- cross-posted to:
- [email protected]
- [email protected]
- cross-posted to:
- [email protected]
- [email protected]
You must log in or register to comment.
I wish FIDO had paid more attention to SQRL. It’s long in the tooth now, but with some attention it could have been a better solution than passkeys, IMO.
Passkeys are also weirdly complex for the end user too, you can’t just share passkey between your devices like you can with a password, there’s very little to no documentation about what you do if you lose access to the passkeys too.
you can’t just share passkey between your devices like you can with a password
Either you enroll a system that shares them between devices without the need for special interaction (password manager, iCloud etc) or you enroll each device separately into your account.
You can have more than one passkey for a service. This is a good thing.
you can’t just share passkey between your devices like you can with a password
You would just sign into your password manager or browser on both devices and have access to them?
Additionally, whatever app or service you’re storing them in can provide sharing features, like how Apple allows you to share them with groups or via AirDrop.
there’s very little to no documentation about what you do if you lose access to the passkeys too.
If you lose your password, there are recovery options available on almost all accounts. Nothing about passkeys means the normal account recovery processes no longer apply.
You would just sign into your password manager or browser on both devices and have access to them?
Does it work like that? Everything I see says they’re tied to that device.
If you lose your password, there are recovery options available on almost all accounts.
Fair, I guess I’ve never lost a password because it’s just a text string in my PW manager, not some auth process that can fail if things don’t work just right.
Does it work like that? Everything I see says they’re tied to that device.
It depends on what kind you want to use. If you want the most security, you can store them on something like a Yubikey, with it only being on that device and not exportable. If you get a new device, you’ll need to add that new device to your accounts. For less security but more convenience, you can have them stored in a password manager that can be synced to some service (self-hosted or in the cloud) or has a database file that can be copied.
Fair, I guess I’ve never lost a password because it’s just a text string in my PW manager, not some auth process that can fail if things don’t work just right.
That’s fair. It can be a bit of a mess with different browser, OS, and password manager support and their interactions but it has continued to get better as there is more adoption and development.
I’m not gonna lie I still don’t understand how passkeys work, or how they’re different from 2fa. I’m just entering a PIN and it’s ok somehow? I don’t get it.
It uses asymmetric cryptography. You sign a login request with the locally stored private key and the service verifies the signature with their stored public key. The PIN on your device is used to unlock access to the private key to sign the login request.
So isn’t the pin now the weakest link and shorter than a password
Typically in most situations where a PIN is used on a modern device, it is not just the number you enter but some kind of hardware backing that is limited to the local device and also does things like rate limiting attempts.
The passkey stored locally in some kind of hardware backed store on your device or in your password manager is the first factor: something you have.
The PIN/password or fingerprint/face to unlock the device and access the stored passkey is the second factor: something you know or something you are, respectively.
Two factors gets you to 2FA.
If you’ve ever used ssh it’s very similar to how ssh keys work. You create a cryptographic key for the site; this is the passkey itself. When you go to “log in” the client and server exchange cryptographic challenges, which also verifies the site’s identity (so you can’t be phished…another site can’t pretend to be your bank, and there are no credentials to steal anyway). Keys are stored locally and are generally access restricted by various methods like PIN, passphrase, security key, OTP, etc. When you’re entering your PIN it’s how the OS has chosen to secure the key storage. But you’ve also already passed one of the security hurdles just by having access to that phone/computer. It is “something you have”.
So one password to access them all basically?
That’s quite a weakness.
It’'s really up to the end device (and the user of said device) to decide how much security to put around the local keys. But importantly, it also requires access to the device the passkeys are stored on which is a second factor. And notably many of the implementations of it require biometrics to unlock.
The “one password” thing is also true of password managers, of course. One thing about having one master passphrase is that if you do not have to remember 50 of them, then you can make that passphrase better then you otherwise might, plus it should be unique, which prevents one of the most common attack vectors.
So one password to access them all basically?
That’s essentially how all password managers work currently though?
True, I hoped for something better :-/
If it makes you feel better, most PINs on modern devices are hardware backed in some way (TPM, secure enclave, etc) and do things like rate limiting. They’ll lock out using a PIN if it’s entered incorrectly too many times.
If you get my master keepass password, you have all my passwords, too.
As I said to Spotlight7573 yes true, I just hoped for something better.
If you’re paranoid about this, go buy a yubikey and use that to secure your device/access to your passkeys. Being able to secure your own data instead of relying on the admin who may or may not know what they’re doing to secure the server is an advantage of passkeys.
Why does anyone still give a fuck what DHH has to say any more?
Rails is a ghetto has been a thing for over a decade, and the man is basically just a tech contrarian at this point.
Whatever way the world is moving, expect DHH to have a different opinion about it.
Random email auth is some thought leadering for sure.
Passkeys aren’t a full replacement in my opinion, which is what DHH gets wrong. It’s a secure, user-friendly alternative to password+MFA. If the device doesn’t have a passkey set up you revert to password+MFA.
And the fewer times that people are entering their password or email/SMS-based 2FA codes because they’re using passkeys, the less of an opportunity there is to be phished, even if the older authentication methods are still usable on the account.
DHH with a pants-on-head stupid argument just because he hates the big players in tech? Must be a day ending in Y again.
I disagree with most of those arguments in the article… Additionally, there is nearly no passkey using service that does require you to still have PW and 2FA login active even if you use passkeys
We are right now in the learning/testing phase. It is not a flip and suddenly only passkey work. Transition to passkey only will be a very long time, like it was for 2FA, like, my girlfriend has it on, only at about 2 services, lol.
The main problem I have is, that people without knowledge get grabbed into walled gardens using passkeys. People with knowledge know that you can use alternative apps for passkeys, like proton or strongbox (keepass).
Just. Use. A. Fucking. Password. Manager.
It isn’t hard. People act like getting users to remember one password isn’t how it’s done already anyway. At least TFAing a password manager is way fucking easier than hoping every service they log into with “password123” has it’s own TFA. And since nearly every site uses shit TFA like a text or email message, it’s even better since they can use a Yubikey very easily instead.
Passkeys are a solution looking for a problem that hasn’t been solved already, and doing it badly.
Yes, use a password manager to store your passkeys.
Passkeys are a solution looking for a problem that hasn’t been solved already, and doing it badly.
You say that and then
hoping every service they log into with “password123” has it’s own TFA. And since nearly every site uses shit TFA like a text or email message
That’s literally a problem passkeys solve and password managers don’t lol
I make the assumption people are using the password managers like they should, which is generating unique, complex passwords, which is kinda the point. Once you hit a certain number of characters on a random password, you might as well not try. And passkeys don’t solve any sort of MFA problem, same as passwords.
And tell me something, do you realize how cunty you come off when you end a comment with “lol”?
And passkeys don’t solve any sort of MFA problem
They do in fact solve this problem. Passkeys are something you have, and are secured by something you know, or something you are.
They also solve an age-old problem with passwords, which is that regardless of how complex your password is, it can be compromised in a breach. Because you have no say in how a company stores your password. And if that company doesn’t offer 2FA or only offers sms or email verification, then you’re even more at risk. This problem doesn’t exist with passkeys.
Edit: lol
it can be compromised in a breach
Sure, and then that one password is compromised. Password managers make it trivial to use unique passwords for every service, so if a service is breached, you’re basically as screwed with passwords as passkeys.
The switching cost here is high, and the security benefits are marginal in practice IMO. I’m not against passkeys, but it should be something password managers handle, and I don’t have a strong preference between TOTP baked into your PW manager and passkeys.
Sure, and then that one password is compromised.
Which means that entire service you used that password to login to is compromised. If you were using passkeys however, you would have nothing compromised.
so if a service is breached, you’re basically as screwed with passwords as passkeys.
No… with a passkey you would be not screwed at all. You’d be entirely unaffected.
the security benefits are marginal in practice
I mean in your own example that’s a reduction of 100%. That’s kind of a huge difference.
You’re looking at this from the perspective of an educated end user. You’re pretty secure already from some common attack vectors. You’re also in the minority. Passkeys are largely about the health of the entire ecosystem. Not only do they protect against credentials being stolen, they also protect against phishing attacks because identity verification is built in. That is of huge value if you’re administering a site. Yes if everyone used a password manager there would be less value, but only about a third of users do that. And as an admin you can’t just say “well that guy got phished but it’s his own fault for not using a password manager.”
Password managers have only really taken off in the last half-decade, so one-third is kind of to be expected. I know they’ve been around a long time, but major adoption has been recent.
Passkeys will take a while to get wide adoption as well, especially with syncing problems that we’ve seen.
Password managers are never going to hit anywhere near 100% adoption rate. It requires knowledge on the part of the user and in many cases money. No grandma isn’t going to roll her own with keepass. Most likely she’ll never even know what a password manager is. And as long as those users are still out there, admins still have to deal with all the problems they bring.
Incidentally I looked and it’s been over a decade since I started using my first password manager. They’re not that new.
Password managers are too hard for the boomers
I do think that we need more standard procedures around what a reset/authorize new device looks like in a passkey world. There’s a lot about that process that just seems like it’s up to the implementer. But I don’t think that invalidates passkeys as a whole, and most people are going to have access to their mobile device for 2 factor no matter where they are.
Incidentally I have no idea who this is or whether his opinion should be lent more weight.
I just wish that companies enabling passkeys would still allow password+MFA. There are several sites that, when you enable passkeys, lock you out of MFA for devices that lack a biometric second factor of authentication. I’d love to use passkeys + biometrics otherwise, since I’ve often felt that the auth problem would be best solved with asymmetric cryptography.
EDIT: I meant to say “would still allow passkeys+MFA.” hooray for sleep deprivation lol.
If companies still allowed you to login via password then any benefit you get from Passkeys would be null and void. In order to implement passkeys properly you have to disable password authentication.
The thing is it’s then on you to secure your passkey with biometrics or a password or whatever you prefer. Your phone most likely will use biometrics by default. If you’re on Mac or PC you’ll need to buy a thumbprint scanner or use camera-based window hello / secure enclave
I just don’t get why I can’t use something like TOTP from my phone or a key fob when logging in with a passkey from my desktop. Why does my second factor have to be an on-device biometrically protected keystore? The sites I’m thinking of currently support TOTP when using passwords, so why can’t they support the same thing when using passkeys? I don’t want to place all my trust in the security of my keystore. I like that I have to unlock my phone to get a TOTP. Someone would have to compromise my local keystore and my phone, which makes it a better second factor in my opinion.
EDIT: like, at work, I ssh to servers all over the damn place using an ssh key. I have to get to those servers through a jump box that requires me to unlock my phone and provide a biometric second factor before it will allow me through. That’s asymmetric cryptography + a second factor of authentication that’s still effective even if someone has compromised my machine and has direct access to my private key. That’s what I want from passkeys.
I have to get to those servers through a jump box that requires me to unlock my phone and provide a biometric second factor before it will allow me through.
That is also the case with passkeys, if you so choose. Though they are functionally similar to your SSH key, they don’t just allow you to utilize the key just by having it loaded onto your device. When you go to use a passkey you need to authenticate your key upon use, and you can do that biometrically. For example let’s say I have a passkey on my phone which is currently unlocked and in use. If somebody runs over and steals the phone from my hand and prevents it from locking, and then attempts to authenticate to a site using my passkey, they won’t be able to.
Right, but I can’t require a second factor on a different device that operates outside of my primary device’s trust store. I’m sure there is some way to make my desktop hit my phone up directly and ask for fingerprint auth before unlocking the local keystore, but that still depends on the security of my device and my trust store. I don’t want the second factor to be totally locked to the device I’m running on. I want the server to say, “oh, cool, here’s this passkey. It looks good, but we also need a TOTP from you before you can log in,” or “loving the passkey, but I also need you to respond to the push notification we just sent to a different device and prove your identity biometrically over there.” I don’t want my second factor to be on the same device as my primary factor. I don’t know why a passkey (potentially protected by local biometric auth) + a separate server-required second factor (TOTP or push notification to a different device or something) isn’t an option.
EDIT: I could make it so a fingerprint would decrypt my SSH key rather than what I have now (i.e. a password). That would effectively be the same number of factors as you’re describing for a passkey, and it would not be good enough for my organization’s security model, nor would it be good enough for me.
I mean you don’t have to authenticate your passkey with biometrics, you can use a password.
I guess I’m not really picking up on what the benefit is you’re going for. You already have a What You Have and a What You Know or What You Are, and you want a second What You Also Have thrown in there. I mean, I guess having that as an option couldn’t hurt. but I also don’t think it’s really necessary.
Passkeys are already more secure than what you’re doing now. If what you’re aiming for is for them to be even more secure than that, then that’s an admirable goal. But as of right now they are worth it just for the fact that they’re more secure than existing solutions.
Yeah I didn’t understand passkeys. I’m like why is my browser asking to store them? What if I’m using another browser? Why is my password manager fighting with my browser on where to store this passkey?
I felt so uneasy.
So I decided not to use passkeys for now until I understood what’s going on.
I’m like why is my browser asking to store them? What if I’m using another browser? Why is my password manager fighting with my browser on where to store this passkey?
The answer to all of these questions is “For the exact same reason they do all these same things with passwords”
Think of a passkey as a very, very complex password that is stored on your device (or in a password manager) that you can use to log into websites with without ever having to know what the password is, and it’s never stored on the site you’re logging into, even in a hashed format, so it literally can’t be exposed in a breach.
It’s the exact same technology you use to connect securely to every website you visit, except used in reverse.
But that’s the problem isn’t it? You have no idea what the value is, your browser on your laptop or phone you are going to lose/eeplace/reset does. Password managers are still not well understood or used by the masses and browsers stepping in here is a recipe for disaster
With chrome and Firefox maybe the user is syncing them with a profile. But that profile is also probably using a passkey on that very browser. A regular user is going to walk face first into this.
Passkeys are unique cert pairs for each site. The site gets the public key, you keep the private to login under your account. The site never stores your private key.
To store them simply, turn off your browsers password/passkey storage. Store them in your password manager along with other sites passwords.
Sounds similar to the SSL stuff, like for GitHub and stuff. I guess the preference in that case would be my password manager as it stores my password already.
Perhaps it’s best I pay for Bitwarden premium now and use those hardware keys people are recommending.
Also thanks!
Because its the same shit. passkeys are essentially passwordless ssh certificates. we’ve had functional MFA for ssh literally since its inception.
I am very shitty on security (I would not write this reply on a post on the cybersecurity community), and I resisted MFA for several years as being too annoying having to login to mail/SMS. After finding open source apps supporting TOTP, I feel better about it and I manually do the syncing by just transferring the secrets between my devices offline.
Passkeys are another foreign thing that I think I will get used to eventually, but for now there are too many holes in support, too much vendor lock-in (which was my main distaste for MFA, I didn’t want MS or Google Authenticator), and cumbersome (when email and SMS were the only options for MFA, difficulty of portability for passkeys).
So the problems you have with them are already solved, in the exact same ways they were solved for password/MFA. If you let Apple manage everything for you, it doesn’t matter whether you’re using passwords or passkeys, you’re locked in either way. But you always have the option to manage your passkeys manually (just like you’re doing with your TOTP) or using a third party cross-platform solution that allows for passkey import and export.
All the major password managers store passkeys now. I have every passkey I’ve been able to make stored in Bitwarden, and they’re accessible on all my devices.
Article is behind the times, and this dude was wrong to “rip out” passkeys as an option.
I need to sync my passkeys between all my devices–which really means I need keepass to store the private keys in its DB so I can sync it with all the other keepass-compatible apps I use in various places. Last I looked, this wasn’t solved, but it’s been a minute. I’m certainly not using a centralized password manager unless they all can freely import and export from one another. I understand this is a “being worked on” problem.
So someday, yes.
Isn’t the sync for keepass-compatible apps just syncing a normal file?
If a password manager stores passkeys, how is that much different than just using a password manager with passwords?
Storing passwords in a password manager is storing a shared secret where you can only control the security on your end and thus is still vulnerable to theft in a breach, negligence on the part of the party you’ve shared it with, phishing, man in the middle potentially, etc.
Storing a passkey in a password manager on the other hand is storing an unshared secret that nobody but you has access to, doesn’t leave your device during use, is highly phishing resistant, can’t be mishandled by the sites you use it to connect to etc.
Can you elaborate a bit more? If I create a passkey on https://passkeys.io on my Mac, then store the passkey in a password manager like Bitwarden, I can log into that site on my phone. I was kinda under the impression that Bitwarden stored the private key on their servers, so if their site gets hacked, then the attacker has access to my passkey.io account?
Your vault is encrypted on your device before it’s sent to Bitwarden’s servers, so even they don’t have access to your passwords and passkeys.
More info on how it is encrypted is here:
https://bitwarden.com/help/what-encryption-is-used/
Pretty much every password manager works like this. Having access to your data would be a liability for them.
That’s a typical DHH article, essentially. He has some interesting insights, but everything else is borderline cult-leader opinions, and some people follow it as gospel
I feel like if DHH hadn’t picked Ruby on Rails it and standalone Ruby would be much more popular today.
Whenever I read an article about security (and read the comments, even here on Lemmy) I’m constantly frustrated and depressed by a couple of things.
-
Corporations making things shittier with the intention of locking customers in to their stupid proprietary ecosystem. And of course, they are always seeking more data harvesting. Security itself is way down the list of their priories, if it’s even there at all.
-
Users being lazy trend-followers who quickly sacrifice their security on the altar of convenience and whatever shiny new FOMO thing is offered up for “better security”.
It’s a very bad combination. Doing security right is a bit inconvenient (which users hate) and expensive (which corporations hate).
You would be less constantly frustrated and depressed if you learned a little bit about security, instead of getting upset about imagined problems with technology you don’t understand.
I’m not against passkeys. They have some real advantages. And I understand more than you think.
My comment is primarily about the preferred ecosystems that tend to come along with these newer solutions (like Apple’s iCloud or Google’s Password Manager) and how the corporations take advantage of user laziness and bandwagon jumping.
They may not force you to be exclusive with them, but they definitely want you to be. And over time they will likely make it more and more inconvenient not to be locked in with them.
For contrast, I use BitWarden for password management and Bitwarden Authenticator for TOTP (and I keep safe copies of TOTP secret keys elsewhere). This is a generic open-standards-first approach to things, with relatively easy recovery should you lose something. You can export your passwords. You have copies of your secret keys. You are in no way locked in to BitWarden forever.
Passkeys can also work within that type of operational framework! Like TOTP which normally uses RFC6238, Passkeys tend to use CTAP or WebAuthn. All of the above are open standards. And this is a good thing!
But do you really think Apple, Google, Microsoft, etc, want to play nice long term? Hopefully they will. But I have also run into evil nonsense like LastPass, which even though they also used open standards, their software would not allow you to do simple things like recover your own secret keys, export your data, etc. (Not to mention the embarrassing security breach they had and the wretched response, the main reasons to dump them).
While I am not directly comparing an idiot company like GoTo Tech with Apple et al, they all have the same types of big brain MBA types working for them who love to constantly brainstorm new ideas on how to screw the users over by taking features away and calling it a “software upgrade”.
So, passkeys as a security mechanism: sure, this gets my vote. But trusting the big corporations not to change the rules on us later…come on, get real. They love limiting or removing portability and recovery options whenever they can.
Bottom line: don’t assume passkeys are inherently good or bad. It’s simply a security standard that can work well if implemented correctly. Passkeys make logging in easier. But will they also make recovery / export / migration easier…? Because if it’s not easy, people won’t do it.
-
His “just use email” like that isn’t very obviously worse in every respect kind of undermines his whole premise.
It’s because he has an email company he wants you to use for $100 a year lol
His whole premise is undermined by him not doing any research on the topic before deciding to write a blog post. Proton passkeys for instance, are cross platform, and the ability to transfer passkeys between devices is one of the features being worked on by the other providers.
Yeah… Why are articles like this being upvoted… I expected better from lemmy
This is the “Technology” community which isn’t for people who are actually tech-savvy in any functional way, it’s just for gadget-head laymen.
