4 ms·

Replace the word passkey with password in your comment. What’s the benefit of passkeys again? If you’re not storing the actual private key in the Secure Enclav

by phs318u 3mo ago

Replace the word passkey with password in your comment. What’s the benefit of passkeys again? If you’re not storing the actual private key in the Secure Enclave but only the “access to it” what’s changed from how Apple’s keychain already manages password syncing to iCloud? The only benefit (and it’s still a decent one) is that some random website breach can’t disclose your private key.

krferriter 3mo ago
A random website breach can't disclose your password either, assuming you use random high-entropy passwords and the website only stores a hash of it. I haven't really seen the benefit to passkeys over passwords. Pretty much everyone is using a password management service that securely syncs both passwords and passkeys across devices. In that context I don't see the difference.
- thewebguyd 3mo ago
  > Pretty much everyone is using a password management service In the US, only about 34 to 36% of adults use a password manager. Of the ~64% that don't, an alarming 20% reuse the same password across almost every service, and a ton just rely on browser autofill. If you use a password manager, you are in the minority. Hell, even if you don't use a PW manager and you at least use a different password for different services, you are ahead of most people. The general population is largely computer illiterate, and have a staggering lack of basic security hygiene.
  - inigyou 3mo ago
    FWIW, browser autofill is a basic password manager.
    - krferriter 2mo ago
      Chrome password manager and Apple Passwords count, in this context.
deleted 3mo ago
[deleted]
mwwaters 3mo ago
The far bigger benefit is phishing resistance (with hardware-contained keys themselves being phishing-proof on a non-compromised system). It moves to the account recovery flows, but that can be much more difficult to phish.
- inigyou 3mo ago
  Why would a key need to be "hardware-contained" to be difficult to phish? My SSH private key is unphishable and it's right there in a file. It's unphishable because I know there's never ever a reason to send it to someone - in a scenario where that would be needed, I'd generate a new key just for that situation.
  - ptman 2mo ago
    Desktop operating systems don't have very good separation between programs. If some malware gets access, it will be looking for e.g. ssh keys and using a keylogger to get the passphrase if you encrypted your ssh keys. Tpm protected passkeys are much better protected
    - inigyou 2mo ago
      That attack isn't phishing
coffe2mug 2mo ago
A random app cannot eat your passkey. Platform authentication ensures more safety. I am not an expert but definitely it does use secure enclave in some ways(maybe decryption). UX usability is far better. With password and 2FA you have at least 2 steps. Here Open the app: device like phone or laptop just asks your fingerprint or facial and done. That is a great benefit for average Joe. Some one trying to scam remotely cannot access the account. The 89 year old grandma will say - I just give fingerprint. Done. Yes, it won't cover all situations. Like if there is sim swap or bank employee does fraud.

by phs318u 3mo ago

krferriter 3mo ago

A random website breach can't disclose your password either, assuming you use random high-entropy passwords and the website only stores a hash of it. I haven't really seen the benefit to passkeys over passwords. Pretty much everyone is using a password management service that securely syncs both passwords and passkeys across devices. In that context I don't see the difference.

thewebguyd 3mo ago
> Pretty much everyone is using a password management service In the US, only about 34 to 36% of adults use a password manager. Of the ~64% that don't, an alarming 20% reuse the same password across almost every service, and a ton just rely on browser autofill. If you use a password manager, you are in the minority. Hell, even if you don't use a PW manager and you at least use a different password for different services, you are ahead of most people. The general population is largely computer illiterate, and have a staggering lack of basic security hygiene.
- inigyou 3mo ago
  FWIW, browser autofill is a basic password manager.
  - krferriter 2mo ago
    Chrome password manager and Apple Passwords count, in this context.

deleted 3mo ago

[deleted]

mwwaters 3mo ago

The far bigger benefit is phishing resistance (with hardware-contained keys themselves being phishing-proof on a non-compromised system). It moves to the account recovery flows, but that can be much more difficult to phish.

inigyou 3mo ago
Why would a key need to be "hardware-contained" to be difficult to phish? My SSH private key is unphishable and it's right there in a file. It's unphishable because I know there's never ever a reason to send it to someone - in a scenario where that would be needed, I'd generate a new key just for that situation.
- ptman 2mo ago
  Desktop operating systems don't have very good separation between programs. If some malware gets access, it will be looking for e.g. ssh keys and using a keylogger to get the passphrase if you encrypted your ssh keys. Tpm protected passkeys are much better protected
  - inigyou 2mo ago
    That attack isn't phishing

coffe2mug 2mo ago

A random app cannot eat your passkey. Platform authentication ensures more safety. I am not an expert but definitely it does use secure enclave in some ways(maybe decryption). UX usability is far better. With password and 2FA you have at least 2 steps. Here Open the app: device like phone or laptop just asks your fingerprint or facial and done. That is a great benefit for average Joe. Some one trying to scam remotely cannot access the account. The 89 year old grandma will say - I just give fingerprint. Done. Yes, it won't cover all situations. Like if there is sim swap or bank employee does fraud.