- cross-posted to:
- [email protected]
- [email protected]
- cross-posted to:
- [email protected]
- [email protected]
You must log in or register to comment.
I do think that we need more standard procedures around what a reset/authorize new device looks like in a passkey world. There’s a lot about that process that just seems like it’s up to the implementer. But I don’t think that invalidates passkeys as a whole, and most people are going to have access to their mobile device for 2 factor no matter where they are.
Incidentally I have no idea who this is or whether his opinion should be lent more weight.
Passkeys aren’t a full replacement in my opinion, which is what DHH gets wrong. It’s a secure, user-friendly alternative to password+MFA. If the device doesn’t have a passkey set up you revert to password+MFA.
And the fewer times that people are entering their password or email/SMS-based 2FA codes because they’re using passkeys, the less of an opportunity there is to be phished, even if the older authentication methods are still usable on the account.
This article is FUD from big password.
If we all had big passwords, this may not have been an issue to begin with lol
Probably, but the real problem has been database dumps for a good number of years now. Maybe this thing fixes that?
That is true. That has been, and (for some dumb reason) continues to be, a real problem.
Just. Use. A. Fucking. Password. Manager.
It isn’t hard. People act like getting users to remember one password isn’t how it’s done already anyway. At least TFAing a password manager is way fucking easier than hoping every service they log into with “password123” has it’s own TFA. And since nearly every site uses shit TFA like a text or email message, it’s even better since they can use a Yubikey very easily instead.
Passkeys are a solution looking for a problem that hasn’t been solved already, and doing it badly.
Password managers are too hard for the boomers
Yes, use a password manager to store your passkeys.
Passkeys are a solution looking for a problem that hasn’t been solved already, and doing it badly.
You say that and then
hoping every service they log into with “password123” has it’s own TFA. And since nearly every site uses shit TFA like a text or email message
That’s literally a problem passkeys solve and password managers don’t lol
I make the assumption people are using the password managers like they should, which is generating unique, complex passwords, which is kinda the point. Once you hit a certain number of characters on a random password, you might as well not try. And passkeys don’t solve any sort of MFA problem, same as passwords.
And tell me something, do you realize how cunty you come off when you end a comment with “lol”?
And passkeys don’t solve any sort of MFA problem
They do in fact solve this problem. Passkeys are something you have, and are secured by something you know, or something you are.
They also solve an age-old problem with passwords, which is that regardless of how complex your password is, it can be compromised in a breach. Because you have no say in how a company stores your password. And if that company doesn’t offer 2FA or only offers sms or email verification, then you’re even more at risk. This problem doesn’t exist with passkeys.
Edit: lol
it can be compromised in a breach
Sure, and then that one password is compromised. Password managers make it trivial to use unique passwords for every service, so if a service is breached, you’re basically as screwed with passwords as passkeys.
The switching cost here is high, and the security benefits are marginal in practice IMO. I’m not against passkeys, but it should be something password managers handle, and I don’t have a strong preference between TOTP baked into your PW manager and passkeys.
Sure, and then that one password is compromised.
Which means that entire service you used that password to login to is compromised. If you were using passkeys however, you would have nothing compromised.
so if a service is breached, you’re basically as screwed with passwords as passkeys.
No… with a passkey you would be not screwed at all. You’d be entirely unaffected.
the security benefits are marginal in practice
I mean in your own example that’s a reduction of 100%. That’s kind of a huge difference.
that entire service you used that password to login to is compromised
If the password is compromised, it means the service is compromised and the password isn’t really protecting anything anymore. So to me, there’s no functional difference between passwords and passkeys once a service is compromised, the data is already leaked. If I’m using proper MFA, there’s no rush to reset my PW unless the service has a stupid “backdoor” that can just bypass MFA entirely, in which case passkeys wouldn’t help either (attackers would just use the backdoor).
The main value of passkeys, AFAICT, is that they’re immune to phishing attacks. Other than that, they’re equivalent to TOTP + random password, so a password manager that supports both provides nearly equivalent security to a passkey (assuming the service follows standards like storing salted hashes). And honestly, if you use a solid form of TOTP (i.e. an app, not text or email), password security isn’t nearly as critical since you can make up for it by improving the TOTP vault security.
I honestly haven’t bothered setting up passkeys anywhere, because I don’t see any real security benefit. If a service provides passkeys, it probably already supported decent MFA and random passwords. The services that should upgrade won’t, because they’ve already shown they don’t care about security by not providing decent MFA options.
In short:
- passkeys > passwords
- passkeys == random passwords + TOTP
The venn diagram of companies that support passkeys and companies that supported/support random passwords + TOTP is essentially a circle, with the former enclosed in the latter. So I don’t really see any rush to “upgrade.”
Not even close. To be honest you’re operating on so many incorrect assumptions and have such a lack of general knowledge of common attack surfaces or even the average scope of modern breaches, that digging you out of this hole would take so much more than what I can fit in a single comment.
So
If the password is compromised, it means the service is compromised and the password isn’t really protecting anything anymore
No… just no. That isn’t how it works. In reality, what commonly happens is metadata around the service is what’s targeted and compromised. So your password, email, and other data like that are what’s stolen. Maybe in plain text, maybe something hashed that a malicious actor can brute force offline without you knowing. If you’re someone using a password in this situation, your password is then used to access your account, and that actor can do any number of things while masquerading as you, potentially entirely undetected. If you’re using a passkey on the other hand, this isn’t even something you need to worry about. They cannot get access to your passkey because the service doesn’t even have it. You are entirely immune. That is something that no amount of Passwords or bolt-ons will fix.
This is the main value of passkeys, they are not shared secrets. Not only is that a huge difference, it’s the single largest paradigm shift possible. The secondary value of passkeys is that they are immune to phishing. This is also huge, as phishing is hands down the most successful way to break into someone’s account, and happens to even the most security conscious people. If a cybersecurity researchers who write books on the topic can be phished, so too can a layman such as yourself. Hand waving away a phishing immune authentication system is unhinged behavior. And it goes to show you’re not even coming from a place of curiosity or even ignorance, but likely misinformation.
In short:
- Passkeys > Passwords
- Passkeys > Random Passwords + TOTP.
You’re looking at this from the perspective of an educated end user. You’re pretty secure already from some common attack vectors. You’re also in the minority. Passkeys are largely about the health of the entire ecosystem. Not only do they protect against credentials being stolen, they also protect against phishing attacks because identity verification is built in. That is of huge value if you’re administering a site. Yes if everyone used a password manager there would be less value, but only about a third of users do that. And as an admin you can’t just say “well that guy got phished but it’s his own fault for not using a password manager.”
Password managers have only really taken off in the last half-decade, so one-third is kind of to be expected. I know they’ve been around a long time, but major adoption has been recent.
Passkeys will take a while to get wide adoption as well, especially with syncing problems that we’ve seen.
Password managers are never going to hit anywhere near 100% adoption rate. It requires knowledge on the part of the user and in many cases money. No grandma isn’t going to roll her own with keepass. Most likely she’ll never even know what a password manager is. And as long as those users are still out there, admins still have to deal with all the problems they bring.
Incidentally I looked and it’s been over a decade since I started using my first password manager. They’re not that new.
I have a sub to dashlane that came with ten additional subs and despite trying to literally give them away to family and friends and you’d think I was trying to pull teeth.
Why not just passkeys with a “magic link” fallback though?
This is the same as forgotten password so ytf not
Passkeys are also weirdly complex for the end user too, you can’t just share passkey between your devices like you can with a password, there’s very little to no documentation about what you do if you lose access to the passkeys too.
you can’t just share passkey between your devices like you can with a password
Either you enroll a system that shares them between devices without the need for special interaction (password manager, iCloud etc) or you enroll each device separately into your account.
You can have more than one passkey for a service. This is a good thing.
Gotcha, that makes more sense when explained that way!
Any of the multi-platform password managers that support pass keys will solve this.
You walk into the vault on every platform and your pass keys are magically shared between every platform you’re logged into.
In any system that I’ve used pass keys for (which is every system that supports them), you can go into the password section and delete devices/passkeys.
To regenerate new passkeys they either support it directly in the spot where you deleted it or you log out log back in with username password and 2FA and it asks you again if you want to set up a passkey. I’ve not run into anything else.
I think that passkeys are simple, but no-one explains what they do and don’t do in specific terms.
Someone compared it to generating private/public key pairs on each device you set up, which helps me a bit, but I recently set up a passkey on a new laptop when offered and it seemed to replace the option to use my phone as a passkey for the same site (which had worked), and was asking me to scan a QR code with my phone to set it up again.
So I don’t know what went on behind the scenes there at all.
The passkey on your phone stopped working when you set one up on your laptop? I would expect the site to allow one per device instead of one per account.
Some sites only allow one public key per account…
Which is really stupid of them but technically within spec currently.
It seemed that way, it asked me to scan a QR code on my phone to link it, which didn’t happen before.
Or maybe the option to use my phone was some older auth method, where I’d use the fingerprint reader on the phone to confirm a login on the laptop. I thought that was a passkey, but that doesn’t fit with what I’m reading about what it does now.
The only way I ever used passkeys is with bitwarden, and there you are sharing them between all bitwarden clients.
From my very limited experience, pass key allows to login faster and more reliable compared to letting bitwarden enter passwords and 2fa keys into the forms, but I still have the password and 2fa key stored in bitwarden as a backup in case passkey breaks.
To me, hardware tokens or passkeys are not there to replace passwords, but to offer a faster and more convenient login alternative. I do not want to rely on specific hardware (hardware token, mobile phone, etc.), because those can get stolen or lost.
+1 for Bitwarden. Seamless experience so far. EBay hasn’t yet worked properly, but GitHub does for sure. It’s very convenient, especially if your browser doesn’t store cookies
Interesting, maybe I’ll give it a try. I didn’t know they could just be synced between devices on bitwarden.
you can’t just share passkey between your devices like you can with a password
You would just sign into your password manager or browser on both devices and have access to them?
Additionally, whatever app or service you’re storing them in can provide sharing features, like how Apple allows you to share them with groups or via AirDrop.
there’s very little to no documentation about what you do if you lose access to the passkeys too.
If you lose your password, there are recovery options available on almost all accounts. Nothing about passkeys means the normal account recovery processes no longer apply.
You would just sign into your password manager or browser on both devices and have access to them?
Does it work like that? Everything I see says they’re tied to that device.
If you lose your password, there are recovery options available on almost all accounts.
Fair, I guess I’ve never lost a password because it’s just a text string in my PW manager, not some auth process that can fail if things don’t work just right.
Does it work like that? Everything I see says they’re tied to that device.
It depends on what kind you want to use. If you want the most security, you can store them on something like a Yubikey, with it only being on that device and not exportable. If you get a new device, you’ll need to add that new device to your accounts. For less security but more convenience, you can have them stored in a password manager that can be synced to some service (self-hosted or in the cloud) or has a database file that can be copied.
Fair, I guess I’ve never lost a password because it’s just a text string in my PW manager, not some auth process that can fail if things don’t work just right.
That’s fair. It can be a bit of a mess with different browser, OS, and password manager support and their interactions but it has continued to get better as there is more adoption and development.
I’m excited to see where it is in another year or so, the idea of using public/private keys for logins is neat for sure.
Why does anyone still give a fuck what DHH has to say any more?
Rails is a ghetto has been a thing for over a decade, and the man is basically just a tech contrarian at this point.
Whatever way the world is moving, expect DHH to have a different opinion about it.
Random email auth is some thought leadering for sure.
I’m not gonna lie I still don’t understand how passkeys work, or how they’re different from 2fa. I’m just entering a PIN and it’s ok somehow? I don’t get it.
The passkey stored locally in some kind of hardware backed store on your device or in your password manager is the first factor: something you have.
The PIN/password or fingerprint/face to unlock the device and access the stored passkey is the second factor: something you know or something you are, respectively.
Two factors gets you to 2FA.
It uses asymmetric cryptography. You sign a login request with the locally stored private key and the service verifies the signature with their stored public key. The PIN on your device is used to unlock access to the private key to sign the login request.
So isn’t the pin now the weakest link and shorter than a password
Typically in most situations where a PIN is used on a modern device, it is not just the number you enter but some kind of hardware backing that is limited to the local device and also does things like rate limiting attempts.
It is 2FA. Just easier to use.
As I understand it (and assuming you know what asymmetric keys are)…
It’s about using public/private key pairs and swapping them in wherever you would use a password. Except, passwords are things users can actually remember in their head, and are short enough to be typed in to a UI. Asymmetric keys are neither of these things, so trying to actually implement passkeys means solving this newly-created problem of “how the hell do users manage them” and the tech world seems to be collectively failing to realize that the benefit isn’t worth the cost. That last bit is subjective opinion, of course, but I’ve yet to see any end-users actually be enthusiastic about passkeys.
If that’s still flying over your head, there’s a direct real-world corollary that you’re probably already familiar with, but I haven’t seen mentioned yet: Chip-enabled Credit Cards. Chip cards still use symmetric cryptography, instead of asymmetric, but the “proper” implementation of passkeys, in my mind, would be basically chip cards. The card keeps your public/private key pair on it, with embedded circuitry that allows it to do encryption with the private key, without ever having to expose it. Of course, the problem would be the same as the problem with chip cards in the US, the one that quite nearly killed the existence of them: everyone that wants to support or use passkeys would then need to have a passkey reader, that you plug into when you want to login somewhere. We could probably make a lot of headway on this by just using USB, but that would make passkey cards more complicated, more expensive, and more prone to being damaged over time. Plus, that doesn’t really help people wanting to login to shit with their phones.
If you’ve ever used ssh it’s very similar to how ssh keys work. You create a cryptographic key for the site; this is the passkey itself. When you go to “log in” the client and server exchange cryptographic challenges, which also verifies the site’s identity (so you can’t be phished…another site can’t pretend to be your bank, and there are no credentials to steal anyway). Keys are stored locally and are generally access restricted by various methods like PIN, passphrase, security key, OTP, etc. When you’re entering your PIN it’s how the OS has chosen to secure the key storage. But you’ve also already passed one of the security hurdles just by having access to that phone/computer. It is “something you have”.
So one password to access them all basically?
That’s quite a weakness.
So one password to access them all basically?
That’s essentially how all password managers work currently though?
True, I hoped for something better :-/
If it makes you feel better, most PINs on modern devices are hardware backed in some way (TPM, secure enclave, etc) and do things like rate limiting. They’ll lock out using a PIN if it’s entered incorrectly too many times.
If you get my master keepass password, you have all my passwords, too.
As I said to Spotlight7573 yes true, I just hoped for something better.
If you’re paranoid about this, go buy a yubikey and use that to secure your device/access to your passkeys. Being able to secure your own data instead of relying on the admin who may or may not know what they’re doing to secure the server is an advantage of passkeys.
It’'s really up to the end device (and the user of said device) to decide how much security to put around the local keys. But importantly, it also requires access to the device the passkeys are stored on which is a second factor. And notably many of the implementations of it require biometrics to unlock.
The “one password” thing is also true of password managers, of course. One thing about having one master passphrase is that if you do not have to remember 50 of them, then you can make that passphrase better then you otherwise might, plus it should be unique, which prevents one of the most common attack vectors.
I always thought of passkeys as a convenient way to authenticate.
I am password-less on multiple services.
I have an authentication app on my phone that authenticate me when I am away of my computers. I have passkeys on my personal computer and another set of passkeys on my work laptop.
If I have to authenticate from your computer I simply use my auth app, click on “it’s a public computer” and I am good to go.
The dude discovered a butter knife and he tries to replace his spoon with it just to realize it doesn’t work well for eating a soup.
Do you add separate keys on every device?
If you do, how long does it take you to add a new device?For example, when you login on Github, go in your settings, authentication & security on the left.
Click “add passkey”, enter your Windows Hello PIN, click save.
It will ask you to enter a name, so I go with ComputerName-GitHub
Click ok.
Done with this device.
How long does it take? Well, how fast can you do these steps?
This does not scale. I have 400 logins in my Bitwarden account right now.
Ok
I wish all sites using 2FA would just support hardware keys instead of authenticator apps. It’s so much easier to login to a site by just plugging in my hardware key and tapping its button, than going to my authenticator app and typing over some code within a certain time.
It’s even sinpler than email 2fa or sms 2fa or vendor app 2fa.
For authenticator app you also can’t easily add more devices unless you share the database which is bad for security. For hardware security key you can just add the key as an additional 2fa, if the site allows it.
Agreed, my main issues with hardware keys are that so few sites support them, and the OS support is kinda bad like in Windows the window pops up underneath everything and sometimes requires a pin entered.
I also hate that when I last looked nobody made a key that supports USB-C, USB-A, and NFC. So now I’ve got an awkward adapter I need to carry on my keychain.
Yeah it’s truly a shame almost no site other than google and github support hardware security keys.
For your case you would probably want a yubikey 5c and then a usb c to usb a adapter yeah. I wish for a usb a and c and nfc as well.
I’ve got one each of the USB-C and USB-A versions. The USB-A is actually the one that lives on my keychain as the connector is more robust against debris and I was able to find an adapter that is on a lanyard.
I thought passkeys were supposed to be a hardware device?
This is typical embrace/extend/extinguish behavior from the large platforms that don’t want their web-SSO hegemony challenged because it would mean less data collection and less vendor lock-in.
The whole idea of passkeys provided by an online platform should have been ruled out by the specification. It completely defeats the purpose of passkeys which is that the user has everything they need to authenticate themself.
I thought passkeys were supposed to be a hardware device?
Did you just admit to not even knowing what a passkey is and then decide to continue to write another two paragraphs passing judgement on them and the motives behind them anyway?
If you think that I’m misunderstanding something and arguing from a false premise then please feel free to engage with the discussion.
I don’t think that, you said that. It’s the very first sentence of your comment. You literally said that you misunderstood them to be hardware keys.
And yes, everything else you said is demonstrably false as well. The FIDO alliance and even specifically the companies within it that are pushing Passkeys the most, are advocating for them to be cross platform without any lock in. 1Password is one of the companies pushing for passkeys, they’re even behind the https://passkeys.directory and allow you to securely import and export passkeys so you aren’t locked in. They also made recent changes to the spec itself to make moving and owning passkeys easier. And that’s not even to mention the fact that Passkeys are just key pair, which don’t require any platform or technology to implement that isn’t built into your device.
Did you read the article?
Yes, the author is also suffering from the same misconceptions and doesn’t really understand passkeys beyond the surface level, so he doesn’t know that the problems he has with them don’t exist.
He then goes on to reason that because passkeys might result in an awkward experience in exactly one extremely niche scenario, that you’re better off using passwords in a password manager that are less secure. He then proceeds to suggest the use of email as a second factor as an alternative, which destroys every shred of credibility he had. He also completely misses the fact that putting your passkeys in that very same password manager he himself is suggesting, solves the complaints that form over half of his entire argument. It’s super ironic too because the specific password manager that he’s recommending in his own article is a member of the FIDO Alliance and is literally one of the world’s biggest advocates for passkeys.
DHH with a pants-on-head stupid argument just because he hates the big players in tech? Must be a day ending in Y again.
I wish FIDO had paid more attention to SQRL. It’s long in the tooth now, but with some attention it could have been a better solution than passkeys, IMO.
I am very shitty on security (I would not write this reply on a post on the cybersecurity community), and I resisted MFA for several years as being too annoying having to login to mail/SMS. After finding open source apps supporting TOTP, I feel better about it and I manually do the syncing by just transferring the secrets between my devices offline.
Passkeys are another foreign thing that I think I will get used to eventually, but for now there are too many holes in support, too much vendor lock-in (which was my main distaste for MFA, I didn’t want MS or Google Authenticator), and cumbersome (when email and SMS were the only options for MFA, difficulty of portability for passkeys).
So the problems you have with them are already solved, in the exact same ways they were solved for password/MFA. If you let Apple manage everything for you, it doesn’t matter whether you’re using passwords or passkeys, you’re locked in either way. But you always have the option to manage your passkeys manually (just like you’re doing with your TOTP) or using a third party cross-platform solution that allows for passkey import and export.
