Passkeys do marginally improve security against MITM and phishing attacks, but they are primarily for protecting the lowest common denominator from themselves: people who re-use passwords and/or don't use a password manager.
If you use multiple devices throughout the day, registering passkeys in all of these systems becomes a big headache with O(m*n) complexity, so putting the passkeys in a password manager is the only realistic solution. But this still breaks the login flow for a very common use case: how do I log in on a device that I don't own? With a password in a password manager I at least have the option of manually typing the password.
The biggest problem, though, is how users are pushed into it without any warning or knowledge of what they're signing up for. I've accidentally set up passkeys just by clicking an okay button a few times in the past and had to go back and figure out how to undo it after being blocked from login on another computer (which computer was I on again?).
> The biggest problem, though, is how users are pushed into it without any warning or knowledge of what they're signing up for.
My irritation is that I know what it is, and I've said no thanks many times, but I'm still asked regularly by the likes of Amazon, and they usually pick a time when I'm trying to order something quick¹. It is one of the growing number of things in life that simply have no “no” option, it is always “yes or later” - I wouldn't mind so much if “later” meant “I know the option exists, I'll ask for it if I change my mind, don't bother me again otherwise”. Call me cynical, but if companies are trying to nag me into something I very much doubt the main benefit is mine. I'm sure there are many people out there who go along with it simply because they are sick of being asked repeatedly.
I also don't see the real benefit with the way things are often implemented anyway. When the credential recovery process is sending a magic email or text, making SMTP or SMS the weak link of the chain just as it often is for passwords so I'd be giving up my preferred workflows for no better security.
----
[1] A short while ago I actually ordered from somewhere else because of this, bitter twit that I am. “I wonder if I can get this almost certainly drop-shipped item on next day delivery via Prime?”, [goes to Amazon to check], [get passkey prompt], “sod it, I'll go back to the original place”.
I dropped Amazon entirely a couple years ago because they didn't provide any way at all to separate my credit card from my kid's Fire tablet and I didn't want to be on the hook for thousands in charges because he pushed the wrong button. It's remarkably easy! It has made basically no change to my life except that I'm a little smug about not using Amazon.
What do you use instead? My main reason for using Amazon is the shipping which no one else can come close to
Same or next day shipping on most things I order is wild, when something goes beyond a 2-3 days on Amazon it even feels odd
And the “do you actually need the item/s that fast” isn’t the response I am looking for
Target/Walmart/BestBuy. They both have fast shipping options as well as store pickup. Sometimes (if you live somewhere more rural) they have _faster_ shipping times than Amazon.
I'm not in the US, but friends there tell me that Home Depot routinely delivers from the local store within a few hours.
(Here, unfortunately, their web site is useless crap.)
Walmart / Home Depot / Lowes / Kroger are generally going to beat Amazon on quickest delivery for most people for most items, if they want to, by virtue of their local brick and mortar footprint.
One reason I imagine Amazon pushed so hard for short delivery times was knowing eventually their legacy peers would leverage this against them.
Not to mention a long delivery time gives people more opportunity to simply go to the store and get something, while they’re out running other errands.
I live in a well populated suburban area. If I’m willing to actually leave my house, I can get most things much faster than Amazon can deliver them. This also helps keep those local businesses running, so shipping doesn’t become the only option in the future.
Shop.App doesn't have everything, but they do have a lot and many merchants have fast shipping options. I always try to search them and Newegg before trying Amazon.
Newegg marketplace is a funny place. Not only many items are more expensive than elsewhere, I had my orders delivered literally in Amazon or Walmart packaging. There are genuine merchants that made a choice to work with Newegg but there are many resellers from other stores as well.
Home Depot/Lowes often have faster delivery than Amazon (like literally delivered in a few hours or next day morning).
I live in the country. Amazon takes days to ship out here, though sometimes it has 1-2 day. Walmart has same day shipping (not delivery, regular shipping) and is cheaper or comparable to Amazon.
Could you create a separate account for the tablet without that credit card? Just curious.
but then how do you pay for things if/when you want to buy the little one something?
you either add the card then remove it, get a separate card, or find a way to use credits somehow -- but in the case of the latter two, Junior could still slam a few buttons and eat up all available funds on that card -- just without the impact of your regular card.
This is something that Apple really got right. My kids can initiate any kind of purchase they want (At least, those that are allowed based on Screen Time controls) but every purchase stops and waits for approval from me or my wife. Even if the item is free. No faffing about with credits, or extra cards, or setting limits.
privacy.com lets you generate credit card numbers on the fly
Just use a bank with a decent service (like Revolut), create a separate card number for your kid (10s within the bank app), where you put more money when needed and can easily put the number on hold or activate it whenever you please.
Like this Revolut?
https://cybernews.com/security/revolut-data-breach-75-millio...
> After the publication went live, Revolut reassured that the review is still ongoing. "We have so far still found no indications of any breach."
> "We have checked the user and card identifiers contained in the alleged records against our systems, and none of them correspond to valid or genuine Revolut identifiers," the spokesperson said.
A bank that cannot be used in the browser has no decent service.
The parent had a practical problem. I told him what kind of simple banking feature would easily solve it. I also mentioned a bank, which has it for sure.
For sure, this feature is not a Revolut-exclusive. Plata from Mexico should also have this and much more, from what I have read.
If American/European banks don't have such a simple feature, this speaks volumes about them.
Your comment has a vibe of "a bank that doesn't have a local office has no decent service". To each their own, I guess.
>I also mentioned a bank
if you're not in the US. revolut in the US is a fintech group with a bunch of bank partners.
I mean, you can gift things when you purchase them, not sure why that can't be a way. But I still agree it's silly to have the customers find work arounds.
I think this is the biggest reason why these category of discussion happens in the first place, there is a gap between what technology is good for, whats its ideal for and then the products motivation to push it on to the user assuming it would give a good name to the company.
Passkeys are one of the few protocols that supports against phishing (Accidentally giving away your credential to some rough site) so it has its benefits and more so for enterprise users.
It becomes challenging and is ill suited when its pushed to general public. A middle ground could have been to give it as an option to user instead of forcing it on the user. For some reason its not cool enough.
From a company's perspective
IMO it’s well-suited to the general public!
What is the average person’s threat model? Re-using passwords.
What is their most common annoyance? They forget their passwords.
Built-in password managers are great for this. But they’re not universal (e.g. I believe using Apple Passwords on Mac doesn’t carry over to Android.)
Passkeys are amazing. They’re basically magic to the average person. No typing passwords; no remembering; simply vibing, securely.
I don’t think people are regularly logging in to a huge number of accounts on other devices. Maybe they are! I doubt it.
> What is the average person’s threat model? Re-using passwords.
Wrong.
As article points out, it's not having access to their account.
Followed by not being able to easily delegate access to their account to a trusted third party (like a spouse, a friend).
Password reuse addresses the first problem, however imperfectly. Ability to share password over any channel, including analog, addresses the second.
Passkeys defeat both.
Account recovery works the same with passkeys as with passwords. You click “I forgot/lost my passkey” and get a link sent you via email that lets you create a new one.
Passkeys can also be shared with other people like spouses or friends, just like passwords.
> Passkeys can also be shared with other people like spouses or friends, just like passwords.
How? They're literally designed to not be, because they're trying to prevent phishing, and you cannot in general case distinguish phishing from legitimate delegation of authority.
> Account recovery works the same with passkeys as with passwords … get a link sent you via email
Making the email account, an often attacked resource that is always online, a single point of failure. I don't mind relatively unimportant accounts being that weak, for instance where the only reason to have an account at all is to separate your preferences from someone else's, and you don't actually care about security, but for accounts where there is significant PII or payment details or other sensitive information it is a terrible idea.
A second problem with this is that for many their email account is the same as their account where their passkeys are backed up. What if you have lost your passkey due to Google locking you out for no readily apparent reason and you don't have the online influence needed to get them to take you seriously (instead being trapped in the support bot loop)?
I still run my own mail server, and if I didn't my important mail accounts wouldn't be with someone like Google (I do have a gmail address, but that account is only really used for testing other accounts when needed), so that isn't a problem for me, but most people can't be bothered with that faf¹ so usually end up with one of the big providers.
--------
[1] It isn't actually that much faf², until those occasions when it is³, but more faf than most people care for, especially those that don't enjoy tinkering with technical matters.
[2] Just quietly ticking over as long as I remember to regularly verify it is patched up-to-date, and keep an eye out for zero-day issues concerning the parts involved
[3] When there is a deliverability problem, where I host it has problems so I need to make sure the backup is synced and then switch over to it, when there is a relevant zero-day and I have to rush a patch in (or take other remedial action until a fix is available) then investigate to make sure I wasn't quietly affected, etc.
> Account recovery works the same with ...
Huh, that is a really funny way to spell "the primary login method used by every not-tech-savvy person I have ever met before".
This would explain why so many places have been starting to force me to log in with an email instead of a password.
Oh right, I started to notice it too - couple non-tech people around me seem to treat "password reset" as default login flow, and definitely don't complain as much about auth flows as the rest.
I guess that's one effective way to cope with security industry bullshit.
>You click “I forgot/lost my passkey” and get a link sent you via email that lets you create a new one
I don't trust my email provider.
Woah. Why not get a better email provider?
And now you have to log into your email with a Passkey that probably you lost at the same time you lost your Passkey to the original site (e.g. lost or stolen device).
If you are not using Passkeys for your email (and the site supports that type of account recovery), then you still have only the security of passwords, just with additional steps.
Well, it puts people in a bind. The current status quo of TOTP 2FA with recovery codes is bad, but it's probably the best we have - because applying passkeys to your primary e-mail is beyond stupid at this point, it's putting your digital life in mortal peril.
I guess it really depends on how one choses to define general public, probably an assumption has been made that everyone has their own personal device.
> Built-in password managers are great for this. But they’re not universal (e.g. I believe using Apple Passwords on Mac doesn’t carry over to Android.
1.Only security keys (single device credentials) are what you can use across the device not the regular platform based one
2.Browser based password managers do provide you with that interoperability across the platforms and in fact the password manager as an supported passkey authenticator allows you do the same
> Passkeys are amazing. They’re basically magic to the average person.
Passkeys are crap. They are just random password prompts to give a false sense of security.
> My irritation is that I know what it is, and I've said no thanks many times, but I'm still asked regularly by the likes of Amazon
The people responsible show a distinct lack of understanding when it comes to consent.
Silicon Valley has no concept of consent and boundaries. If computing was a night club, "Silicon Valley" is the guy who goes up to every woman saying "Want to dance? [Yes or Maybe Later]?"
I don't think you carried on the analogy far enough.
>Want to dance? [Yes or Maybe Later]?, also drink this [Yes]"
A better analogy would be slipping something into her drink whilst handing her a 12-page stapled terms of service agreement in which she unknowingly gives full consent.
Meta: As you see the anal box as already been checked with unerasable ink.
> The biggest problem, though, is how users are pushed into it without any warning or knowledge of what they're signing up for.
Gf just logged in to hotmail without knowing her password because of a popup. I tried to explain but there was no understanding to be had.
This is how the world works. You either understand it or suffer it unknowingly.
Amazon and PayPal are horrible for this. Clicking out of the dialogs and modals to actually get logged in? (Shout out to PayPal for a dark pattern that implies "continue to login" but is actually "continue to set up PassKeys", and you actually need to "cancel" to actually login).
> by the likes of Amazon, and they usually pick a time when I'm trying to order something quick
they have an algorithm that can predict the likeliest moment you'll not see or panic-hit the "ok" button in haste
I think it is simpler than that: they ask irritatingly often, and I'm often looking quickly to see if I can get something on next-day delivery, so the two factors coincide.
"if companies are trying to nag me into something I very much doubt the main benefit is mine."
Bingo.
Amazon does benefit from increased account security; they don't have to refund non-fraudulent orders after all. For most people, a passkey is genuinely more secure.
What about availability? The article is precisely about that.
My MIL setup a passkey accidentally on her Google account and now has no idea where it is. Removing it now requires her password which she’s also forgotten. But now for some reason on Google I can’t initiate any type of forgot your password flow because of how Google sets up things and I have zero clue where she stored the passkey.
Ran into the same issue with my dad the other day. Has a passkey set up on his Google account. Bear in mind that he doesn’t know what a passkey is, so Google obviously sent him through a pattern at one point to get him to create one.
He didn’t have access to it the other day and we needed access to his account. He didn’t remember his password, and we were unable to reset it because you need the passkey! No other options to authenticate for a reset were available.
Add in the fact that I was trying to help him with this by long distance call and you can imagine the frustration.
As someone with elderly parents, the Googles and the Microsofts of the world really don't seem to give a shit about the elderly anymore, if they ever did. Random UI updates and workflow changes with no announcements, thinking they're "intuitive."
One of these days the product managers who push these things thinking "oh, it's easy, you just . . ." are either going to be explaining it to confused Mom or Dad, or they're going to be elderly and irritated themselves. Until then I hope they stub their toe or step on random Legos regularly.
I'm not even elderly but I would really like an e-mail client with a stable UI. I used to like Apple Mail but it's been a buggy mess since Catalina. It doesn't even sort or search mail reliably any more. It's basically a trope at this point but a robot-rewrite-in-Rust seems inevitable at this point.
A while ago I helped an elderly relative migrate off off a copy of Eudora that they'd been using for many years. (To Thunderbird.)
Originally it was about difficulty migrating to a new laptop with a different version of Windows, but I was quite firm about it because when I realized it wasn't able to do secure connections for some reason, so the instant they took their laptop to public Wi-Fi...
P.S.: Migrating decades of local messages was a huge problem. It's been so long that many import/export tools are defunct. I was even loading up extremely old versions of Thunderbird to see if I could import to that and then upgrade.
However the GitHub edition (not Sourceforge) of Eudora2Unix [0] saved me and deserves a shout-out here.
It took some tweaks and a harness to repeatedly try the conversion, since I wanted something I could literally drop into the Thunderbird profile folder. The final result wasn't perfect, (some file attachment issues linger) but it's way better than having it all at risk of Eudora.exe just refusing to launch one day.
[0] https://github.com/jonabbey/eudora2unix
>He didn’t remember his password, and we were unable to reset it because you need the passkey! No other options to authenticate for a reset were available.
Google treats both a password and a passkey as a primary factor, and if you forget either of them you have to go through their account recovery flow: https://support.google.com/accounts/answer/7682439?hl=en
AFAIK there's nothing different about the recovery scenario for a Google account in that state regardless of whether it has a password in use as its primary cred, a passkey in use as primary credential, or both.
Thanks. Upon further investigation we could have hit “Try another way” on the account recovery process UI a few times to get to a workable account recovery method.
Would be nice if Google would lay your recovery options out for you (which I am used to it doing in regard to 2FA if you are doing a regular log in) instead of having to hammer the “Try another way” link repeatedly as it cycles through options.
WDYM -- I thought "try another way" is supposed to list all possible options instead of cycling through them!
It does when I log in. You click "Try another way" and then it brings up a menu of options you have for 2FA. For some reason they have designed the account recovery flow to be different.
So, if you are used to the "Try another way" flow on login, it can be confusing to see an entirely different "Try another way" flow on account recovery.
I set my father (late 70s) up with a physical passkey (yubikey), and a backup key. He uses it for the important accounts (google, apple, bank, etc).
It’s been fine.
Yubikeys generally have much worse recovery scenarios than passkeys do, for consumers. In enterprise if you lose your yubikey, an IT admin can help you get back into your account. If you lose a security key as a consumer, you're generally in a much tougher account recovery situation.
You need extra backup keys in a safe place. They don’t explain that well.
Not all services let you enroll multiple keys. Amazon, with all the money in the world, was guilty of this for a long time.
Practically, it is a huge challenge. I would want my day to day fob, an onsite backup, and an offsite backup. That’s a lot of hassle and potential for mistakes. To even register the offsite backup means I need access to it. Remotely copying a password database is so much reliable
If you use a security key only for the most important accounts like Apple or Google, keys are set up once and then unchanged for years.
This is why I've always been a fan of these. They are easy for laypeople to understand.
Yep, I've never had Google, PayPal, or Amazon ask me about a passkey with a yubikey.
The current ones are passkeys
Doesn't the passkey have to be on her phone or computer?
It should be but haven’t checked her apple vault. I checked Google password manager and her windows password manager and there nothing in either. She might have used her phone and it’s in her iOS vault which I’ll check next. But this is what makes this entire passkey thing a mess. She’s 75, she didn’t do this on purpose and the ecosystem is just a mess
Everything about it is.
Also in the process of helping my dad with his phone, 76 and my grandmother 99. Maybe this works better with Apple, but the biggest problem on Android is, that it feels like every update shuffles everything around. Allmost no point in explaining, that they can solve some things on their own.
And all the time new things on the screen, new features they don't understand, need nor asked for.
Im young and I dont even bother learning how to use my Android phone's new features since it feels like everything moves or changes all the time. there's no point trying to get familiar with most of the features.
That's because most people at Google use iPhones as their primary phones, they hardly know or care about the UX
if any android pms or execs read this comment, it should be like a slap in the face. a scathing indictment of the state of their product.
just hang their heads in shame and walk into the sea
We're at a point where the biggest possible contribution to humanity of many PMs in big corps would be to just... drop dead. Feature-freeze rather than furthering the enshittification, as that seems all they're capable of.
I'd wish the world would just become boring again.
They’d just hire more to replace them and keep chaos machine running
Apple does seem to have one of the best and most secure passkey implementations.
A little snarky, but...
It _is_ true that it's more secure when even the people that the passkey was created for can't use it.
They seem unnecessarily opaque about it all.
I just made one for PayPal using my MacBook which seems to have ended up in Bitwarden rather than the mac thing. But there's nothing in Bitwarden to say list all passkeys. Not sure how I check elsewhere. Maybe they should email you "you have created a paypal passkey in Tim's Bitwarden" or something. Then at least you could search the email for "passkey"?
I wonder if I can use Bitwarden on another device with that? I honestly don't know.
You can't search for passkeys, but you can search for logins by URL and check the much shorter list for passkeys. The good news is that having the passkey in Bitwarden means you can use it on another device.
Even the concept of "where on the PC" has been totally annihilated by OS vendors and app developers. Is it on the filesystem? Is it on The Cloud? Is it vaguely "In An App"? Is it in some "Secure Enclave"? Who the fuck knows anymore? And the apps are no help--they insist on blurring the lines between local and cloud, hiding full paths, and generally just saying "Don't worry about where your data actually is. We pinky swear to be able to find it for you!"
Windows prompting her about Bluetooth for the pass key threw me too. I thought for sure she had clicked the wrong thing before I realized that somehow her widows pass key requires communicating to some device? Maybe her phone? No idea
I know on my Windows if I sign into icloud.com I have the option of using a passkey which I do by scanning a picture with my iPhone and it also using Bluetooth, presumably to prove physical presence of it.
No, it doesn't have to be associated with the phone, and IMO you are better off not letting the big tech companies own your identity, which is effectively getting Apple or Google to store it in your phone for you ends up being. There are physical passkeys that feel like a door key in everyday use. You can attach them to your house key ring, and like house keys are near indestructible. Lookup the Yubikey 5 NFC.
The only downside is unlike a house key, you can't get a backup "cut". Copying a physical passkey currently isn't possible. If you lose it, you've lost access to all your logins. As the article says, their recommended workaround is to keep backup physical passkeys, and log all your passkeys (including the backups) into every site. Which is insane - very few people have the patience to do that.
The article is really a long rant about that one issue - there is currently no way to securely backup a physical passkey. Solve that, and all the other issues melt away.
Who the fuck knows?
I for sure don't. Websites only know there is a passkey associated with my account, and the OS only knows there might be one on the device, or maybe on another device, and offers me options to check here or do a Bluetooth/QR Code dance, and when all of them fail, I'm no closer to knowing where the damn passkey is.
I had to mess with this just yesterday.
I got a new cell phone and installed Microsoft Swiftkey and tried to login to Microsoft. It said my device's password or security manager would popup, but it never did and it never showed an option to login via password, just a mostly blank screen. I tried logging in from my laptop browser and it immediately tried using a passkey, but I've never created a passkey for Microsoft, so it errored out, still never showing an option for password login. I tried again and it errored out again and FINALLY showed the option to login via password. It had to fail 2 times to finally show the option for password login.
I was finally able to login via password, then had to go to Microsoft's passkey management page to create a new passkey, store it in 1password, and use that on my phone.
I'm a software engineer and it was annoying and time consuming and took a minute to figure out. How are non engineers supposed to even use this crap?
It's gotten to the point where I assume "product manager" is a synonym for "incompetent person who breaks working products."
> how do I log in on a device that I don't own?
This is solved by passkey-implementing software and devices (with Bluetooth) allowing you to log in with a QR code (Webauthn via CTAP hybrid transport). iOS and Android support this, and it’s generally not a locked-down thing if other devices wanted to do it too.
The only use case left is in “how do I login if all my devices are stolen/fall into a body of water” in which there really isn’t an answer beyond “get (a|your) device back, sign back into your password manager, use that to get back into critical accounts”.
What if the computer you want to log in on doesn't have Bluetooth? Probably most public computers (like ones in libraries) don't have it.
The website should display a qr code you can scan with your phone that allows you to then login, unfortunately a lot of sites don't implement this, and some don't implement backup codes. This isn't the fault of passkeys per se, but of poor implementations.
> The website should display a qr code you can scan with your phone that allows you to then login...
A malicious website can display a QR code too. I think this "feature" could cause some of the security issues that passkesys were intended to solve.
I use Keepass and the free tier of Dropbox, to keep my passwords strong and available across multiple devices. (Dropbox not required, you can store the database on a thumb drive.) Backups are no problem.
Keepass (or KeepassXC) stores other data as well, including the correct URLs for sites. So my workflow is simply to click the URL from within Keepass, copy the username and password, and paste them into the login screen. So easy even an adult can do it! (Humor attempt)
For convenience, Keepass database can be unlocked with either a password or biometrics (your fingerprint).
(Not affiliated with Keepass, just a happy longtime user.)
That QR code from a malicious website will not actually communicate with the malicious website with authentication from the correct origin, most QR code phishing scams do not actually use passkeys but rather fall back to trying to get the user's fallback login information (if any). By spec, if the domain does not perfectly match the domain where the passkey was originally created, the phone (or passkey provider) will fail to find a matching passkey. And the domain is derived, not provided by the QR code data (it's all in the spec).
Basically, it's very hard if not basically impossible to spoof a QR code to access the real passkey via a malicious site. (caveat, without already having compromised something like the user's DNS, maybe? Even then the site would likely fail the cryptographic checks.)
Yes, the passkey flow QR code contains a public key, and a local key exchange is done over bluetooth to prove proximity. That is used to set up a confidential channel.
That means attackers need more than to display a QR code, they also need a local presence (radio).
The phishing protections of passkeys also works against "malicious QR codes". Which is a great example of why passkeys are kind of good, you stop needing to worry about a lot of attacks.
The fact that nearly every passkey implementation is lacking in a variety of very impactful ways... is a very good reason to _not_ use passkeys.
When every passkey interaction is a different variety of user interaction nightmare, it's not very convincing that it's a good idea in the first place
They're talking about a web-based QR code solution separate from passkeys.
Passkey QR codes are only WebAuthn via CTAP hybrid transport (with BLE verified proximity)
How does scanning the barcode with your phone log you into the computer? Does your phone need network access for that?
Steam does this. If I want to login, it shows a barcode I can scan with the app and it logs me in without needing to enter my login information. Phone needs internet access, doesn't need to be on the same network as the device I'm logging in on.
I assume the QR code contains a token for the device, which is used by the app to authorize the login and the server automatically logs in the client on the device with the matching token.
Seems a lot safer to me than using my login credentials on a potentially unsafe device.
Yes, this is how it could work, or it could display a code you type into your phone.
There's a whole set of fallbacks built in to the standard, including Bluetooth, local network connections, and going via a relay server. All of them eventually end up with your device signing something and handing that back to the browser on the other device to complete the authentication flow.
Is this why I keep getting notifications that such-and-such a website wants access to devices on my local network? I've been denying those left and right lately and didn't understand what on earth they needed access to that for.
Android 17? If yes, then that's because they added a new permission specifically to block apps from LAN access, then bundled it together with "nearby devices" (one introduced earlier specifically to block Bluetooth and WiFi scanning and point-to-point connections) because apparently they believe the concept of "local network" is too difficult for normies to understand or something - and due to how it's implemented, even apps trying to talk via loopback with themselves get captured in scope, too. The UI won't tell you which is which, though.
That's likely Google's implementation of Local Network Access (https://wicg.github.io/local-network-access/).
The browser delegates passkey plumbing up to the core platform typically, so it already should have the appropriate permissions.
I cannot speak to how accurate your description is, but this description sounds like there are multiple weak points and multiple attack vectors that open this up to increased risk of compromise, undermining the very security stance it's supposed to provide.
See my response above... I believe the description is incorrect, and bluetooth is required to prove physical proximity.
The spec is quite thorough and well thought out in this regard. Despite what it "sounds like" when described, it is very secure, even with a variety of implementations. What is far weaker is that most sites that offer passkeys also offer a multitude of fallback recovery options.
AFAIK, the "scan this QR code" method of signing in with a passkey on a phone on a device w/o the passkey requires Bluetooth. There's some type of handshaking that goes on in order for you to prove you're in physical proximity of the device you are logging in on, to prevent phishing attacks.
Since I might have made someone mad... to clarify, as I understand it, Bluetooth is absolutely required for this "Scan the QR code" flow to work. However, it's also possible the actual authentication traffic to travel over a different pathway (wifi, cellular), but the bluetooth part is always required though to prove proximity. So on e.g. a library computer without Bluetooth enabled, you would not be able to log in with a passkey on your phone.
Right - you can treat the protocol as having:
1. Initiation (QR code, NFC in draft)
2. (Proximal) negotiation (BLE key exchange)
3. Communication (over websockets or a direct L2CAP channel)
The challenge is that a devices without bluetooth (at least today) don't have another common way to wirelessly judge proximity. A desktop/laptop without bluetooth likely either doesn't have NFC, or has bluetooth disabled by policy and would likely have cross-device passkeys disabled by policy as well.
If you're not happy connecting your phone to the network, then how likely is it that you would you be willing to enter your login details on a machine you don't control?
What if you just can't have internet on your phone? Like if the computer is connected via Ethernet and there's no wifi network you can connect to? What if you're abroad and have no roaming? And the ultimate question about a person that the modern world can barely conceptualize - what if you have a dumbphone? Or what if your smartphone is lost or stolen or dead and you need to access some account? That last one has happened to me, and I sure am glad I know the key passwords that I need for survival.
These may seem like nitpicks, but there's probably a thousand rare scenarios like these that exist. You inevitably have to consider them when you're moving from punching in letters and numbers that you remember in the normal, low-tech way to a complex networked two-device workflow.
I think there exists a vein of contempt for anyone not fully embracing our bold new world, so many implementers etc. get the double bonus of alienating and frustrating all of the non conformers
If my phone is lost or damaged, I would buy a new, cheap Android phone and sync my passkeys to it. But I am curious why one would need to login to a website in order to survive? If one did have say a severe medical condition that somehow required a website in order to manage, I guess I would concede that maybe passkeys aren't the best way to secure such a life-sustaining website.
> But I am curious why one would need to login to a website in order to survive?
They use bank like Ally or Discover with no physical branches.
They use a mortgage provider like Rocket mortgage with no physical branches.
They use a medication delivery service with no physical customer facing pharmacies.
They have an employer that only facilitates reimbursement for expenses via online tools.
etc...
I guess "survive" has a sliding scale, but if I lost access to critical accounts... my life is going to FUCKING SUCK in a non-trivial and very impactful way almost immediately, on many fronts.
And if your answer to that problem is "well, just call them"... then we're right back to the point the article is making: "An account’s security is still dictated by the weakest recovery method"
Passkeys aren't a meaningful improvement in security - assuming you do actually have decent password hygiene like a password manager.
If your phone is lost, how are you going to sync your passkeys to your new cheap android? In a passkey-only future, you cannot login to your Gmail account without your passkey, which is only on your phone, which you've now just lost.
What am I missing? Either we retain passwords as backup for a lost or stolen device - in which case, all the security concerns are still there - or we only use passkeys, in which case we've added a clear nonrecoverable point of failure in the system.
What confuses me is that for a long while we told people to not write their passwords on a sticky note, to not write them in plain text somewhere.
Then we introduce all these "security" mechanisms that make it literally impossible to recover an account without backup codes.
Where do you store the backup codes? The average person, if they store it at all, will store it on a plain text file or in a sticky note.
Except that this creates a much more brittle system. Systems are safe when they are routinely tested/used. If you routinely have to enter your password, you are aware you need it. If you don't need your password, and you never have to enter your backup codes, you won't feel the importance of them until you actually need them.
It's the whole "I have backups" vs. "the backups actually work" problem except it's pushed onto the users who have zero technical knowledge.
FWIW my break-the-glass actual use of backup codes is for access to my password manager.
Everything else which has ever given me a backup code... gets stored in a secure note in my password manager.
It is just another knowledge-based factor. It is one that they are reasonably sure you aren't spreading around the internet. It is one that the site gets to pick rather than the user. But in reality, they are a often just a way to try to reduce some support and identity verification costs.
The path to get to the password manager is the case where the backup codes truly matter, because without them there may not be a way for support to restore access. Those codes may be your only way of regaining the master encryption key.
But that also winds up being part of the trade-off of security vs user friendliness. Some password managers are way easier to get back into.
Doesn't being able to sync your passkeys by entering your conventional password somewhere eliminate the whole point of passkeys? It just shifts the point where you can enter the password to recover your data to a less convenient place. And if your entire stack is passkey-protected (which I'm pretty sure is the case most of the time) then the secondary phone won't do anything for you.
When I said "survival", I meant it in the "being able to make do with few resources in a time of crisis" way, not that you will literally die if you can't access an account. Losing a crucial device without a fallback of being able to log in somewhere else quickly can mean immediately losing access to payments (the most crippling, especially if you're not home), being stranded in an airport or even not having an identity document (in countries with digital ID systems). Any of these happening can lead to enormous losses in time, money or worse, depending on when and where this event hits you.
Passkeys can exist on devices other than phones, so your entire premise is moot.
What? Did you read the thread? I never said passkeys can only exist on phones. The whole conversation is about "how do I log on with passkeys if something happens to my trusted device?". The parent comments talked about just using your phone, I'm saying there's lots of situations where someone might not have access to either a phone or an internet connection for it. And when this happens, you really don't want to be left without a way to access all vital digital services.
> I'm saying there's lots of situations where someone might not have access to either a phone or an internet connection for it. And when this happens, you really don't want to be left without a way to access all vital digital services.
And when that happens I'm usually glad my credential is a passkey on my keyring, as chances are if I don't have my phone and I haven't auth'd on to some computer I almost certainly don't have access to my password vault. But hey, my passkey works just fine without my phone. And I can trust that once I unplug my authenticator and log out of that session, there's no long lasting credentials left behind. I don't get that with passwords.
Aren't passkeys great?
You go to country X (USA sounds good to put in here).
You get mugged.
They take your phone and keyring.
They can't do anything with it since it's locked, but you don't have it.
Aren't passkeys great?
Wouldn't I have the same problem with passwords? I would lose my phone and be unable to two factor log in to my Gmail account or bank from someone else's device?
With passwords? No.
With 2FA? Yes. 2FA is almost just as stupid and almost just as bad for regular users as passkeys are, but it got adopted due to historical loophole - by far the most popular form was TOTP delivered via SMS, then "authenticator" apps, both of which keep the code transferable - you can receive it on one device, transfer to yourself or someone else (which is a feature, not a bug) via any channel, and get it to work. Passkeys were created specifically to close that loophole.
Plus, SMS didn't allow for vendor lock-in, which is arguably why they're so hated in security circles (SIM-jacking is real, but doesn't scale anywhere near enough to warrant deprecating it as mechanism for regular users).
I have over 2,000 accounts. The majority of them have unique passwords. I can count the services that have passwords that I know on one hand, with quite a few spare fingers.
Passwords just don't provide a broad recoverability benefit once you commit to doing strong, unique passwords.
> Passkeys were created specifically to close that loophole.
Credential sharing? I have a family share with passwords and passkeys in it. Passkeys most certainly didn't stop this.
They did add friction to having a user being duped to share their password to someone claiming to be tech support, since you can no longer request plaintext secrets be sent over arbitrary channels.
> Plus, SMS didn't allow for vendor lock-in, which is arguably why they're so hated in security circles (SIM-jacking is real, but doesn't scale anywhere near enough to warrant deprecating it as mechanism for regular users).
SMS is an ugly user experience and more importantly is expensive. Now a lot of services do emailed codes when they don't have a regulatory reason to require SMS - an even worse user experience, but less expensive.
We have authenticator apps which use a standard OATH setup, and quite a few platforms which have integrated support to try to sand over the worst part of the UX. Unfortunately they just didn't become popular, and OATH fails the same regulatory requirements that emailed codes fail.
Passkeys are not meant to have a vendor lock-in story. Credential exchange allows for credentials stored in consumer credential managers to be imported into another credential managers. The platforms have added infrastructure specifically to make this easier for users.
The exceptions are when enterprises run their own passkey stores, or when the user explicitly picks a solution that doesn't allow export (like a physical Yubikey).
"SMS is an ugly user experience"
No, it's fine. Most common example, I log in to my bank, they send an SMS, I copy the code and paste it into the web site. Works fine and I don't have to pick up my stupid phone, like I would if I used an authenticator app instead.
"and more importantly is expensive."
Not for me. The bank made several billion dollars last quarter, don't think it's a big problem for them, either.
A passkey or a 2FA requiring a non-trivial device are functionally equivalent. Passkeys and app driven 2FA are the same when shit goes bad.
They can’t do anything with it
I have a backup key at home
Mission accomplished
But the problem is that you can't really backup passkeys and because people are frankly frequent tricked into using them, they have no good recovery options.
I know plenty of people who only have a phone, no other devices. They don't backup that phone, they should but they don't. They don't use a password manager either, maybe they should, but they don't.
My issue with passkeys are that they are designed for a reality that don't exist, or at least only exists for people who are already doing a lot to secure their devices.
> But the problem is that you can't really backup passkeys
The individual passkey? Maybe not. But I don't really need to backup the passkey, I can just have backup passkeys or other backup authenticators, including complicated stored one-time passwords.
To answer your earlier hypothetical, I'm out traveling and I'm mugged. Well, hopefully, I'm not mugged in the part of the travels where I'm carrying truly everything at the moment, and I can just go back to the hotel room and re-auth with a device I saved there Problem solved, no big deal. If I lost truly everything while I'm out, I'd do as suggested elsewhere here and call home to get a trusted friend/family member to read me off the one time password saved at home or whatever, or figure out some way to get me money to get home. Chances are I'll end up having to work with the embassy anyway.
> My issue with passkeys are that they are designed for a reality that don't exist
The reality of passwords being hijacked is absolutely a reality of today and is a constant issue for tons of people.
> I know plenty of people who only have a phone, no other devices.
And I really don't get why we can't also teach these people to also have a little token they use that can also be a part of their online identity. And sure, for certain kinds of accounts have appropriate levels of recoverability, but for the normal authentication workflows its so much better in so many ways.
At this exact same level I posted this.
>They are designed for a wealthy technologically inclined user with a very stable lifestyle and trusted resources and connections to other people. You know, the exact people who developed them.
And here you go posting
> I'd do as suggested elsewhere here and call home to get a trusted friend/family member to read me off the one time password saved at home or whateve
If you read what I posted you see why you live at a particular place of privileged and are seemingly incapable of putting yourself in another persons position where these things do not hold true.
"If you are a white male earning over 100,000 a year in a stable relationship with living family members, excess savings in the bank, in a stable first world country everything is going to be fine and the rest of you can get fucked" --what you keep repeating in different ways.
I agree every kind of account should have a reasonable level of recovery process in place.
Also, you're posting incredibly racist and sexist statements here. Why does race and gender matter here?
Stop being racist.
I mean I was pointing out that you were being racist and sexist from a position of privilege without realizing you were doing so. A kind of systematic failure caused by not realizing our choices as developers has real world impacts on the less privileged.
You're being racist and sexist by assuming wealthy westerners or those in stable relationships or those being able to call home to family are white males. If that's not racist I don't know what is. I don't think it takes being a white male to be able to call home to family when traveling internationally. You're assuming a point of view is invalid due to someone's race and gender.
Quit being racist and projecting identities on people.
This is about people who would have a hard time recovering digital identities. I imagine there were lots of white males fleeing war in Europe who probably struggled to get access to accounts backed with things like passkeys and other forms of 2FA. But I guess to you their struggles don't matter.
Its almost like you including gender and race was just your own projections of your own hatred for a particular group. You should probably think about things when painting people with such a wide brush of "white males" when trying to paint people in a derogatory fashion.
I spent a chunk of my life homeless. Don't project some identity on me that's not valid, or that I just totally lack some perspective due to your assumption of my race or gender. Its not a fair thing to do, its literally racist and sexist.
You could have tried to make your point without throwing in racist and sexist comments by just saying "wealthy western software developers" or whatever.
> designed for a reality that don't exist
They are designed for a wealthy technologically inclined user with a very stable lifestyle and trusted resources and connections to other people. You know, the exact people who developed them.
Do you have a plan for getting home without access to any of your accounts? And one of the problems with passkeys is that it's unreasonably difficult to keep a backup key.
You're asking way too much foresight in this thread I guess. There are some people who have lived lives without any series of unfortunate events, they can't even imagine what the world can serve up.
If nearby (some country) any credit card or even my ID card will get me home. I can walk into a branch of my bank and - with some waiting and paper work - I should be able to get enough cash to get myself home.
Abroad I’d head to the nearest consulate of my home country. Might be difficult to get to if it’s in a far away city. Hard to prepare for abstractly.
I've done a mock "what if I wake up naked in Tokyo" for my own recovery several times, mostly because I keep things really tied down.
I have not yet done an actual test within Japan, however.
Great, now I just need to get back home to use my uncompromised accounts (which would have still been protected by my device as long as the thieves aren't NSO Group, but whatever). Gee, it seems my tickets back home were taken with my stolen phone! Not to worry, they sent me an email confirmation, so all I need to do is log into my passkey-protected email on my friend's phone and have them download my ticket in addition to theirs, or print them at a public computer. Oh wait
As long as you still have your passport, which you’d need for international travel anyway, you can get your boarding pass at the airport without any hassle.
Poor people exist.
The poorest country I'm familiar with is Zambia, where about 90% of the population have a mobile subscription.
The number of people sharing GP's concerns for reasons of poverty rather than because of their personal security posture will be vanishingly small.
> The poorest country I'm familiar with is Zambia, where about 90% of the population have a mobile subscription.
Only 85%¹ of the population are over the age of 4. Smart kids they've got.
¹ https://populationpyramids.org/zambia
They still exist, though. And in my experience people in vulnerable positions have somewhere between zero and one phones at any given time, without necessarily any good continuity between them.
I don't think "fuck 10% of the population" is as strong an argument as you seem to think it is.
I'll have to remember this one the next time I hear the phone/poverty argument made in bad faith.
> willing to enter your login details on a machine you don't control?
Are you talking about your phone here?
Sure, your personal security posture might very well preclude that.
But, again, if you don't trust your phone then how likely is it that you will be prepared to trust a public computer?
what good is a phone if it isn't on a network?
Have you ever been in a large building with awful cell reception and no wifi access?
> what good is a phone if it isn't on a network?
1. It might be on a voice network but not on a data network; for instance, if you don't have a data plan.
2. Modern smartphones are actually a hybrid of a traditional cell phone and a traditional PDA, and you might be using it for the PDA part.
That's still a terrible solution. Plenty of people don't have phones that can do that, or dont have e it with them when they do etc..
My suggestion would be to not do that. But keep a password and an offline TOTP app if you must. It’s still an option.
Only if they’re a bit old. Nowadays WiFi chips double as Bluetooth chips on newer platforms.
Only if they’re a bit old. Nowadays WiFi chips double as Bluetooth chips on newer platforms.
That's a technocratic reply, not one that is useful in the real world.
As noted by the person you're replying to, it's not his computer. It's a public library.
Most computers in non-residential settings will have various features locked down, including Bluetooth.
Hotels, clubs, airport lounges, various government facilities… there are thousands of places where you might really need to use a computer but don't control the technology.
> > What if the computer you want to log in on doesn't have Bluetooth?
> Only if they’re a bit old. Nowadays WiFi chips double as Bluetooth chips on newer platforms.
What if the computer you want to log in on doesn't have a WiFi chip?
It doesn't have to be an old computer; for instance, the desktop computer I built last year uses a wired gigabit Ethernet connection to the router right next to it, and doesn't have (or need) any WiFi or Bluetooth chip.
The computer I just replaced had neither wifi nor bluetooth. It was a desktop device and had no use for either.
>This is solved by passkey-implementing software and devices (with Bluetooth) allowing you to log in with a QR code (Webauthn via CTAP hybrid transport).
Ok but how do I share my Netflix or Spotify accounts for example with those?
The same way you share them now: sharing the account name and password and doing whatever you currently do to deal with any 2FA they occasionally toss in.
If they also allow passkeys as an alternative form of login that doesn't need 2FA you can use those to make the account sharing more secure.
When setting up sharing with someone first change the password to something else, and then share the account name and password. After they log in the can add a passkey to the account on their device or devices.
Then you can change the password back to your real password. When they want to use the account they login with their passkey.
If the service doesn't accept login passkeys but does allows passkeys for 2FA, you have to use real password sharing, but at least they can have a passkey for 2FA which may be easier than how you know handle 2FA.
How do people handle 2FA with account sharing? If the site uses TOTP you can give them the QR code that you received back when you made the account (you do save a screenshot of such QR codes for backup, right?).
But how do you handle SMS 2FA, which seems to be far more commonly offered than TOTP?
For email 2FA I suppose you could set up a filter on your incoming mail that forwards any incoming code emails to the people you shared with, and hope that the time limit on the code is long enough for this to work.
2FA is lowkey designed to reduce paid account sharing. It's always those services that are so eager to get people 2FA'd. Microsoft Minecraft account is the hardest thing to log into, and they even perma locked tons of people out.
Can't you just share the TOTP secret key?
TOTP is unfamiliar or hard to use for most people, so they use SMS. Most sites don't support TOTP either.
Even if you use TOTP, it's not designed to be shared, for example look up what hoops you need to jump through to export a single TOTP code in Google Authenticator. And they used to not even have that option; they told you to set up multiple TOTP codes on each website instead. Even on 1password I had to look up a tutorial on how to import a TOTP code cause the menu is in a very non-obvious and deep spot.
I've shared with non-tech people a few accesses with TOTP codes and it's just a WhatsApp message away "hey dad, enter 12345 when asked".
Code is different from key. The secret key is how he can get new codes without you having to deal with it every time he logs in.
In general you shouldn’t - Netflix[0] really should get proper invite-based family sharing, and Spotify’s subscriber agreement has a section that defines Premium as a “Single-user Paid Subscription” and thus can’t be used by multiple people, legally (and you might be at risk of getting banned if they detect it)
However, passkeys can and are available to be shared via password managers. They’re not locked to the secure chip on the device where they live usually. iOS’ Passwords app has a share button and 1Password lets you share passkey-containing items.
In fact, the QR code login feature makes it even easier to do a one-time sign in to your account for a friend, if you don’t want them to be able to login to your account indefinitely.
0: Netflix doesn’t support passkeys because their main audience is people signing in via smart TVs and whatnot, which largely don’t support CTAP or Webauthn in general)
>In general you shouldn’
Me to said companies: I will do what I want.
Said companies to you: sounds like what you want is to get booted from our service.
Me: Invents more new ways of being problematic for the company spreading the ideas to millions of others decreasing their profitability to almost nothing.
Me to company: Damn, guess you shouldn't have been an asshole about it, kind of backfired on you.
The responsible product owners will already have bounced 18 months prior after tweaking the stats to falsify the customer satisfaction rate and grabbing their bonus on the way out.
Ok so when is Netflix going unprofitable?
What if my phone is dead? Stolen?
In the same vein as 2fa, going up to a fresh computer and trying to log into anything is now a nightmare. Every service has a 2fa that somehow loops into another provider that also has 2fa.
And some 2fa, if not many, make accounts weaker. Apple's solution to get around 2fa is to put in SOMEBODY ELSES phone number that I trust, as a backdoor. It's an insane solution. And its normalized, and nobody questions it.
While we're at it, the insanity of those "recovery questions", made even worse when many companies demand the same ones.
but you can type anything in the recovery box.
its just three additional passwords.
should you type the same brother name in each time? should you even answer with a name?
don't get me wrong, they were insane, but they can be repurposed.
Good luck remembering what you put there when asked 10 years later.
Yeah, many do not even allow you to enter in a custom question, which would be marginally better--at least for users who care about security.
Then you'd have the option to craft a question which is (A) personally memorable (B) specifically phrased to avoid ambiguity, (C) not public or guessable, and (D) unique to a service.
* "Where is your first pet buried?"
* "While on vacation, The Noodle Incident happened in which city?"
* In what year did you first see Example Band live in concert along with Alice and Bob?"
put it in your password manager?
Awesome. I'll just find the thief and ask nicely, shall I?
Sign in with a QR code is dangerous though because at that point theres very little stopping QR phishing and forwarding the bluetooth request to your browser. See the most common Discord scam.
> forwarding the bluetooth request to your browser.
This isn't a thing. Discord's QR Code scanning is entirely a feature they made unrelated to passkeys or bluetooth. Passkey auth using a QR code has a step that verifies the proximity of both devices using BLE.
Passkey on NFC/USB hardware token (x2)
They're cheap enough if you lose one it's not the end of the world. Goes on your keyring. Doesn't require esim management. Use NFC swipe/usb-plug-in + pin to use.
The problem with hardware tokens is that they 1) Only store a limited number of logins, 2) It is very difficult to keep them in sync- every time you need to add a passkey, you have to get them both out, which makes it difficult to keep one a in a secure safe to keep it safe from damage/loss
This two fatal flaws are what limits their usefulness to enterprise SSO and perhaps some other limited uses where the organization has the ability to replace tokens. (Even in a distributed enterprise, enterprise SSO may not be a good fit for hardware tokens, if they can't get replacements out to employees fast enough).
> the problem with hardware tokens is that they 1) Only store a limited number of logins,
1) It's one passkey used over and over, so it only takes 1 slot.
> 2) It is very difficult to keep them in sync- every time you need to add a passkey, you have to get them both out, which makes it difficult to keep one a in a secure safe to keep it safe from damage/loss
2) With SSO used across enterprise exactly like you're talking about, works fine without having to reregister over and over. Been using this and have implemented it myself for years.
3) much cheaper than a phone with a much cheaper recovery path
4) no path is a free lunch, you're always going to be making compromises somewhere, it's the nature of security - it is adversarial
> it's the nature of security - it is adversarial
Yes, this is the issue. People don't like how adversarial security people act, and how they force things onto people. It's fine if a corporation wants to have some internal policy since they're the ones eating the cost if an employee can't work or whatever. Less so if individuals are forced into these wonky setups for no benefit. e.g. now I have to run and maintain and backup a Vaultwarden server just to log into my HSA, which is absurd (I also have to keep an old version of the bitwarden extension around and use that because the latest requires TLS, which is another piece of infrastructure that I don't want). My password manager already generated random site-specific passwords. And for some unknown reason, browsers didn't start with the obvious step of software passkey support in password managers, and then allow hardware keys for the nerds that want that.
Oh, right, because it's actually a lock-in play, and it's designed to be unusable unless you tie your entire life to Google or Apple's cloud platform.
The problem isn't the cost of replacing it, the problem is - how do you log in when all your passkey-bearing devices just got flushed down the toilet?
How is that different from accidentally deleting your keepass database? Or forgetting your password? I think it’d be easier for me to forget than find myself trying to flush all my hw tokens…
I can back up my keepass database, and I can write down my passwords.
I can back up my FIDO2 (non-)resident keys too. In the end it's just a piece of HW with some secret material inside. non-resident FIDO2 keys are easier to back up, because the master secret seed is fixed and shared for all origins and there's nothing stored on the key.
Same way. A majority generally have a old phone that was already signed in to google. Or if they remember only Apple ID and password (one very difficult password) + sms. They can login on to a new phone.
Everything is SYNCED immediately.
What if you have a ransomeware that destroy everything on the same day your house and all backups burn down. And you cant get it from immutable backups as you wrote that decryption key in paper. And the bank will not allow you to access it as the govt deported you elsewhere.
I can get another hw key (if one of mine breaks, which I, surprisingly enough, have not yet managed to achieve)
And since I have at least two at all times, the possibility of one of them breaking changes… not much really.
Paper can burn or get tossed, backups files can go corrupt, and I really don't understand what is that extra risk hw keys introduce…
There is at least one valid (in my opinion) reason to not like hw keys though: they cost real money to acquire, so you probably want an extra margin in your budget for the unlikely case they indeed decide to break.
You have more than one key right?
Also... Is flushing your whole keys down the toilet a problem you run into often?
> Also... Is flushing your whole keys down the toilet a problem you run into often?
It's a potential catastrophe I'd like to avoid if possible, but the catastrophe is not inherent to any other key I have.
House key: Make new copy for 10 USD. Alternatively, get a locksmith to unlock the door and change the lock. Even more alternatively, break a window or door. I still get into my house.
Car key: Make a new copy for >10 USD. Alternatively, call roadside assistance and get them to tow me somewhere I can get a new key. More inconvenient, still very possible.
TOTP 2FA and passwords: Password databases can be backed up, and so can TOTP seeds. It's inconvenient to do so, but I can at least still just leave copies around everywhere I can, so that it's extremely unlikely that I'll be completely locked out.
Yubikey: Making copies is literally impossible, so I'll need to buy two or three keys from the get go, and get them all out every time I need to add a new key. This is a huge inconvenience that no casual user will ever do (they might do 3-2-1 if it was set-and-forget, but Yubikeys aren't). If I don't do this, I lose permanent access to my accounts. There is no safety valve built in to the system. If I lose my key, I'm fucked.
Copy pasting my other comment from an earlier thread
FIDO2 USB Security key -> Bitwarden (With master password) -> Every other method (topt/password)
I have 3 FIDO2 USB Security keys, One I carry with my persons at all times, one that stays with my main machine at all times and an offsite backup that is sitting in a friend's server, if my house burns down, I can either physically collect the key or use USB-IP to authenticate back into bitwarden and enroll a new key. (Actually all 3 are at home right now but that's ok)
Its going to be hard to flush my desktop and my laptop down the toilet.
I recommend a reciprocating saw with a metal cutting blade to get them into small enough pieces. Do not try to flush them all of the pieces at the same time. It's not just about whether they fit or not, they also need to be light enough for the water current of the flush to carry them all the way through. Otherwise, they may end up in the water trap and hinder your future use of the appliance. For small partial blockages, it may be possible to consume some extra fiber in order to be able to "sweep" some of the metallic remnants along, but this will void both your warranty and your bowels.
I am a doctor -- and a lawyer and an orbital mechanics specialist, as well as a highly respected behavioral therapist -- so you can trust my advice. Also, feel free to consult an AI on this topic; it would make for an amusing benchmark.
Pretty easy for a lightning strike to simultaneously destroy both though unless you always unplug your computers during a storm.
I believe in you.
But a majority don't do that. For them let them use passkeys. If the possibility is once in 10 years then I am happy to do that. A majority is happy to do that.
And yes, Google or Apple - dont say you should not keep passwords in your database and sync it with dropbox. DIY.
Rest of us want convenience.
My point is if you just flushed your keychain, maybe some terrible accident while drunk at a pub, you should still have at least 1 more hardware key somewhere else. And by the way, your phone is also a viable key. Having a passkey on your phone and a physical one on your person solves most issues, with the rest being covered by having 1 or more in a safe or other secured storage location.
Enrolling two devices stored in different locations for every sign up is extremely annoying.
I suspect that most people that ostensibly do this actually only enroll one for non-critical accounts and then depend on some fallback mechanism.
This is a legitimate problem, and one of the few cases where a third party login provider makes sense, at least for non-critical “apps”. If both tokens can be authorized to that provider, then you don’t need to enroll any more tokens for apps using that provider. The difficulty is creating a trustworthy provider system without weakening security (the provider shouldn’t be able to login without you) that doesn’t collect information about you and which can’t lock you out from all your accounts.
I’m not sure what work has been done on this since Mozilla Persona. I certainly wouldn’t want Google and Apple, or governments, to be the sole gatekeepers.
Why would you choose that over a synchronizing passkey manager?
A third party OAuth provider puts you at the mercy of the service provider, the other can work fully on your client side even if the app provider were to disappear tomorrow.
The only advantage I can think of is that you have a centralized place to revoke credentials in case your password manager does get compromised.
> Why would you choose that over a synchronizing passkey manager?
No second factor, compromised passkey manager leads to compromise of all accounts. This is a huge problem.
> A third party OAuth provider puts you at the mercy of the service provider, the other can work fully on your client side even if the app provider were to disappear tomorrow.
Yes that’s what I was saying, it needs some thought and careful work. It would need to be decentralized, and I’m not sure that current standards are up to the task.
"A third party OAuth provider puts you at the mercy of the service provider" This is they key issue with trusting a third party to manage my passkeys, they can also BLOCK them and lock me out. An exception is if the passkeys are synced to all your devices and cannot be remotely wiped. I think this is how Apple works.
I didn’t think of this in the moment, but you’re right, this is an even bigger risk than compromise. There’s regularly a thread here about someone getting locked out of their cloud accounts, and now we’re going to gate everything behind those same accounts? Horrible idea.
Yes, I'd absolutely not use Apple or Google for my passkeys, even though they now at least seem to support exporting them to other platforms.
Then don't, there are several open source synchronizing passkey implementations!
> how do I log in on a device that I don't own?
Sad reality is that such usecase is less and less common, thus, no one cares about it. I think majority of my friends would not be able to access their email, or facebook or alike, if they were forced to use my computer in emergency.
And that sounds fine, until you're traveling and your devices get stolen or lost. How, exactly, are you going to get into your email then, once passkeys become the only means of login? Because that moment is when you really do need to access your email, stat.
What services implement it like this? Don't services usually implement passkeys as a more secure alternative to a password, but password login is still available?
Some sites allow passkeys as an option for MFA, so that could be an issue if the passkey is your only MFA option and MFA is required. But I imagine email would pretty much always be a fallback.
Didn't Outlook.com famously rolled out passkeys with no recovery option and no option to sign in using username and password once enrolled. So if you lost your trusted device, you couldn't sign in, nor could Microsoft send you an email, because... Outlook.com is your email provider.
I don't know if they fixed it, they probably did. Edit: Maybe not, because the recovery option at the end is just nuts: https://learn.microsoft.com/en-us/answers/questions/5454924/...
When was the last time you tried to log into something like Google, Apple, Microsoft etc without your phone nearby, on a fresh computer?
Nothing but a memorized password works in this scenario, right?
And not even that, now that I think about it. I have my very long Bitwarden password memorized but if my devices are all stolen I won't be able to get passed the 2-factor, so I'd still be screwed.
Rubbish. Such use cases are extremely common anywhere it can't be expected everyone has access to their own device.
Isn't there a workflow where you scan a QR code to confirm the pass key on your phone?
I've definitely done this, but not sure if the workflow was at the OS or browser level.
I'm honestly confused by all the negativity in the comments. Passkeys are great for convenience. Just leave your password login enabled as a backup. That defeats any security benefit, but oh well.
> Isn't there a workflow where you scan a QR code to confirm the pass key on your phone?
For people in this position, if they had their phone, they probably wouldn't be logging in on a computer anyway.
There are a lot of reasons why I might want to login on a computer I don't own to do something, rather than to use my phone. Having a keyboard is a major usability benefit for many types of work. Larger screen, printer. Software that is on the machine that can't run on my phone.
I agree with you; those are all reasons I only use my phone for on-the-go messaging or navigation. I'm against the idea that you should have to have a secure (against the owner) connected phone on your person at all times in order to sign in to a web service.
You don't have to with passkeys. I use passkeys every day, they rarely involve using my phone.
Thats still irrelevant to the example being discussed.
This is what I use to log into our remote desktop software at work. The passkey is on my phone and I scan a QR code presented by the remote desktop software (in this case it's the Windows App on my macbook and Microsoft Authenticator on my android).
There is. Doesn't work on every browser but it's really nice and I use it routinely.
Which is a trade-off that makes sense for a lot of people. If you have multiple devices, many of which are portable and one you have on you all the time, the need for that is just way lower, so being more secure against commonplace automated widespread attacks is worth it to them.
Many people are moving to only a single portable device that’s easily lost, broken, or stolen, without any understanding of backups or fallbacks for their accounts.
And many are moving to virtual wallets like Cashapp rather than banks with a physical presence where you can take out money without a phone.
It’s a bad situation.
Heh, this situation totally reminds me of politics.
Person 1: "People that end up in this situation that can easily happen should be punished to the full extent of the law with no mercy!"
[Exact situation happens to Person 1]
Person 1: "This is the greatest injustice, do people have no empathy? I could not have avoided this situation!"
That sounds deeper than politics… More like human nature.
A variant of that is alternative accounts that properly live on a different device/context.
For instance YouTubers usually have a different account for their channel than the one they use privately, and don't want their channel account logged in everywhere.
That means having to log in as a guest when push comes to shove. And similar setups are common for most self-employed keeping a "work" account IMHO.
That's actually a good use case for HW keys. Since untrusted computers are much more likely to have keyloggers/malware, etc. So you don't need to reset password and invalidate all sessions after each such login on an untrusted computer.
The offer a strong protection against phishing attacks that would still get plenty of password manager users: fake websites. A passkey is strongly linked to a domain, so a fake site can't get that credential.
Some password managers will only fill if a domain matches, but IRL the response I've seen from most users when it doesn't match is to assume the integration broke and manually copy/paste it in. I've also seen lots of them do stuff like happily autofill on any prefix of the domain, so your credential for `something.example.com` will autofill into `fake-something.example.com`.
"Oh, usually my bank just logs me in, that's strange. Let me just go grab my username and password and type it into this site that looks like my bank."
Same thing is going to happen with passkeys for non-technical users for exactly the same reason you stated. People will think the integration is busted and manually copy/paste the non-passkey credentials in. In that way, I would argue that passkey is not stronger protection against phishing attacks unless its the only way to login. It is, at best, a convenience for users.
If the user just has a username/password fallback and that's it, then yes, but the aim of passkeys is that won't be the norm, rather users will only have passkeys and the fallback would be to, e.g: magic link email log in where the phishing attack is still broken. I've seen some sites explicitly disallow plain username/password login after you enable passkeys for this reason (you can still put them in, but then it just does a magic link flow afterwards as a second factor).
The pitch is that passwords will supposedly be phased out entirely as an option.
I've been told by multiple people that the recovery method of passkeys is to enter your username/password. If passwords are eliminated, your final recourse is fucked.
Why would it be that is the only recovery method? The most convenient one is just more passkeys on other devices of course, but you can have any other recovery methods you want. Magic link emails are the most common, but there is nothing about passkeys stopping you from implementing anything you want.
Which is a laudible goal, but something that makes "oh just fall back to the standard insecure recovery process" not a very good response to the concerns about users being able to actually hold on to their passkeys easily and reliably.
How did fake-something get injected as a subdomain?
Loads of hosting sites do this, username.domain.tld is the most common one.
I guess it's a good thing my bank doesn't have a free web hosting service
> but IRL the response I've seen from most users when it doesn't match is to assume the integration broke and manually copy/paste it in.
I've seen people do this AFK as well, and I'm always helpfully suggesting them the correct way of solving this: verifying the URL again, and if correct, add it to the password manager so it remembers in the future, and never copy-paste passwords on the web. Basically 50/50 if they take the advice or come back after a week asking if it's safe to copy-paste the password into the website, and I try to inform again.
Shockingly, I saw one developer peer copy-pasting a password into a website, but I guess for these people there is no hope.
There are too many websites where this is broken for me (even with Firefox's built-in password fill) to go as far as to never copy-paste passwords. If web devs actually implemented it consistently, I might be that draconian about it, but asking them to do that when we already have the '200 MB of JS is needed to view this page' problem, I have my doubts we're going to see this problem going away any time soon.
Probably the whole authentication thing shouldn't be implemented by the website at all. There should be some standardized way to ask for authentication that's implemented by the browser or the operating system.
It should be a big red flag for sure, but the reality is most users aren't going to understand that. They got told to use a password manager by someone or find it convenient, but they don't understand the security flow enough to catch that it's a potential attack, or how to resolve it safely.
Historically I've seen lots of sites do a subdomain shuffle for login pages every now and then which routinely breaks domain matching, introducing false positives that users have to deal with, making them numb to the threat too. Passkeys baking in the domain check with no workaround means that sites can't do that, which is a benefit.
My password manager's browser integration breaks on every update of Firefox, which seems like it is a weekly affair. I got rid of the extension, and copy/paste everything.
Password managers were never meant to solve the problem of phishing, and aren't really capable of that. They solved the problem of password reuse. They do that just fine.
Your last sentence got me good, as I'm a developer who copy-pastes passwords into websites (from a 12? year old KeePass database, for whatever that's worth).
I've tried using the Firefox integration in the past - more than once - and I don't know... it had so many warts that I got fed up with it and turned it off. And now I have 1Password (from work) also doing its best to feed me credentials all the time. So trying the KeePass integration again is going to have them both drawing suggestion dropdowns all the time..
But ok, I'll give it another honest shot. Because of your comment.
> Some password managers will only fill if a domain matches, but IRL the response I've seen from most users when it doesn't match is to assume the integration broke and manually copy/paste it in. I've also seen lots of them do stuff like happily autofill on any prefix of the domain, so your credential for `something.example.com` will autofill into `fake-something.example.com`.
Why would you trust the very same password managers that don't handle passwords properly to handle passkeys properly?
You don't. The browser handles the passkey matching to the domain which is obviously a better place to do it. There could obviously still be bugs as with all things, but it's much more intentionally integrated into the flow which makes it much harder to bypass.
> The browser handles the passkey matching to the domain which is obviously a better place to do it.
I'm not sure why you're making a distinction. In many cases the browser is the password manager.
Right, I haven't seen that particular flaw in baked-into-the-browser ones (probably because they already having secure domain matching code ready to use), but the distinction is that doing the domain check is a part of the spec and standard, so e.g: sites aren't going to break it by changing the log-in subdomain routinely, as has been common historically.
Password managers have had to be permissive enough to work with most websites, and there is no standard for it. There have been sites that blocked the autofilling of passwords and so on as well.
My point wasn't this one particular flaw in some password managers is the reason to use passkeys (the copy/paste point is the much bigger issue anyway), just that it's an example of how relatively brittle the password manager process is. Having it a core part of the spec gives stronger guarantees.
“There have been sites that blocked the autofilling of passwords and so on as well.”
Sites that do this irritate me so much. Ones that try to block pasting and stuff… like somebody intentionally baked that into the site. Who? And what was their rationale? Are they really so arrogant to think people are going to carefully type in some elaborate password not once but twice?
That and blocking paste in fields like bank account numbers and stuff.
Surely somebody here has been asked to implement these mis-features. Please explain what went through the heads of the people responsible for it?
Blocking bank account numbers from being pasted is considered an error prevention measure. By forcing people to enter it manually at least once, you stop them from blindly pasting the wrong number twice.
There's no real regulation requiring blocking paste but it has become an annoying informal standard of sorts.
Thankfully brave’s right click menu has a force paste that works quite well
Sure but who is reading account numbers off checks? They are copy and pasting from their bank app.
The users are the ones manually copy/pasting the password. There's no way the password manager could prevent this short of disallowing copying/viewing passwords.
The password integration breaks because it's trying to detect password fields rather and failing because of weird HTML/JS code.
The passkey integration goes the other way, which is much more reliable.
> Why would you trust the very same password managers that don't handle passwords properly to handle passkeys properly?
Gell-Mann amnesia effect
https://en.wikipedia.org/wiki/Michael_Crichton#%22Gell-Mann_...
> But this still breaks the login flow for a very common use case: how do I log in on a device that I don't own? With a password in a password manager I at least have the option of manually typing the password.
This is meant to be solved by the cross-device flow - a QR code pops up that you scan, and a secure channel is established from that with your other device.
[Disclosure: an editor of said standard]
> The biggest problem, though, is how users are pushed into it without any warning or knowledge of what they're signing up for.
On macOS/iOS, the system gives this prompt regardless of where your passkeys are being created/stored:
Save a passkey?
"<site>" supports passkeys, a stronger alternative to passwords that cannot be leaked or stolen. A passkey for "<username>" will be saved in "<provider>".
There is a transparent upgrade option though that sites can request - basically when a site supports passwords and passkeys, they can request a password manager supporting both create and return a new passkey on password sign-in.
> [...] and had to go back and figure out how to undo it after being blocked from login on another computer (which computer was I on again?).
That's unfortunate. A site/service should absolutely not replace other passkeys, nor should it remove other sign-in options like passwords, without explicit user consent.
The above credential upgrade flow makes that doubly so; even if someone relies on a password manager to manage and provide their credentials for a site, it very well may not be the singular piece of software that does so.
> This is meant to be solved by the cross-device flow - a QR code pops up that you scan, and a secure channel is established from that with your other device.
That only works if the device has working camera and bluetooth. What if I want to log in from my new desktop PC to an account whose Passkey is stored on my old desktop PC?
If passkeys were implemented properly, the would be most useful to relatively technical users that already use password managers. Ideally, the only real change is that a single text password is replaced with multiple non-text "passwords" that cannot be entered on the wrong website by accident.
The problem is exactly that they're being forced on nontechnical users when the UX isn't even good enough yet to sell them to technical users.
> If you use multiple devices throughout the day, registering passkeys in all of these systems becomes a big headache
This is why you use hardware keys which work across devices like yubikeys and the like.
I have two of the old neos and two of the newer usb c + NFC enabled ones.
No issues.
Some would consider spending over $200 on hardware keys an issue.
Peace of mind is a luxury good
> I've accidentally set up passkeys just by clicking an okay button a few times in the past and had to go back and figure out how to undo it after being blocked from login on another computer (which computer was I on again?).
No doubt there exist services that do not offer recovery method for passkey or mfa enabled account. But this is entirely on them (the service), to blame for, not the passkeys or the users. It’s bad implementation.
Bad implementations of an otherwise sane/fine technology can sink the technology. Here’s to hoping that happens with passkeys
I'm just storing my passkeys in 1password, which means they're synced across my two computers and phone and also means I gave up any kind of hardware security.
Oh well.
Sony Playstation will only let you setup a passkey if you disable password auth.
But I have not found any way to use my browser's passkey to login on my PS5. I can scan a QR code, but that requires logging into the mobile app with a passkey. And I can't add one to my mobile phone because I can't login on mobile... the passkey is on my laptop, and it won't autofill from 1Password (Android).
> Passkeys do marginally improve security against MITM and phishing attacks ...
The tragedy of passkeys is that they're a step back from the security offered by the likes of Yubikeys.
But because passkeys are pushed by both Google, Microsoft and Apple: there is is simply no fighting these three. It is impossible.
Passkeys won not because they're better (they're not and the entire concept of "secret behind a hardware security module" that can be transferred to another system defeats the whole point of a HSM in the first place) but because the powers-that-be decided that passkeys are to be used.
It's still a win: the commoners are better served with passkeys.
But a secret in control of Google/Apple/Microsoft that can be backed up is not a secret I control: it's a complete step back from yubikeys.
Passkeys won and we better get used to them (and, yup, there are usability issues as you mentioned).
Why not just use a passkey backed by your Yubikey?
As an IT manager weak and/or re-used passwords are an absolute scourge. Ideally every time you set a passkey you'd also add an OTP Authenticator factor as fallback. Passkeys are incredibly useful and relatively secure when pair with biometric authorization (touch/face ID). I agree with a lot of the points about consumer level use, but still think they're net positive compared with bad password (re)use. I'd advocate for email recover as a decent fallback, but there's only so much you can do when the average user won't establish a base line of security for their primary account and access point.
Security is frustrating and it's hard to get people to do the bare minimum to establish secure access to their services.
> how do I log in on a device that I don't own? With a password in a password manager I at least have the option of manually typing the password.
I agree with you 100%, although I will say that it seems like newer OSes (perhaps it depends on the desktop + mobile combination, or maybe Chrome + Android is enough, not sure) have a way for you to use a passkey from your phone by scanning a QR code. I still think it's not super user-friendly but it is a clever workaround at least. Most people are accustomed to scanning QR codes, so scanning a QR code from your phone to sign in seems like not too big of a leap. (Although I wonder if it conditions users to scan random QR codes to sign in which could be a bigger phishing problem lol...).
This. My simple brain is always like...."This passkey is going to be lost and only usable on this machine and I don't even trust that to work consistently because I do weird stuff sometimes"
> But this still breaks the login flow for a very common use case: how do I log in on a device that I don't own?
at least in Apple land, if you try to sign on on a device that you don’t own (let’s say a work laptop where you’re not signed in to your apple id) it’ll give you a QR code to scan with your iPhone and it’ll do faceID on your iphone then do some bluetooth handshake to use your passkey on the other device. I’m not sure if this is Apple exclusive or if android/windows/linux would be able to do the same
Other OSes can do the same.
I’m a big dummy who commented before reading the article, this is actually called out there
> The last option is to use “Hybrid Transport”, where you scan a QR code and connect via Bluetooth simultaneously to the computer. Whilst this option is secure and works in theory, reality is plagued with edge-cases where connections fail or Bluetooth is straight-up unsupported.
I haven't articulated my thoughts about passkeys nearly as eloquently, but you did an amazing job here. This really sums up a latent problem I've had with passkeys.
Do you have a blog?
Passkeys are awesome if you're one person, with one account, on one device. As soon as any of those three aren't true, they're a huge pain in the ass.
> people who re-use passwords and/or don't use a password manager.
So the vast majority of all humans on this very planet?
I have a passkey on CVS, but that YubiKey was eaten by the sewer.
Thankfully I can still log-in with a password & text. But how to reset the passkey? No-one knows.
Edit: I take that back, for some reason they stopped taking the password I used when setting up the account. It's only email or SMS with code verification + birth-date.
In the Apple ecosystem this is trivial - you select to sign in using a QR code which you scan with a device you do own. It works perfectly in my experience (of using them wherever possible for several years)
> how do I log in on a device that I don't own?
You scan the qr code from your phone and it logs you in on that device. The experience is pretty amazing, honestly.
They mean if you dont have access to your devices.
What if you don't own a phone?
iCloud Keychain? Is there a reason not to use it? Aside from having android.
go back and figure out how to undo it
There's an undo? Could you elaborate?
Except this isn’t true?
I use my github passkey on my phone to log in on my laptop by scanning a QR code. “My” laptop for work, which I wouldn’t put said passkey on.
[dead]