somehow getting access to the raw private key or root secret bytes. When passkeys were first introduced, they were 100% stuck to the device that they were created. There was absolutely no real way to copy them off. This is when proponents were -correctly- making the claim that they were immune to phishing. When lots of users (who -notably- were not supported by whole-ass IT departments who set up and run systems that handle provisioning and enrolling new devices) started using passkeys, the correctness of the thing that many non-boosters were screaming ("You have to have a way to back these up and move them between devices!") became abundantly clear. Passkeys became something that could be copied off of devices, and proponents -correctly- switched to the claim "Passkeys are phishing resistant". Once things switched around so that passkeys were no longer stuck on a single device, third-party managers got the ability to manage and copy passkeys. [0] Hopefully it's now clear that the shift from "they never leave the device" to "they do leave the device" (and the consequences of this change) is what I'm talking about. [0] At least, they will for the next five, ten years until the big players decide that it's okay to use attestation to lock them out to "enhance security".
      - Terr_ 8mo ago
        It sounds like part of the problem is that two rather separate standards of "phishing" are getting conflated: 1. "Hi, I'm your bank, log in just like you normally do." (Passkeys immune.) 2. "Hi, I'm your bank, do something strange I've never ever asked you to do before by uploading some special files or running this sketchy program." (Passkeys just resist.) The problem with the expansive definition is it basically starts to encompass every kind of trick or social-engineering ever.
fc417fc802 8mo ago
That qualifies as "immune to phishing" as far as I'm concerned. No reasonable person using a reasonable implementation will ever be successfully victimized in that manner. We need to stop pretending that padded cells for the criminally incompetent are a desirable design target. If you are too stupid to realize that you are being taken for a ride when asked to go through a manual export process and fork over sensitive information (in this case your passkeys) to a third party then you have no business managing sensitive information to begin with. Such people should not have online accounts. We should not design technology to accommodate that level of incompetence. If you can't stop driving your car into pedestrians in crosswalks you lose your license. If you can't stop handing over your bank account number to strangers who call you on the phone you lose all of your money. If you eat rotten food you get sick and possibly die. If you hop a fence and proceed to fall off of the cliff behind it you will most likely perish. To some extent the world inherently has sharp edges and we need to stop pretending that it doesn't because when we do that it makes the world a worse place.