4 ms·
> the only possible way to compete with that UX is to sync the private key across the user’s devices This is my issue with passkeys. Either we lessen securit
by phs318u 2mo ago
> the only possible way to compete with that UX is to sync the private key across the user’s devices
This is my issue with passkeys. Either we lessen security to improve UX (syncing across devices implies extracting private keys from secure enclaves, at which point it’s no different to password syncing), or we have a proliferation of different keys per website across devices (assuming the website supports multiple passkeys).
Perhaps this trade off is not resolvable in a way that happily satisfies both the security constraint and the UX requirement.
- Ajedi32 2mo ago"A better version of password syncing" is exactly what Passkeys are and ought to be. Just like passwords, but unphishable, unguessable, not reusable across sites, not vulnerable to data breaches, and with better UX. Stranding private keys in clone resistant secure enclaves has unacceptably bad UX for the average user, which is why very few implementations try to do that.
- inigyou 2mo agoSo just a password manager?
- jesseendahl 2mo agoPasswords are still significantly less secure than passkeys even when using a password manager.
- inigyou 2mo agoWhy?
- coffe2mug 2mo agoPasskeys cannot be stolen. Yes, don't say that what if someone steals my iPhone, PIN, and adds their fingerprint. Let's say eBay asks user to login. With passkey. Press and hold fingerprint etc. login done. Even with laptop. And average Joe doesn't want to maintain a keepassdatabse sync it. Yes, you can always use your own server etc but others have life.
- inigyou 2mo agohow do I back it up and transfer it to a new device? This is relevant because an attacker can also do that.
- coffe2mug 2mo agoBuy a new iPhone. Sign into it. Everything is now available. That is the reason: for the average Joe not having exportable passkeys is good. Average Joe doesn't have to do backup. It is all automatic.
- someguydave 2mo agoHiding the underlying exchange of data from the user does not mean the data is unstealable
- coffe2mug 2mo agoWith your logic nothing is unstealable. Go and watch film inception. The main point is the average Joe it works seamless. And average Joe won't have to remember things. Yes, it does. Not everyone wants to maintain password database.
- deleted 2mo ago[deleted]
- Ajedi32 2mo agoBecause as I just outlined, passwords, even when stored in a password manager, can be misused. (Phished, set to something weak/guessable, reused on multiple sites, leaked in a database breach, etc.) Password managers make it easier to avoid those pitfalls, but passkeys make it nearly impossible to fall into them.
- deleted 2mo ago[deleted]
- crote 2mo ago> at which point it’s no different to password syncing You still get the phishing resistance, though!
- choo-t 2mo agoPassword managers prevent phishing as they check for the domain name before inputing the password.
- jesseendahl 2mo agoPassword managers do not architecturally, cryptographically make phishing impossible. Ultimately a user can still be tricked to copy/paste their passwords into fake websites, even when using a password manager. You could blame end-users for this behavior, but attackers don't care about blame. Ultimately, it doesn't matter who's at fault when there are massive phishing attacks happening at scale every single hour of every day. The only real solution to solve this problem for the entire internet is to make credentials architecturally, cryptographically unphishable by design. That's what passkeys give you.
- TeMPOraL 2mo agoIs the "phishing resistance" just inability to view and manage your own data? That's a bug, not a feature then.
- coffe2mug 2mo agoDownloading and keeping safe local data is a bug for others
- TeMPOraL 2mo agoIt's still ignoring one of the main features of passwords for regular people, which is authority delegation via password sharing, aka. "could you please log in to my ${service} and do ${something}, my password is ${password}...". Yes, that is a feature and a normal use case that has equivalents in meat space, that security aficionados refuse to recognize even exists, much less support.
- lazide 2mo agoNot only that, they don’t need to worry if they lose their phone they’re locked out of their accounts too!