Passkey is some sort of specific unique key to a device allowing to use a pin on a device instead of the password. But which won’t work on another device.
Now I don’t know if that key can be stolen or not, or if it’s really more secure or not, as people have really unsecure pins.
Man, the amount of fearmongering and anti-Google rhetoric in this thread makes me sad. Passkeys are almost entirely a good thing and are supported by many big and small companies.
No, it won’t lock you into Google, it’s an open web standard. Google will have an Authenticator, Apple will, and third parties will spring up to support it as well. And there’s no lock in, you can get a new passkey when you want to switch devices or providers.
No, someone who gets access to your device can’t get access to everything if you have basic security hygeine. Secure your passkeys with a secondary password or use biometric authentication.
Yes, it’s almost a straight upgrade to text passwords. They are immune to phishing attacks and other social engineering tricks, and you don’t need to remember long strings of numbers and letters anymore.
Do your research people, sheesh.
This is starting to really get on my nerves, and I feel like discourse on the fediverse is worse; basically the attitude is that if it’s not FOSS and self-hosted, it’s shite. That attitude is fucking grating for the rest of us.
The irony is that it’s an open standard. There are FOSS implementations you can self-host. Server side, client side, soft token, hard token. Everything.
https://github.com/herrjemand/awesome-webauthn
People on this thread are just really ignorant, even self-proclaimed security experts.
This and if any business anywhere manages to reache a significant level of success — and has the nerve to charge money for their service — it’s a sign that capitalism doesn’t work and corporations are inherently evil.
I just assume it’s an age thing.
Big tech have done this to themselves
An online authentication system is quite literally the one central thing your whole digital life depends up on. If it’s broken, it can completely f’up your life and remove you from existence in the digital space. So there is extremely good reason to be skeptical when big-company tries to force you into a new thing. Especially when said big-companies have a history of f’n things up on purpose (remember G+ forcing real names on everybody and bundling previously unrelated accounts into one monolithic one?). Or take HTTPS, which was sold us with “bringing more security”, when what it actually did was kill large chunks of the open and self-hosted Web.
Are you seriously arguing against HTTPS?
Yes. It’s one of the major reasons why the Web turned into a cooperate controlled hellscape. Note, I am not arguing against encryption, just against HTTPS crappy implementation of it. It’s also going to get even worse with QUIC.
HTTPS is definitely not a major reason the web turned corporate. It has its problems for sure though.
Look at Gemini if you want an example of a decent web ecosystem that has HTTPS as a requirement for the protocol.
Gemini benefits from two things that the web has lost:
- small size: just like the web was once small, Gemini is still too small for any copos to consider it as an option to push their content or services although I believe there has been some small examples of this being tried.
- simple browser spec: Gemini benefits from having a number of browsers, none of which implement anything as interactive or insecure as JS(mime types other than gem text tend to be opened by other applications) and no one browser is influencing the spec for their own goals. This means all Gemini content is static once loaded by the client. No injected ads, no scraping of data and no hijacking of the tech by private companies.
The problem with passkeys is that surrender of a physical key is not protected by the 4th amendment and subject to seizure. From a security perspective, I agree that passkeys are good. But I only use a physical key as a secondary factor. Never a primary.
The courts have ruled that you can’t be forced to give up a password or passcode. (We’ll have to see if the current court will keep this precedent.)
Until we get better privacy protections, I’m not trusting passkeys whole cloth.
You can protect your passkeys with a knowledge element.
But I don’t see your use case. Passkeys are about logging in to webservices, not about protecting devices.
Web service providers can always be ordered to surrender your data by a court. Very few of them even try to encrypt your data. And for those that do, a court order could still force them to intercept your password and decrypt the data.
If you replace passwords with passkeys that must be protected by a password, you haven’t replaced passwords, you’ve just moved where the attack can happen. While I think there’s certainly value in that, it’s very disingenuous to say you’ve replaced passwords.
Passkeys are used for more than web services and have the possibility to replace other security options elsewhere (being something you have, one of the three secrets possible). Their lack of protection, at least in the United States, is a very serious problem. Your points do nothing to address this and highlight just how bad the situation is.
You should really read up on multi-factor authentication and Web-Authn.
Your problem seems more that you don’t trust Google to store your private keys in their cloud.
And that’s fine. You don’t have to do that. But don’t be confused to think that’s the only option. You can buy a yubikey or a Trezor model T if you prefer.
Passkeys are just a marketing term for Web-Authn. When you use asymmetric keys for other purposes, it’s not passkeys.
I missed the part where I said I don’t trust Google. You seemed to have ignored everything of substance in my response, namely putting a password on the passkey doesn’t remove passwords and the extension of things like FIDO2 beyond web auth.
I didn’t ignore it, I said you need to read up on the basics.
Protecting a private key with a password is totally different than authenticating with a password and you don’t see to understand that difference.
It doesn’t get rid of passwords, which is what I said when I said it was a disingenuous claim. It just moves the attack surface, like I said before. You haven’t bothered to demonstrate even a passable understanding of my original comment and the security issues I raised as a security professional because you appear to want to dunk on me. I’ve been having this conversation for years so sorry not interested.
There is no implementation right now that enables you to own and manage your own passkey backups without Google it icloud.
Additionally, the attestation feature is one step away from banks and other sites mandating specific implementations, preventing people from using software tokens or OSS managers.
Passkeys is great, and I am eager to recommend it to everyone, but without those items addressed, it’s a trap door, and one bitflip away from very strong lock in.
I just set my passkey up in Dashlane. It does not require Google or iCloud.
The same webauthn standard allows you to use a security key with PIN luck
My understanding is that, currently, a PIN or password is protected. So if you secure your phone with one of those, access to it is under 4th amendment protection. Given this, I’m curious how passkey legality would work out since it’s a physical key, but access to use it would still require a knowledge element.
Passkeys will not protect you against the government.
As I said elsewhere, it’s for web services. The web service provider will have to surrender your data on a court order. They can decouple it from the passkey. The passkey doesn’t encrypt your data at the provider, it’s only used for authentication.
If you really want to protect your data, you will need to use a different encryption solution. Something like full disk encryption with a complex pass phrase.
Google is a lot of things for a lot of reasons. This isn’t one of them. There’s plenty of reasons to bash them without needing to pull shit out of one’s ass
While I would agree this sounds more secure, I’m always worried about people getting further locked in to Google’s products.
Hopefully this system won’t take accounts “hostage” by requiring you use Chrome to log in to them, but it’s Google, so…
EDIT: I’m wrong, passkeys are stored per-device and can be shared between devices using an open standard. Here’s a video explaining the basics. It addresses my concern at around the 2:50 mark.
Passkey is an open standard. It’s not Google specific.
That’s good to hear. I don’t know much about passkeys, and I should really spend some time learning about them. Didn’t mean to fear-monger, but I guess I’m getting more cynical these days.
Updated my root comment to reflect this.
We’re sorry, Firefox cannot access your IMEI to fingerprint your device. Please use a modern web browser like Chrome, Chrome, or maybe try Chrome.
Yet another anti-consumer, anti-privacy, “for the sake of children!” Type tactic from Google.
Mozilla is in the process of implementing passkeys in Firefox. This page tracks the status of various implementations of passkeys.
Yeah I’ve already switched to LibreWolf after seeing the AI bullshit that FF is adding in the name of “spotting fake reviews”. My ass. Unfortunately I can’t use it at work apparently, the security app we use flagged it because I tried to import passwords from another browser… sigh
CAN I JUST BROWSE THE DAMN INTERNET PLEASE
Did you just make up something that could happen and then get mad about it?
Yeah I’m in that kinda mood today. And it’s not exactly far fetched.
Satire typically highlights something that has happened, not something made up.
The onion…?
Where’s the humor?
deleted by creator
it’s passkeys. they are getting integrated in a lot of stuff right now, including password managers like bitwarden
Use a yubikey, that doesn’t vendor-lock you to an OS ecosystem. They make one with nfc so it’s not a pain to use with your phone.
I’m not sure if this is universal or specific to the last site I tried to use my Yubikey with as a passkey, but it only would allow it to be used as 2FA, not actual passwordless authentication.
I assume this is because Yubikeys don’t create a secret for each individual website I suppose? Not exactly sure about that one.
The site likely didn’t support passkeys. But passkeys are basically webauthn passwordless login, and per the yubikey docs they support that.
See https://www.yubico.com/authentication-standards/fido2/ and https://fidoalliance.org/passkeys/#faq for more info. See also https://support.apple.com/guide/iphone/use-passkeys-to-sign-in-to-apps-and-websites-iphf538ea8d0/ios specifically the bit about adding a passkey to a physical key.
Google definitely supports passkeys, and they were one of the sites that did this. I’ve just replied to another comment regarding this. I wonder if the Yubikey 4 (I’m not sure how to tell which one I have, since they look about the same) just doesn’t support passkeys, which would be… unfortunate.
It’ll be even more unfortunate if there’s a weird mix of sites that support the Yubikey as a passkey and some only support it as a passkey. My Pixel is supported as a passkey, but Firefox on Linux doesn’t support this - only on Windows and macOS. I believe Chrome/Chromium does, which is equally as frustrating as my Yubikey possibly not supporting passkeys.
Strangely enough, Google lets me “add” my Yubikey as a passkey, but then does not let me sign in with it due to it not being “recognized”. If I remove it as a passkey, and only use it as a 2FA token, attempt to sign in and use the “Enter your password” option, it will then let me use the key after I’ve entered my password as a second factor.
So it seems Google has removed the error (or its not triggering anymore) as they will have been one of the first sites I tried to create a passkey for, but it still does not let you use it as a passkey.
Per Yubico’s specs on the Yubikey 4, it does not support FIDO 2 resident credentials, meaning it does not support Passkeys.
Compare to the specs of the Yubikey 5C NFC or Yubico Security Key C NFC, which both have this section:
FIDO2
The FIDO2 application allows for secure single and multi-factor authentication, and can store up to 25 resident credentials. These credentials, which are protected by a PIN, enable passwordless login, where the YubiKey, unlocked by a PIN and authorized by touch, can log you in to your accounts without entering a username or password. The FIDO2 application is FIDO certified.
See also Yubico blog post with an FAQ about passkeys:
How are passkeys different from YubiKeys?
They’re the same, and they’re different.
They’re the same because YubiKeys have had the ability to create these passwordless enabled FIDO2 credentials (passkeys) since the YubiKey 5 Series became available in mid-2018. Currently, YubiKeys can store a maximum of 25 passkeys. We are evaluating increasing this in the future because of the likely increase in fully passwordless experiences across the web that require them.
They’re different because Platform created passkeys will be copyable by default using the credentials for the underlying cloud account (plus maybe an additional password manager sync passphrase), whereas passkeys in YubiKeys are bound to the YubiKey’s physical hardware where they can’t be copied.
I wouldn’t run out right now and buy a Yubikey to store Passkeys given the 25 key limit and the likelihood that Yubico releases a new key that supports storing far more of them, but if you do, the $25 Security Key series is the cheapest option.
Interesting, I’ll probably just have to wait till either Bitwarden supports Passkeys, or wait till Firefox on Linux supports cross-device Passkeys (so, my phone for example) as yeah a 25 key limit is not likely to be worth purchasing an upgrade for just yet.
The credential needs to be set as discoverable and some other stuff to work for passwordless login (the token must store site specific data)
You would need to reregister it as passwordless to not just use it as 2FA after having entered a password (meanwhile standard 2FA with webauthn don’t store anything on the token, the website sends encrypted credentials to the token which only the token can decrypt and then authenticate with)
Both the website and your physical security token must support the right type of webauthn credentials (the token has storage for a certain number of slots with “discoverable credentials”).
Passkeys is a variant of the same which is bound to your device’s own TPM / SE security chip or equivalent, plus a synchronization feature for backups.
You can use Yubico keys as your passwordless logins. Both Google and Microsoft have this option.
Strangely enough, Google lets me “add” my Yubikey as a passkey, but then does not let me sign in with it due to it not being “recognized”. If I remove it as a passkey, and only use it as a 2FA token, attempt to sign in and use the “Enter your password” option, it will then let me use the key after I’ve entered my password as a second factor.
So it seems Google has removed the error (or its not triggering anymore) as they will have been one of the first sites I tried to create a passkey for, but it still does not let you use it as a passkey.
I haven’t encountered this issue, yet. I’m using LibreWolf browser (v118.0) and tested logging in my Google and MS account passwordless. BTW, I have Yubico Security Key NFC (the blue one).
Mot likely it won’t need to have chrome. However maybe Google services may be required.
However it is also very likely, if a device cannot support such feature, it will only require a password and 2fa.
It’s definitely more secure, since stealing someone’s phone is much more difficult to scale up compared to stealing passwords.
I don’t think that access to your personal data/email/files being dependent on a battery-powered electronic device is a great idea, to be honest.
That’s why they invented chargers, eh.
But more seriously, there are recovery procedures if you lose a phone with or without a backup and if you are willing to share the keys with a cloud provider, you can also store them there and use them on any of your devices.
Or you can get something like a yubikey if the battery aspect is really that problematic for you.
The fact is that I fail to see something obviously wrong with outrageously long/complicated passwords managed by e.g. Bitwarden or the likes.
Long passwords can still be phished. Passkeys cannot. It’s a huge upgrade.
I don’t think so, but whatever.
What do you mean? Do you not believe the anti-phishing features will work as described for a reason?
Bitwarden is also supporting passkeys, so it won’t make a difference for their users whether they use passwords or passkeys.
And the fact that you don’t see anything wrong is more a you problem. Boomer mentality, dude. Don’t became one.
It would probably be better for you to explain what’s wrong and not just call them a boomer as if that explains it.
If they want to be a Boomer and stick to 20th century solutions, why should I care?
If it works for them, fine. Nothing wrong with that.
It’s obviously not working for most people. Most people reuse weak passwords and get their passwords hacked. Passkeys solve that for those users.
That’s why the whole industry is shifting to passkeys.
“It’s old so it’s bad” is not a very convincing argument.
I think he was wondering how technically the new solution is better, especially compared to password database solutions where complex password and password reuse isn’t an issue.
It kinda sounds like you dont actually know whats wrong, and are just blindly following the trends.
Doesnt that make you the boomer?
oh man. so I am a boomer. good to know.
What do you see that’s wrong with it that we don’t if I may ask?
Mostly phishing. Passkeys can’t be phished. And really, passwords are awful in general for security purposes. You don’t have to use your phone or google or apple or whatever.
I actually have a physical usb key that I use as a passkey. Its just a more secure login implementation and will likely be the only option in the future.
Passkeys can be phished, it’s just much more difficult than with passwords, TOTP MFA, SMS MFA, other OTPs, or push notification-based MFA (e.g., Duo or the way Microsoft, Apple, and Google push a notification to their app and you confirm and/or enter the key).
Passkey is extremely phishing resistant in the same as Webauthn MFA and U2F MFA are, in that origin checks by the browser prevent attackers from initiating the auth process. But it can still be attacked in these ways:
- XSS bug in the target website
- Browser vulnerability
- Malicious browser (not a concern on iOS but a concern everywhere else)
- Compromise of any cert in the chain between you and the target website
- Convincing the user to install (or using malware to install) a root certificate, or compromising one you already installed (e.g., for work)
- Bookmarklet/clipboard/devtools attacks
From memory, passkeys, webauthn, and u2f should prevent over 99% of phishing attacks that are successful without them in place.
There’s also the risk of the passkey itself being compromised, though that level of risk is dependent on your device / how you’re storing your passkeys and isn’t a “phishing” risk.
Removed by mod
My understanding of Apple Keychain is that every credential is useable from every device, and can be backed up and restored to a new device. Most importantly Apple doesn’t have access, although we have to trust them on that
It’s not quite unique to a specific device. You can store your private key in a password manager or something similar, and then access it from other devices
Depends on your personal choice. You can definitely limit them to a single, hardeneddevice if you want the highest level of security.
For most users and most situations, a synced solution will be preferable.
But it becomes much easier if you want to compromise a specific target individual
No, not really.
Even if you want to target a specific user, it doesn’t become necessarily easier.
Unless you happen to target an individual that combines good password OpSec with shitty phone OpSec.
But I would expect those to be a minority.
Me, at the bank:
Robbers, as they enter the bank: everybody freeze
Me: ah shit
Robbers: everyone give me your phones
Me: aw hell naw
mission impossible style shootout
Nope. Not going to have my entire digital everything depend on me not losing or breaking a single electronic device.
From Ricky Mondello, who works on passkeys at Apple: “If it’s device-bound, it’s not a passkey”:
That’s a terrible take … He’s confusing “what it does and how it works” with “how you manage it”.
It’s like saying “don’t call it a password if you write it down”. It’s confusing and unhelpful.
No it’s literally in the spec. Passkeys are designed for cross device synchronization. You have to go out of your way to make it local only (or use a different webauthn spec like physical security keys)
They’re just private keys. By nature you can copy them wherever you want. I guess I don’t know why he’s making that distinction at all.
The original spec is resident keys including TPM protected or hardware token protected keys designed to be impossible to copy. That’s why there’s a distinction.
You won’t need to?
The key is for a single device. Logging in on another one is going to generate another key.
They key is secured with the pin of the device, so when you try to log in, you can use the pin to log in, and not the password.
Would you have to set up multiple devices when making your account then, if you wanted more than just your phone?
Yes. Unless there was a way to share that key between devices. I know Bitwarden is working on a vault for keys but it’s not released yet. It was due out now so I assume it’s delayed.
Apple is quite dogmatic in that their implementation demands cross device syncing.
It’s definitely possible to have such an implementation and those will be the most common. You take a very small security risk for a huge convenience factor.
For the more paranoid, device-bound passkeys do not sync. If you lose the device, you will need to go through a recovery procedure.
Thanks for posting this video. Very good explanation for those unfamiliar with the technology.
Do you not use MFA at all then?
Authy on the phone while also using their desktop app. If you lose the phone you still have options.
Each to their own but cloud syncing and MFA are a bad mix in my eyes. It has a “who watches the watchmen” problem and it somewhat defeats the point of having a trusted factor when you have an untrusted one on “someone else’s computer”.
Authy have demonstrated why this is a problem (https://techcrunch.com/2022/08/26/twilio-breach-authy/), plus they’re closed source, so it’s a big no from me.
Vaultwarden, a FOSS Bitwarden server compatible with upstream clients, is able to store TOTP, and when self hosted, you are the watchmen.
Yeah, this is fine. It’s closed source, opaque cloud solutions that people should be wary of.
If your MFA is bound to a single device and you have no backup then you’re doing it wrong.
You can accuse companies of doing it wrong by often only providing a single additional factor, but I don’t see what that has to do with me.
What I’m hearing is that when an authenticator app is the only option, you’ll go with nothing over something.
Perfection is the enemy of good after all.
Looks like I replied to the wrong comment.
The person you had replied to originally commented on not wanting to have the possibility of everything being broken by losing a single device. I think that’s important that everyone realize that some sort of a backup plan is needed, whether that be back up codes, saving the original QR code, or being able to use multiple devices to authenticate.
At any rate, I should have replied to someone else. Sorry for any confusion.
No harm, no foul.
And you’re very much right. There’s a growing problem in consumer perceptions of modern security methods and how they should be applied. Much more time is spent justifying the convenience of proposed solutions, and not nearly enough time spent understanding what the scope is of the attack vectors that lead to these things needing to exist in the first place.
And further, why some of these conveniences - much like the reused-everywhere super-long password of yesteryear - are a danger in themselves.
I have the KeepassXC database with the TOTP thoroughly backed up, so nope.
So you are using MFA but for the password manager? (Appreciate that you’re not the OP I was asking)
I have a long list of questions about PassKeys and none of this articles explains them well enough.
- Does Android have it build in AOSP or Google Play Services?
- Would it be possible to actually see your private key on Android? Like export them to a file?
- Does they work without third party service? Can it be just me and the service I am logging in, or does it require my servers from PassKey provider (like Google, Bitwarden, 1Password) to work?
- Can it be used offline? For example, can an offline device create token that second online device could use for login? (Like TOTP codes).
- Does they work on other Internet services than the Web? In other words, does they work purely over HTTP and webviews or can they be in future used to login in for ex. SSH servers?
- Since passkeys are basically asymmetric keys, SSH technically had “passkeys” for years.
Yes, but that’s missing the important part.
Passkeys is not primarily about asymmetric keys. It’s about applying asymmetric keys to the Web as an open standard.
The W3C Web-Authn standard is what makes it important and revolutionary.
This is just as important as HTML, CSS and ActivityPub.
Finally we have an open standard that integrates in the web and offers a high level of security.
Is that like TLS client-side certificates?
It’s actually quite similar, yes, in the sense that it uses a public/private key pair linked to your account.
But this works on the application layer and you don’t use certificates.
Much easier to setup.
Also it generates unique keys per site so it doesn’t help anybody track you
Just an example of protocol different than HTTP.
Nothing of that?
You don’t need to export or know what is the key.
The key is different for each device.
You don’t need to export or know what is the key.
But is it possible in the implementation of Android/iOS?
Backups are a thing. With SSH keys I have different key for every device too, but as they are stored in an accessable file (as all computer data should be) they are backed up with the rest of the system.
So first, no, all the files should not be accessible : There are special not “files”, but keys, like the key used for this method. These keys pose a huge security risk of they are leaked somehow. The key can be something used to encrypt the device/disk, encrypt a connection, and other things associated with encryption.
And because of that security risk, they are often stored in a special chip or simulated chip (like the simulated tpm 2.0 on pc cpu), and not just “stored” so any malware or who knows what can access them just by reading the drive.
Second, the key is never transfered. When you connect to another device, that other device will get another key. Or maybe could it be backed up somehow in case of recovery on another phone? But that would defeat the entire purpose of this.
How Google can do to allow you to connect to another device if the first one is lost, not sure. But it would certainly either ask for a password and a 2fa method.
How Google can do to allow you to connect to another device if the first one is lost, not sure. But it would certainly either ask for a password and a 2fa method.
That’s the key question. From what it seems, it would replace a password manager with different passwords for each website, but you give Google control of the master password.
It is not for the password manager…
It’s just to connect to the google account.
It is not a service to connect to other ones without passwords.
Keys are stored in the equivalent of iOS’s Secure Enclave (actual name is implementation specific: ARM’s TrustZone, Samsung’s KNOX, Pixel’s Titan M, etc): https://www.howtogeek.com/387934/your-smartphone-has-a-special-security-chip.-heres-how-it-works/
I just replaced my iPhone, and the few places I “sign in with Apple” still work in the new phone. Yes, you can back it up and restore to a different device. I assume you can also use it across devices but I haven’t tried that
This is something different to PassKeys. “Sign in with Apple” is Apple telling online service “let him in”, while PassKeys is storing your authentication data on your device.
i tested it on another device, it looks like it gets the passkey from the source device (not from cloud), i had to input the original device’s unlock pattern for it to work
And it’s expected as you still had that device. And it’s not the same key, a new key has been created for that new device. Now if that device cannot be accessed?
Here is an alternative Piped link(s):
https://piped.video/6lBixL_qpro?si=wFFQwrfjQBKDHs5B
Piped is a privacy-respecting open-source alternative frontend to YouTube.
I’m open-source; check me out at GitHub.
Fuck google.
passkeys sounds good on paper and for most users on day to day stuff should improve their security. But the failure path is horrible and it happens at the worst case most of the time. If I have the keychain on the phone and lose it or is out of battery and usually happens that I need to access some service like email, then if the email provider starts forcing people to use passkeys or you only have that method on, then I’m locked out of the account and can’t use email. This will happen for all other services that one may need to use on an emergency. Personally I don’t like it.
Ummm??? What keychain? Passkeys don’t have physical keys. I think you’d better learn more before cursing Google. BTW Apple supports them as well.
“Keychain” is often used colloquially to refer to a piece of software that holds passwords and other secrets, which can include passkeys depending on the implementation.
Someone else correct me if I’m wrong but it works similar to PGP.
Background info:
- Your device generates two keys, a private key and a public key
- The public key can be given to anyone and the private key stays with you
- The public key is used to encrypt data and the private key is used to decrypt it
Usage:
- You sign up for a service with all the normal info minus a password and click submit
- In the background, a private key is generated and stored in iCloud Keychain, Google Passwords, or a 3rd party password manager (so all your devices can access it). A public key is also generated and given to the service
- Now you try and login. You enter your username and click login
- In the background, the server encrypts a challenge, token, or some piece of data and sends it to your device
- Your device decrypts that piece of data with the private key associated with the website
- At this point, your device either sends the decrypted data back to the server in exchange for an access token or maybe you decrypted the access token (not sure exactly how that will work. If it’s the former, the data would still be encrypted via ssl so only you and the server would see it)
- Now you are logged in
Closing:
So, it’s supposed to be more secure because every time you login, you never type in a password that gets transferred to the server for verification. The server is sending your device data to verify so that it can then verify you. This mainly prevents phishing and the reuse of passwords but I suppose if someone hacks into your iCloud account or whatever, they have the keys to the kingdom 🤷♂️
As you point out, the single point of failure is access to the passkey repository. Of course, this will usually be 2FA, so much more secure than simple passwords which people usually employ.
One major issue, IMHO, is vendor lock-in. I’ve no doubt Apple is going to make migration away from iCloud a huge pain in the ass. It’s just another way they’re going to make it difficult to leave their ecosystem.
I’m also worried about backups. People lose access to their Google and Apple accounts routinely for any and no reason at all. Will these keys be stored in the cloud? If so, access to EVERYTHING is just a capricious random algorithm away from being lost.
I wouldn’t touch any passkey system which doesn’t provide a seamless way to migrate away especially if I’ve lost access to my Apple/Google account.
Having a seamless way to migrate away is itself a security risk, since that method could be used by attackers to compromise the key store. The migration path for any of the major players (Apple, Google, Microsoft, Yubikey) involves logging into each site you used a passkey with, adding a new one from your new passkey store, then revoking the old passkey.
Password managers that store Passkeys may handle this differently, though, and are your best bet if you want migration flexibility.
I’m really over people calling backups a security risk.
There’s a reason bitwarden, 1password, last pass, etc etc. allow you to export your passwords. They also all allow you to do so in an encrypted file.
Accessible keys are a security risk, regardless of how you feel about it. If a key is accessible on the system then any exploit with elevated read permissions can steal the entire key store. By leveraging hardware features that let you add and use a key but prevent reading it, you mitigate that risk. There’s a reason that on Yubikeys, secrets are write-only.
Bitwarden, 1Password, and other companies who build password managers are able to operate with higher expectations of their users. Their users opted into using a flexible, secure tool, and as such, they can provide riskier options to their customers. They know that providing a TOTP solution in their application doesn’t force their customers to use it when doing so would be outside their risk tolerance.
That said, every password manager that I know of - Apple’s, Google’s, Microsoft’s, Firefox’s, as well as dedicated password managers - has an export tool. But this doesn’t mean that all of those providers value having flexibility. I’d argue that in many cases it just means that they recognize that a password alone isn’t trusted enough to warrant concealing it. Given that you have to know the password to enter it, there’s much less value in concealing it from the end user. Since passkeys don’t work that way and do have that value, it makes sense for providers, if they are opting to prioritize security, would choose a less-flexible solution that most of their users don’t care about.
If the big providers did offer a more flexible alternative, enabling exports, to advanced users, those users would necessarily have reduced security and they would have to opt into that ahead of time, since later the secrets would be inaccessible (theoretically - depending on how the syncing is implemented it might be feasible to intercept them. My assumption, since syncing is within a given ecosystem only, is that when synced they are encrypted with a public key that only their secure hardware can decrypt). Also, having such an option would require a different code pathway when interacting with the secrets store, which would mean more potential code that could have bugs.
The method you describe is untenable for 99.9% of the population. If that is truly the only way to migrate, then this move to passkeys is a catastrophe for security. In the coming years, millions of people are going to be permanently locked out of important accounts. Accounts will be written about the clearly flawed implementation of passkeys by Apple and Google, and a whole generation of people are going to shun passkeys forever. Myself included. This is a nightmare for vendor lock-in. I can see why Apple and Google are so ready to implement this.
How does this work with checking my emails on a public computer in a library, for example? Somehow my private key needs to be shared with the library pc?
Not necessarily. I can’t imagine they’d want you to login to your iCloud or Google account on a public computer. It will probably work how Microsoft “Authenticator” works or how when you try logging in to iCloud or your Google account when you have 2FA turned on:
- Type in your username and click submit on the library computer
- The service on the computer tells you to look at your phone
- In the background, the service sent an encrypted challenge to your iCloud account
- All your devices receives a notification asking if that’s you trying to login
- You pull out your phone, click yes
- In the background, your phone decrypts the challenge and sends it back to the server
- The server verifies its you who is trying to login and logs you in on the library computer
No sharing of keys necessary
Edit: that was just a guess and there are likely a few ways logging in can be achieved on a public computer without needing the private key on that computer. My knowledge on passkeys is surface level, I haven’t really taken the time to look deeply into them yet
If that’s the case, then a bad actor could spam someone’s phone with notifications. All they’d need is a username.
Or, like my mum, you don’t read what the notification says and just hit ‘OK’. Now you’ve let someone into your account without realising
Shit. Good point. According to this blog at 1Password, Bluetooth can be used to have one device verify another for a service. So I guess if the public device has Bluetooth, it’s possible 🤷♂️
There’s more ways such as scanning a Qr code to establish a connection from the app to the computer, or by presenting a number on one device which must be entered on the other
Wouldn’t the private key stay in your phone and you’d be exchanging a challenge and a response?
people have really unsecure pins.
Ok but what’s unsecure with ‘1111’ as long as I’m not telling the order of the digits to anybody?
It can be cracked in less than a second?
If someone never loses their phones, laptop… Maybe it’s secure.
But if someone steals it, how secure can it be? Is the key protected by the pin encryption? If so the encryption is now useless.
Here is a French video about Micode interviewing the French DGSE : https://youtu.be/g_jEz6aF2b4?si=-sUAIvDf4F7-7kGc
They crack the phone security in 4 seconds with the pin beeing : Mic0rp2022. The software used is hashcat, an open source tool.
Pretty sure he was being sarcastic
Here is an alternative Piped link(s):
https://piped.video/g_jEz6aF2b4?si=-sUAIvDf4F7-7kGc
Piped is a privacy-respecting open-source alternative frontend to YouTube.
I’m open-source; check me out at GitHub.
Am not buying the idea. It sounds great on paper but in reality it doesn’t feel better. So idea is you have private and public keys, like many other forms of encryption out there. Private is stored on your device, and public is stored on account holder, like Google. Since keys are mathematically linked anything signed with private key can be verified by public key and vice-versa.
This is great technology and has been proven for decades now. It essentially means your device and account holder can exchange data without anyone ever finding out your private key since it never leaves your device.
However, issues. Keys are backed up somewhere and still depend on password, be it pin or regular old password. Recovering lost key means using password still. That means attack vector has just shifted and they won’t try to steal your key but social engineer their way into phishing your original password, making the whole thing a bit pointless.
Another things that worries me is the possibility each device will have its own key, although they claim transferable. Depending on what data is used to authenticate and prove device is owned properly this can be used to fingerprint users. For example IMEI or some other unique id, etc. Something that’s not easily done with passwords.
Biggest one is the fact it will negate two factor authentication. Verifying code on your phone and knowing password is difficult to exploit since it requires a lot of effort… possession of the device and knowledge of password. But with passkeys, there’s no password to remember and everything boils down to owning a device. They are then relying on the OS and device itself not to leak sensitive information. Not something I’d rely on.
Also, private key being backed up on Google means should they ever leak data someone can get everything they need to access your account. Private keys being protected by simple pin or password means nothing and would probably be easily broken due to simple nature of the protection.
Am not convinced this will see such high adoption as so many are claiming it will have.
Most hardware today has what’s called a TPM. It’s a physical hardware chip that can store certificates in a way that can’t be extracted.
It’s way more secure than someone stealing a cer file.
I know what TPM is, am not talking out of my ass here. But chain is only as strong as its weakest link, which is backup certificates somewhere protected by a pin or simple password. If it still requires password to access certificate, than you have moved issues from one place to another. What good is iron front door when you leave your windows open.
It doesn’t feel better? Good thing security doesn’t care about feelings. The fact is it is more secure no matter what it feels like. Privacy is maintained since you use a new key with each site. There is no IMEI or anything like that in the passkey spec. Social engineering ranges from more difficult to impossible depending on if you use a synced, local software based, or hardware based passkey system.
You have a lot of incorrect assumptions. Read https://support.apple.com/en-us/102195 and https://fidoalliance.org/passkeys/#faq.
You have a lot of incorrect assumptions
No I don’t. You either misunderstood what I wrote about or don’t understand how whole process works. There’s no denial that signing in with passkeys is more secure. Technology has been there for a while and it’s proven. But that’s only one part of the whole process.
However, even the site you linked states:
When a user is asked to sign in to an app or website, the user approves the sign-in with the same biometric or PIN or on-device password that the user has to unlock their device (phone, computer, or security key). The app or website can use this mechanism instead of the traditional username and password.
Problem is in biometric or PIN on device. Which is what I talked about, you replace 2 factors with a single point of authentication. No matter how secure data exchange between site and device is, getting hold of your device means there’s a potential to losing access.
They claim second factor and password can be fished, but so can your PIN, and it’s even easier since it’s usually short. Whole security idea they are proposing is removing human factor completely from the authentication process. Which in general is not a bad idea to get rid of bad habits people have but at the same time, those bad habits are just relocated elsewhere. There are number of YouTube videos showcasing how easy it is to bypass lock screen patterns and PINs. Not to mention huge amount of people who simply don’t want to have any sort of security on their phone.
They claim passkeys are multi-factor in essence, but that’s not true. Whole point of multi-factor authentication is to make it harder to posses all things needed to exploit the data. Access to ATM requires card and pin, one thing you posses other have in your head. OTP works the same way, user/pass for web and then device you posses generates one time password. Having everything in one place is like locking your door and leaving the key beneath the door mat. Key can be as elaborate as it wants to, if someone lifts the door mat, whole security goes away.
Use a pair of hardware tokens and a long pin if you want maximum security. If you want to use a sync-able software token do that and set a strong pin.
You like long passwords? Go ahead and put one on your passkeys. You don’t have to use a short pin.
It is two factor. Something you have, key in TPM or hardware token, and something you know: the PIN. Or if you choose to enable biometric it shifts to two things you have the: key and your face/fingerprint.
Remember you only have limited attempts to guess the PIN and biometric auth is subject to configurable timeout conditions before the PIN is required.
Any security conscious person will use a strong PIN. Many will choose to use biometrics as well for convenience. Most people are still setting their password to Sm3llyK@t42 on every website. A protected key and a 4-digit pin/finger print is a huge leap in security.
But that’s the whole thing we are trying to solve here. We are trying to eliminate human factor and by extension bad habits people have when it comes to security. So expecting people to use good passwords and pins for keys will be the same as expecting people to have good passwords for accounts. Perhaps even worse because of claims it’s better security so people might even relax more.
Also timeouts with pins and passwords mean very little once someone has your device. This is why I don’t consider it good two-factor. PIN might be in your head, but nothing is preventing someone brute forcing it. Once you image the device you can do whatever you want. With credit cards, you’d need ATM to keep doing it and lockout is a serious problem there.
It’s a step in right direction for sure, but I’d prefer if keys didn’t depend on PIN or password.
But that’s the whole thing we are trying to solve here. We are trying to eliminate human factor and by extension bad habits people have when it comes to security. So expecting people to use good passwords and pins for keys will be the same as expecting people to have good passwords for accounts. Perhaps even worse because of claims it’s better security so people might even relax more.
I feel like it’s 2001 and I’m trying to convince my users to switch from passwords to RSA keys for SSH. Yes there are potential weaknesses. Yes it’s still much better.
Also timeouts with pins and passwords mean very little once someone has your device. This is why I don’t consider it good two-factor. PIN might be in your head, but nothing is preventing someone brute forcing it. Once you image the device you can do whatever you want. With credit cards, you’d need ATM to keep doing it and lockout is a serious problem there.
Even if all we’ve done is reduced potential attackers from everyone with an Internet connection to people with physical access to the device we’ve still massively increased the average user’s security. And we’ve done more than that.
Also unless you can clone the device somehow hitting max guesses and losing access just like an ATM is part of the design.
It’s a step in right direction for sure, but I’d prefer if keys didn’t depend on PIN or password.
I lost track of your suggestion over the weekend but what was your suggestion for second factor other than a pin or password?
I didn’t have one, I just disliked the idea of having all that’s needed for auth in a single device which can be lost.
Thanks for the civil discussion. While my views haven’t changed I have learned a lot about possible objections from informed people.
Let’s hope this new auth standard is implemented responsibly by all the major parties and that weak passwords and phishing become relics of the past.
deleted by creator
How long do you think this will last until they kill it?
Until Google “kills” passkeys as a default for personal accounts? They probably won’t. Google can’t kill passkeys in general btw, it’s an open standard not a Google thing.
They will find a way
Insane take. What other open standards do you believe Google is capable of killing? It’s just one company they aren’t god.
They kind if killed JPEG-XL
Kinda. Given that nobody else supported it Google dropping it did sort of kill it. Passkeys are very different as they are already supported by Apple, Microsoft, and scads of smaller companies.
a year maybe
This is the best summary I could come up with:
Google is taking a big step toward making passkeys the default login option for its users.
Starting today, users logging in to personal Google accounts will be prompted to create and use passkeys instead of passwords when possible.
They’re both easier to use and more secure than passwords, so users no longer need to rely on the names of pets, birthdays or the infamous “password123.” Instead, passkeys let users sign in to apps and sites the same way they unlock their devices: with a fingerprint, a face scan or a screen lock PIN.
And, unlike passwords, passkeys are resistant to online attacks like phishing, making them more secure than things like SMS one-time codes.
Google has been experimenting with passkeys across numerous products, including Chrome, over the past year.
Users who want to forgo passkeys can uncheck the “skip password when possible” option in their accounts.
The original article contains 289 words, the summary contains 146 words. Saved 49%. I’m a bot and I’m open source!
This video about passkeys is fascinating. They are very secure even if your pin is 1234. The only way for someone to hack your account is if they have your device.
Here is an alternative Piped link(s):
Piped is a privacy-respecting open-source alternative frontend to YouTube.
I’m open-source; check me out at GitHub.
deleted by creator
The problem with Google’s passcodes:
- I don’t use Google account on my phone. In a rare occasion I need to access gmail outside of my home, I just log in via a browser, either on my phone or work computer or wherever.
- My home PC has no authentication whatsoever. The three physical locks on my apartment’s door is the access control. Couldn’t lug it around for authentication, anyway.
- I have no other devices that could be used for this passcode thing, and my phone is usually laying around somewhere, probably shut off with empty battery.
In fact, I have not bothered even with 2FA for google accounts. At this point these are just “garbage collection accounts” for spam and youtube subscriptions/playlists, anyway.
i don’t own a ‘device’ to use for this. i don’t even want one.
