A rebuttal to an anti-passkey, pro-TOTP post that has made the rounds on Lemmy as well.
But most people don't have well managed passwords. And me having good password hygiene doesn't stop my data being hacked when someone working at a subcontracting firm to a company I use leaks all my data.
It also is annoying to have to log in over many steps with 2fa, often forced to email or SMS.
Collectively improving security benefits us all.
I think the point about lusers not being able to manage passwords has been argued to death elsewhere, so I won't take issue with that.
me having good password hygiene doesn't stop my data being hacked when someone working at a subcontracting firm to a company I use leaks all my data
What has this to do with passkeys? Are you sending your password in plaintext to the contractor who stores it that way, unencrypted? That's a separate problem entirely. The only benefit I see with just sending them your public key is that they can't leak your private key, whereas if you used one password for everything, and sent it to them, they could leak it.
Am I missing something? Would passkeys offer an advantage over a password manager? What if the website assigns you a password via DH so that users can't pick bad ones or reuse them, would it have the same advantages?
2FA can be super annoying, but again I think it's a separate issue. If I get control of your phone or laptop then 2FA might save you, but passkeys won't.
It sounds like they're saying that if you can manage your passwords then do so yourself and avoid passkeys, but if you can't/don't want to then use passkeys.
And they are pointing out that the company is far more likely to lose your password than you are.
Convenience vs security, but the weakest link is probably not the user.
I think you're mixing up compromise of an account with compromise of the data associated with that account.
If a particular piece of data is accessible to people of a dozen accounts, compromise of any of those accounts potentially compromises the data. That's a legitimate concern for people who want certain data secured, whether other accounts with access are also secure. In some cases, it may be best to have an authentication policy that provides a baseline level of protection even for the most clueless users, rather than a system where you're able to secure your own account.
I’m saying that bad user passwords allow data to be hacked. When it’s the credentials of someone with access, like an employee of companies with your data, then that data is more easily compromised if they have crappy passwords. It’s harder to compromise with passkeys. It is not just your password hygiene that protects your data.
Here is a recent example in Australia. https://www.abc.net.au/...
But that's exactly the problem. Those that were the target audience for the article do not have well managed passwords. For them the passkeys arguably do increase security, while having a bit more "lock-in".
For those that have well managed passwords (like probably most in this community), they are perfectly fine to use because they don't have lock-in either. I have full control over my used passkeys.
Basically you're not getting the "normies" to use proper password management, and for them they do provide additional security and convenience. They can always add more passkeys on different vendors, you're not limited to just 1 per service. Yes, adding them is a hassle, but so it's managing passwords and following higher security standards in general.
The "normies" don't have a clue what passkeys are either.
They don't need to. It just works to log them in when they're using one of their own trusted devices. Being able to unlock their phone gives them full access to the services (apps, websites) that are authenticated to that device.
I know that, and you know that, but passkeys are supposed to solve security-related problems by reducing friction.
What passkeys can't overcome is people dismissing the popups asking if they want to switch to passkeys or create them.
The problem with passkeys is they are 20 years too late, and no one cares.
a way to increase lock-in
Lock-in was already being achieved by mandatory use of apps which require iOS or Google Play services.
Plenty of banks etc which I can simply not use because of this requirement, and others which downgrade you to password+SMS security (used to be a physical TOTP token) if you refuse their app.
but in practice they’re being pushed as a way to increase lock-in
Which ones are doing this? Give specific examples of sites that are forcing you to use a specific TOTP or passkey validator.
That's entirely optional and not forced. You can use FOSS password managers that store your passkeys, that can log into all those services.
If you're referring to proprietary password managers (IE like google or apples), then that concern applies equally to all the passwords you're storing with them. So that concern is not specific to passkeys.
I don't disagree with any of that. You and I will be fine, as long as whatever sites we use don't insist on evil-only providers. The trouble I'm thinking of is for average uncritical phone enjoyers who are guided into a flow where they're migrated to using passkeys with whatever propriety junk they're using and end up locked into Matacorp Secure Cloud who now control their access to all their accounts, where once they had a list of passwords written in the back page of their diary.
Corporations never, ever, act badly!
It is not like they are treated as people with rights but fewer consequences for their actions, right? Right, guys?
Agreed. Even if you trust her words, she's only one person and Apple could override any decisions she makes.
It makes me wonder about the people in Google who worked for, maintained, and advocated the openness of Android. Only now for Google to continually lock it down.
Passwords are protected (for now) by the first amendment. You can't be compelled to tell what it is. Passkeys can be seized with a warrant. This only matters in the US but it does matter and I literally never see that addressed.
That’s not really a bash on passkeys so much as it is a bash on storage methods. Anything with a password that is not no knowledge encrypted is at the exact same risk because the password doesn’t matter to the company the warrant is issued to.
Edit: You may be right about that. I spoke too soon.
Fourth amendment protects against unreasonable search and seizure. That applies to passkeys. First amendment protects speech, that's what protects your password. You can't be compelled to tell that because you can't be compelled to say things, not because there's any protection against the data being seized. IANAL, feel free to go into more detail if you still disagree
First time I am reading people orate their passwords🤣😂🤣😂🤣
Now you're going to tell me the US has free press🤣😂🤣😂🤣🤣😂
I have a basic question, I learned that MFA should draw from multiples of "things you have" (totp) and "things you know" (passwords). There's all this talk of passkeys replacing passwords, but aren't passkeys in the "thing you have" category, not the "thing you know" category? My worry is that an unlocked computer or unlocked phone will let someone access ALL of a person's accounts because now they have the thing and don't need you at all. Putting access to my entire digital life behind my 4-9 point lock symbol? Or worse, a fingerprint?
I have been hesitant in the same way. I have not until recently understood where the passkeys are stored, and then understood that they then become a “thing tou have”. The passkey is stored on my computer, I prove I have access to my computer, and that is the authentication.
I am still hestitant since it often is just one factor, and I feel I have to manage them much more carefully.
There are actually 3 categories (though the idea of 2FA is picking 2 out of 3):
- Something you know (passwords, PINs, security questions...)
- Something you have (hardware keys, TOTP, smartcards, SMS/push-notification...)
- Something you are (fingerprints, facial recognition, iris scans...)
But passkeys collapse 2 of those into one by having the passkey algorithm include (as a step of the key derivation) a passcode or some biometric data.. that's why most passkey systems require some form of verification. Though it's up to your authenticator which method is used.
Those two categories aren't really meaningful, but even if you consider them to be, passwords (apart from a master password for your password manager) also should never be in the "things you know" category, because then it means you've memorized them, and are not using a password manager to generate completely random ones.
And unless you've got an incredible memory that can memorize unique passwords like "+28x@!8eaEak!" for 10+ sites, then you're likely using a pattern or single password than can be compromised.
I do consider the master password to my password manager as my "thing I know", and not the randomly generated passwords it stores. But you're saying that have-vs-know is not really important in the security space, that was mostly just a handy shorthand?
so are passkeys just a simplified workflow version of the complicated dance I have to do on windows to get git commits to push easily with the public key from putty-gen? But also the private key is sometimes locked to the device it was generated on? I guess I should read some actual technical docs on em.
- Describing TOTP as a “great solution” for adding security to a password-based account. When the most common threat model on the web is phishing (a word the post never mentions!), TOTP hardly buys you anything. TOTP is phishable.
If (after decades of awareness) you manage to get phished while using TOTP, you shouldn't be trusted with a phone or any digital information at all
Granted. But there are plenty of users who probably shouldn't be trusted with any digital accounts, but they still have to use them for daily life. If we can make it harder for them to mess up we should.
The problem is that if they're getting phished with TOTPs then they'll walk through a scammer over the phone to let them access their accounts other ways.
You can put all the security in place all you want but 99% of breaches aren't coming from red team actors "hacking" into a system. It's way easier (and even moreso now with LLMs able to do robo calls with human sounding voices) and get Brian from accounting to give up his shit...or even the CEO to give up his.
I've seen it all, they willfully will give over their access because they're dumb as fuck.
Most of the people who get phished, are not educated enough to avoid it. They don't want to be, because computers are just supposed to work and not be something they need to learn.
If you're educated and ask questions vs just assuming everything is legit and giving away everything they ask for then you realize quickly that phishing is not as convincing as you're making it out to be.
Phished doesn’t mean just a plain old phone call or email these days. It can still happen, and does. But there are now reverse proxy systems that clone legit web pages to steal TOTP by appearing legit, and they’re highly successful.
TOTP tokens are often distributed as QR codes, where you can store in more than one place, store/copy/transfer in plaintext between people or places. Compromise of that token gives permanent access to all TOTP codes generated.
I'm not a fan of how most TOTP apps and implementations actually work right now.
I know someone who works at a fairly large public university where TOTP is required. People (mostly students) are still constantly getting phished, despite TOTP. I guess young people don't have the decades of awareness that some of us have.
I like the idea of a Yubikey but there is no way it would survive more than a month on me due to the conditions where I work. And getting a physical key then not having it on my body at all times is a non-starter.
I keep my keepass .kdbx in on a webdav server and that covers any device I can think of.
Maintenance at a blast furnace. I am exposed to acidic vapours, caustic vapours, ambient heat in the 60c range, radiant heat in the 1000c range, rock from the nanometer up to 30cm size, phenolic resins, oil mists, and metal powders. And then there's the crawling around over, under, and between equipment.
Not every tech-savvy person works in an office.
If you use a self-hosted password manager like bitwarden, then its there. If you use a file-based password manager like keepass, then you can use any syncing method you choose, and its no different from passwords.
Passkeys also aren't lock-in. You control them, and your FOSS password manager likely already supports them.
I'm using a FOSS password manager for like 6+ passkeys right now, on some of the biggest sites. So this is just demonstratably false.
Why would I want a convenient passkey stored securely inside my password manager if I can just, much more conventiently, lock myself out of my account by losing my phone?
The point is that attestation allows for services to restrict where do you put it on.
The attestation certificate includes metadata securely identifying the exact maker, model, and capabilities of the local authenticator you used, with the purpose of allowing services to verify if they trust the authenticator.
So if you use your own no-name open source fork of a particular authenticator and don't even register it with the FIDO Alliance Metadata Service then services requiring attestation would reject your keys. Unless they explicitly make the exception for your particular AAGUID (at which point.. why ask for attestation in the first place?)
The issue is not with passkeys themselves, but the attestation feature specifically, which is part of the standard.
Attestation for passkeys (software-based, syncable credentials) is antithetical to their mass market goals, and would freeze out independent, non-corporate-backed credential managers. It’s an explicit non-goal of the designers of passkeys, who work together in a forum anyone can join.
The web wasn't supposed to be controlled by corps either, and look where we are now.
If passkeys were to follow the same path as the web, here's what it would look like. Corporate passkeys get the most users because of OS integration and convenience. Now that they have all the users they can commandeer the standards, and make them so complex and evolve so quickly that non-corporate implementations can't keep up (think Firefox vs Chrome). Corporations convince websites to drop support for outdated passkeys, citing security issues. Non-corporate implementations are locked out. Monopoly is established.
And now that passkeys are centralized to corps, the government can exert power on them, mandating hardware attestation for things like hardware-backed id and age verification. They push for backdoors, so they can log into anybody's account. Bye bye privacy.
Question: Why did these corps implement TOTP? You should be able to answer this from an economic perspective of them trying to save money.
Another question: why aren't these corporations locking down TOTP to restrict them to their own validator apps, in the same way you're proposing that they might do for passkeys?
why aren't these corporations locking down TOTP to restrict them to their own validator apps
But they do. There are TOTP implementations that have been intentionally modified to prevent using standard apps. I don't remember other examples right now, but I think Steam Guard is one.
I'm sure a lot of people (like myself) would refuse to install a special custom TOTP app just to be able to use one site. They're only hurting TOTP adoption by doing that, and thus increasing the amount of support resources they need to allocate to account hacking / hijacking.
I'm sure there are other companies too willing to go against their economic interests for various reasons, but they're going to be in the minority.
Why did these corps implement TOTP?
To reduce support load from people getting their accounts hacked and asking support to get them re-instated. I don't doubt that these incentives also drive the push for passkeys, but passkeys are much more opaque and tightly integrated with the OS, and is thus more vulnerable to centralization.
why aren't these corporations locking down TOTP to restrict them to their own validator apps
They are. Authy is the biggest offender I know.
Edit: some info about how Authy locks you in: https://www.bentasker.co.uk/.... Note that some websites integrate directly with Authy and force you to use Authy to set up the TOTP. The only way out is to use a rooted phone to transfer the codes to another app like Aegis.
I don’t doubt that these incentives also drive the push for passkeys, but passkeys are much more opaque and tightly integrated with the OS, and is thus more vulnerable to centralization.
I'm not sure what you mean by integrated into the OS. I use a FOSS password manager on android (keepassdx), storing passkeys both for apps and websites. When the browser or an app asks for a passkey, android uses the password filling service you've chosen (in my case keepass), and it loads up, no differently from when there's a password prompt. I'm not sure how it works on other platforms like iOS, windows, or linux, but at least on android, you can use a FOSS password manager not integrated into the OS.
They are. Authy is the biggest offender I know.
Specific sites aren't locking down TOTP, this seems to be an EEE scheme of Authy specifically, since as you say the TOTP codes provided by sites still work with other authenticators. I'm referring to the case where say, amazon forces you to use their app to login, or creates their own custom TOTP or passkey app, and won't let you log into their site without it, and then you have no control over your login method or codes.
By integrated into the OS, I'm talking about the major corporate implementations, like Apple, Microsoft Windows, or Google Android. The advantage is that you don't need to install an app or browser extension, and then give that app permissions. Everything is already set up. I've seen some websites like Amazon try to automatically set up passkeys for you, so it's likely that a good portion of the population already has passkeys set up in these corporate passkey managers, before they have the opportunity to learn about alternatives.
Speaking of Keepass, you should check out these discussions:
In short, keepass had a way of exporting passkeys unencrypted to disk, and some people did not like that, threatening things like:
This implementation is not spec compliant and has the potential to be blocked by relying parties.
The unfortunate piece is that your product choices can have both positive and negative impacts on the ecosystem as a whole. I've already heard rumblings that KeepassXC is likely to be featured in a few industry presentations that highlight security challenges with passkey providers, the need for functional and security certification, and the lack of identifying passkey provider attestation (which would allow RPs to block you, and something that I have previously rallied against but rethinking as of late because of these situations).
This is exactly what the "passkeys are a trap" article warned about. Passkey attestation allows websites to reject specific clients, just like how SafetyNet allows apps to block GrapheneOS users. In the future, banking websites or google.com could force usage of passkeys, and block usage of keepass. Are there enough keepass users to protest this? Certainly hasn't worked well for GrapheneOS and SafetyNet.
this seems to be an EEE scheme of Authy specifically
Functionally, it's locked down because it's nearly impossible to migrate the TOTP codes to another app.
You don't really see custom TOTP apps because users don't want to have to install an app just to generate TOTP codes for a specific website. Google Authenticator could have done this, but I think Google decided to start moving towards passkeys instead of enshittifying Google Authenticator.
There is much more incentive to do this with passkeys, because you can lock down passkey sharing in ways that can't be done with TOTP. For example, Netflix could block passkeys from any client that allows passkey copies and exports, like Keepass, in order to block account sharing.
I'm using GNU pass, it doesn't support passkeys. I'm using Arch with Firefox. When a site requesting a passkey, Firefox says touch the key. I don't know what to do so I cancel the process and search for a workaround.
For example npmjs.org, they require passkey for publishing packages, so I rather have to create an API token which supposed to be for CICDs and publish the package with that instead.
It's f*cking awkward. I have a secure password manager, offline, nowhere shared, even the passwords are encrypted. Don't force passkeys on me for no reason, I was secure before as well. And even if you do, at least it should work. As always Linux users left behind.
I have a secure password manager, offline, nowhere shared, even the passwords are encrypted.
How can the service provider tell, though?
The point of passkeys is to create an authentication flow that is easier for users to keep secure. The question, then, becomes whether a service provider should make user authentication decisions based on the worst case scenario, best case scenario, or average case scenario. Passkeys are a reasonable way to make sure almost all of your users have secure login credentials, even if the best of the best users would have just as secure login credentials with traditional passphrases.
I'm another gnu pass user, made a similar complaint in one of the other threads. I see dessalines claiming here that they use passkeys just fine with a 'FOSS" password manager. I guess that means it's up to us to contribute an implementation of some kind.
There's a discussion/issue on the codeberg hosting of the passff extension that seems to lay out what is needed: https://codeberg.org/PassFF/passff/issues/581
Hmmm, for someone complaining that another post makes logical leaps, this one has a pretty glaring contradiction that severely undermines their own argument:
The post is predicated on the idea that a feature of WebAuthn called “attestation”, which is only used in high-assurance and usually corporate scenarios, and usually with physical hardware security keys, will be leveraged to hurt people, somehow. The post posits that a website like X will bait and switch users: first, you get a passkey. Then, later, scary “attested” passkeys! This simply isn’t possible to do because attestation isn’t supported on the web for mass market, consumer authentication. Attestation for passkeys (software-based, syncable credentials) is antithetical to their mass market goals, and would freeze out independent, non-corporate-backed credential managers. It’s an explicit non-goal of the designers of passkeys, who work together in a forum anyone can join. And trust me, websites and apps like banks repeatedly asked for attestation at the beginning of the industry’s passkey journey. The platforms, browsers, and credential management apps have held firm that the goal of passkeys is reducing phishing and not some kind of trusted computing scheme. (And I will note: over my dead body!)
In other words, "attestation is bad and everyone is against it, but it's a feature of the standard." What they are really claiming is that there is something that for now is stopping governments and corporations from pushing attestation, but how long will that hold? I didn't have a horse in this race when I first started reading these posts, but this counter-argument is flawed and it makes me lean toward the camp against passkeys.
It reminds me of when Netflix was big and I told everyone they'd have commercials eventually. Sure you can still buy a plan without commercials, but I suspect that eventually, when money gets really tight for them, will go away.
Same thing here. Right now passkeys are "open", but who is to say my bank won't require a Apple/Google managed passkey in the future. Hell, I can't run the bank app without running a Apple/Google approved apk.
What propietary bs? It's an open standard.
that's quite a leap.
Yes google does have a lot of control over the HTML and HTTP specs because they control the most popular web browser. Whether people are or will in the future be "locked in" to google for that reason is debatable.
Regardless, the potential for a company to dominate the implementation of a specification is not a reason not to create said specification.
google will also control the most popular passkey manager. is that not obvious by how they already control the most popular password manager, browser, search engine and more?
Sure but that's not an inherent issue with passkeys.
You can use whatever proprietary password manager you'd like. Sure that often means people are using the device built in ones...
But why should that stop me personally from using passkeys?
it is. passkeys are not memorable.
and if all you are thinking about is how you should personally set up your own computer, you are missing the forest for the trees. we will keep happening upon android type situations if we're being that individualist.
After reading both of the posts, I'm kind of back where I started with passkeys: neutral. I'm pretty happy with my current setup of a self-hosted password manager, diceware master passphrase and strong, unique passwords for every account, along with an open source app for TOTP. I only ever see passkeys pushed on me for work-related accounts anyway, but I'm not using them there either. I do have a question though if someone can answer: are passkey protected logins also vulnerable to stolen session cookies?
So it's fair that you are neutral about them for your own use, clearly you know what you're doing. It doesn't make sense to be neutral about them, generally. On usability alone they are not good. There are so many people who don't have a clue how they work, or their consequences, and just click okay when continually harassed into using them. Some will even go ahead and save one on a shared computers, or someone else's, 'because the website says so'.
Honestly, I don't understand them well enough to recommend them either. I do IT, and I set my users up with a (managed) password manager and MS Authenticator. If I encounter a situation where a user has ended up with a passkey for a given service, I just leave it be. On the other hand, if someone is locked out because of a passkey, I reset it and get them set back up with the Authenticator app.
I'm telling you why passkeys are garbage:
Case 1
- Login to website
- Maybe use 2FA device
- Website creates session cookie
Never have to login again for the next few months
Case 2
- Go to website
- Use password manager to auto fill credentials
Click like 2 buttons and you're done
Case 3
- Create passkey
- Passkey is stored on propietary, trust me bro, "we will never share this with the NSA or FBI" Apple or something account where you can't export them
- User becomes dependent on cloud provider
- User will easier forget their real login data because they don't use them
- User is fucked if account get's locked/deleted
- User can still be hacked by simply compromising machine
- No 2FA
Passkey is stored on propietary, trust me bro, “we will never share this with the NSA or FBI” Apple or something account where you can’t export them
No. Most FOSS password managers support them, even keepass and bitwarden. You control them, you can export them as you wish, and even use them across multiple devices. I know because I do this.
No, but the "normal, worst case" usage of passwords is still far worse than even that case. Most people just re-use the same password for everything. This is why almost all companies use phone numbers and text messages as a totp now.
If we're comparing worst usage of passwords vs worst usage of passkeys, passkeys still wins.
passkeys can perfectly be used with third party password managers. everything you say here can apply to passwords if you use the Os provided manager.
you can absolutely have 2fa with passkeys. most platforms don’t do it since it adds little value
Os provided password manager
That's the neat point. You don't have to use one when you enter your normal login credentials and the average user like does not use one.
But with passkeys you are forced to use one and the average user will use the default one of their vendor.
most platforms don’t do it since it adds little value
Yeah because they obviously don't care about security (like machine compromise - that's why there is 2FA in the first place), which contradicts all advantages of passkeys.
every single argument I've seen against passkeys could be said against TOTP and 2FA in general.
- SMS token: they need to know your phone number. it's a privacy issue. also actual lock in to one device.
- MS authenticator with push notifications: actual lock in to a single app
- TOTP: you need a manager to store it, way more phishable than passkeys
and yes, you could use third part TOTP managers, but as you said, the average user wont. I dont feel any argument against passkeys is particularly strong.
Who has used as argument that passkeys are phishable?
The argument is that passkeys include "attestation" as part of the official standard, which is a method explicitly intended for services to be able to securely identify what local authenticator you used with the explicit purpose of allowing the service to reject access if it's not considered "safe". Can you say that about TOTP?
The problem is not the general idea of passkeys.. there are actually good things in the standard. The criticism was that there's also a part in the standard that seems perfectly designed for companies to use them in anti-consumer practices.
True story … take it as you like,
my 8 months old reddit account was filter flagged as a bot after commenting the following
“death to the Epstein class and fuck Israel the genocide state”
The only way to get it back according to reddit was if i used IOS authentication passkey.
Not the normal password manager i use on Firefox but no it must be passkey on ios.
Now i am convinced that 8200 unit of the Zionist regime have my facial biometrics.
This ^
the idea is that there will be a 'central repository of trust' and it ain't you. the step of moving that to 'verifying you' is short. the next step of monitoring you comes for free. the next step of managing you is the plan.
A passkey is just traditional PKI in a trench coat, your biometrics are A) not even required as you can just use a PIN and B) are not sent from iOS when unlocking the passkey.
I love how you provided no rebuttal to my two points. The EFF even goes into detail on how it works. The beauty of an open standard is that you can verify these assumptions of yours.
I don't need to, if you read my comment again you would understand my point.
But let me try to breakdown what i mean; you need to wake up from your lala land, if you truly think and believe corporations that are actively participating in genocide and killing children will really care about “policies and terms of usage”.
Your statement reads like someone who used to believe the “don't be evil“ google policy citing it as evidence in his head.
If that is how you stand, then good for you, but i don't, actually i view such corporations as a dangerous entities to humanity.
Hope its clear for you now.
I misread your second sentence as "my 8 month old's reddit account" and was confused when there was no payoff to the premise of the shitpost.
You can use a foss alternative like keepassxc to set up a passkey so you control the file instead of trusting it to Apple.
This was on hackernews this morning.
The author is in the passkey business.
The most pertinent question there imho was : What do passkeys offer that random strong passwords + a pw manager do not?
There was a wall of comments, but no concise answer.
======== You buy a new super secure lock for your house, but to get in you go to one of the 3 conveniently located HomeDepot's in your city. You simply prove your identity to the guy there. He verifies you in the system. Then he gives you a one time pass to your house.
If its such a great idea, you can pay me now to do it for your home.
The way i understand it, passkeys test for a combination of what you have and what you are (for those that check user presence, which is all of them I suppose); whereas passwords test what you know.
From my reading, passkeys give more control to the platform/service provider, whereas passwords do the reverse.
The former clearly benefits corps in their unique ways - motivated by profit, security, data/spying and so on.
The current iteration of passkeys is not the form that is being challenged by the earlier anti-passkey post. But rather a floodgates problem. Pretending that it will never happen is asking for trouble.
The better option (be it passwords or passkeys) needs to demonstrate that it gives control to the user.
I'm in the passwords camp, I do not see what convenience or added security passkeys might provide in any of my use cases that is worth sacrificing my level of control and choice.
The biggest problem I have with passkeys is big companies aren't implementing them to improve your security - they're implementing them because it absolves them of liability and responsibility for implementing good security on THEIR end and allows them to implement whatever the fuck vibe-coded bullshit nonsense they want without any knowledgeable or skilled staff, and even if it's good for me too, I'm not inclined to do these assholes any favors. It'll just make them sloppier and lazier on other elements of security and they'll turn around and put the blame on the user, and courts will go right along with it because nobody in the legal system can find their asses with both hands.
It's not about the implementation - it's about what passkeys do and don't do.
Passkeys prevent someone from stealing hashed passwords from the SERVER, but if the server is already compromised badly enough to let someone in, all of the data stored on that server is compromised already anyway. Companies want to use passkeys because there is less involved in implementing secure login credentials, but that is only ONE tiny part of overall end to end security, and I do not for a SECOND believe that they are going to keep on highly skilled, security-minded developers at real salaries when the C-suite says "We're using passkeys. We're secure. Fire the high priced developers and get me some interns who can use Claude."
TLDR: Passkeys are not a magic bullet and they aren't a game changer, and the false sense of security they push is dangerous.
I realy dont think that's a thing. End-user login security is a tiny footnote on page 729 of the 2000+ page security document of a large company's cyber security department. Switching that to passkeys will not change anything about how the company handles security. AI will. But not passkeys.
And as we have seen many times, companies have been bad with security already and many password databases have been breached. Having a tool that limits the impact of bad security is a good thing.
Exactly, people keep focusing on whether passkeys are secure as a concept, and they are. However, what we actually need to talk about is how they're going to be used in the wild, and what companies are likely to do with them. That's what's going to affect vast majority of the people.
Passkeys have inherent advantages over passwords. They are more secure.
- Public-private cryptography vs shared secret
- They can be stored in an authenticator that can never leak your private key.
- You can have many passkeys for the same account and they are all unique and can be revoked individually.
- Can be put in a password manager. (less secure, but still better than password. see point 1)
The standard requiring the authenticator to report attestation if asked, opens up for abuse though.
Even if the standard allows them asking for attestation; the nice thing is that they can't force the passkey in to protected storage, as long as there is a browser like firefox in between you and them. (don't use non free apps) So store all your passkeys how you wish and the day they start asking you to replace those passkeys with their better storage options, you just don't. If they lock you out of your account, then stop using their service. Don't use shitty services when they abuse you.
They are turning off passwords before they start asking for attested authenticators anyway. So might as well enjoy the convenience of passkeys while they are working like you want them to.
they can’t force the passkey in to protected storage, as long as there is a browser like firefox in between you and them.
You also need to not use Windows Hello, or Apple Touch ID / Face ID (which actually is the default in Windows & Apple, even if you are using Firefox). Otherwise the browser will relay the request through them and provide the attestation.
The problem is when the mainstream people do use those methods because it's the default, they don't know, or it's simply more convenient since it's bundled in their proprietary OS that they (stupidly) trust.
If having your own non-attested custom method of providing your passkeys becomes something niche amongst the users of passkeys, then I would not be surprised if many places flip the switch and start requiring attested methods.
Of course one can always switch to more consumer-friendly alternatives even if they are more niche, but as long as they remain niche it won't stop the big services from pushing for anti-consumer practices.
Passkeys are not perfectly implemented on every service and not exactly widely available. I use passkeys on a handful of places. Where they work, they are nice. I want my accounts passwordless and no multi-hassle-authentication any more.
They should stop pushing them since they don't work. It takes more clicks now to get to the regular password options because they try the non working passkeys first now. You have to click "show more options to log in" .
That's why it is So frustrating.
Let's get back to after 10 years because this was the same debate about drm in browsers and now we have this https://www.w3.org/TR/encrypted-media-2/
FWIW I don't have DRM enabled and I can don't even remember what part of the Web I can't browse.
Before you ask, no I don't use Netflix, or Disney+ or audio streaming service nor do I plan nor want to.
I've had trouble with them with my gear.
I intend to continue with keepassxc wherever possible until compatibility is built out.
I'm quite confused about all the suspicion about passkeys. I just add a passkey to my password manager whenever the service offers it. I don't understand the "lock-in" concern because I can just import + export my passwords between managers
You can, maybe, have you actually imported or exported all of your passkeys before?
The concern is that in order to solve a technical problem, trusting the user, a system of actions and technologies called remote attestation was added to the passkey design. It allows for the service being authenticated into to figure out if it even wants to accept the supposed users attempt. One way remote attestation can be done is by client. Not using a client the service accepts? No way in even if you have the right credentials!
This is really powerful technology that lets me ensure my own services won’t even allow connection to insecure clients or just clients I don’t wanna talk to.
But of course we’re not talking about me using passkeys to gate access to my own services I control, we’re talking about Google, Microsoft and Apple doing it. So built into the passkey standard is the capacity for the service to simply stop allowing you to access it with a passkey if you don’t have the right thingy (or any other suite of remote attestation technologies, client is just one example).
Do you know if your passkeys do this? Do you know how to get in to your accounts if passkeys are suddenly not working?
People are mostly afraid of lock in, control, etc here but the real problem is that most users don’t understand how passkeys work. How can you comply with a regime of passkey use if you don’t know how they work?
Passkeys use public-private cryptography and password use shared secret. So regardless if the key is stored in a password manager, the passkey is still more secure. It would be impervious if stored in a security key. But it is still more secure than a password, even when handeled the same way.
Fixes what? By 'less trusted device', do you mean to say leaking your password? Adding more factors makes it less likely an attacker gets all your factors, yes. Totp is also a shared secret credential. You can combine it with a password or a passkey if you want. Just don't store them together, or you loose them both at the same time.
"TOTP is phishable."
i can safely say both articles were made by insane people. all i can say is, to keep using generated passwords and offline 2fa codes. dont click on the naked lady in the spam folder.
have a good night, kids.
Passkeys are 100% not a trap, but they've been fucked over by being allowed to be portable. Now your passkey is only as good as the portable password solution you're using to store it. They're meant to be 1:1 computer->service. Then there's the issue that most of the sites that accept passkeys let you bypass them with passwords or TOTP anyway.
TOTP, however, is REALLY fucked. Even a rudimentary phishing email can get your time-based key, get in and fuck your account over in real time.
Passkeys are extremely phishing-resistant. They are the best thing we have short of a YubiKey at the moment.
Yubikeys are amazing, But they're not meant to be permanently carried, just used to stitch your securred devices together.
Agreed, but it can be better, with open solutions.
If you use a popular open source OTP solution (like Aegis), you can export your tokens (carefully) as an encrypted file from your phone, and then import them to another popular open OTP solution on the laptop.
Alternately, one can also set up each separate device as a separate authorized token for each service - for many services.
I like the import/export solution, because even for services dumb enough to only allow "one token", I can still have that token on two or more devices.
I use hardware keys to connect to my own self-hosted services and login on (some of) my devices. There is no 3rd party involved.
Some of them like NitroKey are even open hardware. I have backup hardware keys.
It's amazing. I can't believe it took me so long to rely on them.
So... IMHO if you don't like (hardware) passkey it's because you dislike services relying on them, no the keys themselves.
What is the difference from two factor with aegis + random generated password with keepassxc, and passkey saved on keepassxc.
You don't need passkeys if you don't have anything important to steal, or any accounts on anything you would feel sad to lose. Just cancel all your subscriptions and sail the high seas! Nobody likes you anyway!
@lemmy.ml
A place to discuss privacy and freedom in the digital world.
Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.
In this community everyone is welcome to post links and discuss topics related to privacy.
Some Rules
- Posting a link to a website containing tracking isn't great, if contents of the website are behind a paywall maybe copy them into the post
- Don't promote proprietary software
- Try to keep things on topic
- If you have a question, please try searching for previous discussions, maybe it has already been answered
- Reposts are fine, but should have at least a couple of weeks in between so that the post can reach a new audience
- Be nice :)
Related communities
much thanks to @gary_host_laptop for the logo design :)
go to feed...
@lemmy.ml
A place to discuss privacy and freedom in the digital world.
Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.
In this community everyone is welcome to post links and discuss topics related to privacy.
Some Rules
- Posting a link to a website containing tracking isn't great, if contents of the website are behind a paywall maybe copy them into the post
- Don't promote proprietary software
- Try to keep things on topic
- If you have a question, please try searching for previous discussions, maybe it has already been answered
- Reposts are fine, but should have at least a couple of weeks in between so that the post can reach a new audience
- Be nice :)
Related communities
much thanks to @gary_host_laptop for the logo design :)
go to feed...
Not much of a rebuttal imho. We still have the problem that passkeys are ok in theory, but in practice they're being pushed as a way to increase lock-in and don't offer compelling advantages over well-managed passwords.
save