19 ms·

Passkeys: A shattered dream

• buggg 2y ago
  Bitwarden now official released passkey support on mobile app on iOS/Iphone in Version 2024.4.2. If there will be a way to backup and restore between competitors, for example from bitwarden to 1password or vice versa, im fine to go with bitwarden now. Backup and import passkeys from Bitwarden to Bitwarden already supported. So please FIDO'S contributers, find away to standardize backup&restore passkeys.
• md_ 2y ago
  I use iCloud's Passkeys extensively and have never had saved Passkeys "wiped out". I am not disputing that data loss bugs can happen, but three times for one user sounds pretty weird given the maturity of the ecosystem. The most obvious explanations seem to me to be: a) Apple loses data (presumably not just Passkeys, but also photos, passwords, and other highly noticeable stuff) all the time, and I've been lucky for the last ten years. Hundreds of millions of Apple users just learn to live with this. b) The author is doing something weird. c) This is hyperbole. I'm probably picking nits, but it's like an article raising a bunch of legitimate criticisms of the internal combustion engine mentioning that the author's car has, while sitting in the parking lot, simply exploded on three separate occasions. Like, maybe?
  • deleted 2y ago
    [deleted]
  • buildbot 2y ago
    I was about to type something similar to this as well! I use passkeys pretty heavily, with iCloud sync. Never had an issue. The only similar issue I can think of is sometimes my Macbook will loose the contents of the on device wallet, including in one case an ssh key stored there. That was somewhat annoying!
  • cjk2 2y ago
    Agreed. I'm not so sure that some of the iCloud data loss bugs people talk about are actual data loss bugs. I've had a few issues over the years. Firstly I spent weeks chasing down what I thought was a data loss bug in iCloud. After much effort I managed to reproduce it. Turned out it was an issue with TeXshop rather than iCloud. Secondly, the one time I had a photo lost, it wasn't lost. I just couldn't find it in the 12000 photos I had. It wasn't where I'd left it. The third one was a data loss bug, was reproducible, was reported to Apple and was fixed. This was due to how Numbers handles three devices and how it decides the winner of a conflicting change and was an edge case as number 1 awkward customer. YMMV but user testimony may be as reliable as eyewitness reports.
    • md_ 2y ago
      To be clear, I don't work for Apple. :) And I'm not discounting that there are usage patterns that might lead to persistent bad experiences (like your example with Numbers). But the implication that Keychain just kind of forgets saved Passkeys once in a while seems alarmist and probably unfounded.
      • cjk2 2y ago
        Yeah exactly. It is possible that some expiry or provider specific bug may lead to revocation? I am not sure how it works entirely. I will say that there are some very well known backup and restore issues with keychain however so I keep anything critical in MacPass as the primary copy.
  • jsnell 2y ago
    It can't be hyperbole, their partner's car keeps exploding too! So often that they're switching back to a four horse carriage.
  • flup 2y ago
    One thing that comes to mind is with the earlier WebAuthn implementations in iOS, before they were stored in iCloud and called passkeys, there was no management interface for stored passkeys and 'clear website data' (to delete cookies etc.) would actually erase all credentials permanently. It was useless this way.
    • usrusr 2y ago
      Why useless? Not an authentication scheme to and all other authentication schemes, but certainly a (much) better successor to the login cookie?
      • flup 2y ago
        I do not mean passkeys in general but early iOS implementation was useless since it deleted passkeys along with your cookies and other website data. The passkey iOS implementation is useful in its current form.
  • MichaelMug 2y ago
    > I use iCloud's Passkeys extensively So what happens if you want to migrate away from iCloud for the storage of passkeys?
    • 4ad 2y ago
      I can't speak for OP, but for every service that I use passkeys with I enrolled both iCloud Passkeys (for convenience) and several YubiKeys (for portability and backup). This is not different at all from a SSH public/private key combo. You are not supposed to duplicate SSH keys!
      • md_ 2y ago
        Your answer is totally reasonable, but I admit I don't have time for that in most cases. 1. Most services are not Passkey-only--most people are using it as a password alternative (e.g. eBay) or a second-factor alternative. So losing it won't lock me out. 2. A very small number (e.g. Google) let you configure Passkey as your sole second factor. For those, I am indeed careful to do what you do and have duplicates. I do think this is kind of bad? So the grandparent totally has a point here: services find it hard to do only Passkeys (and thus realize the security benefits). But, as a user, it's not something I worry about a lot, to be honest.
    • drxzcl 2y ago
      You generally enroll a passkey for a single device or connected group of devices. My icloud-syncing devices has a passkey. My windows laptop has another. My desktop has yet another. I have also enrolled my yubikey. I could stop using my idevices tomorrow and not be negatively influenced.
  • nebulous1 2y ago
    > b) The author is doing something weird. The author is the main dev of an identity management platform and called kanidm, so yeah I'd wager their usage is fairly non-standard. That said, it should be almost impossible for it to happen anyway. Also, that doesn't apply to his partner.
  • arianvanp 2y ago
    It's not hyperbole. I recently (few weeks ago) got locked out of my GitHub account after iCloud Keychain thrashed my passkey and after analyzing the root cause it turned out to be a bug in webkit (that is now fixed in Safari technology preview after me raising it with the Webkit team) https://bugs.webkit.org/show_bug.cgi?id=270553 https://bugs.webkit.org/show_bug.cgi?id=270553
• cco 2y ago
  Oof, the Passkeys ecosystem is incredibly complex. Even as someone that deals with it day in and day out at $CURRENT_CO, it can be a headache. As an exercise from a developer's perspective, try creating a chart of every device type (mobile, desktop etc), browser, and Passkeys platform provider (Apple, Microsoft etc). Then fill out how each behaves across each combination, it is a nightmare! I'm hopeful that we'll see more cooperation across Passkey providers to align both the devx and UX to increase adoption where it makes sense. Not holding my breath too much though.
  • md_ 2y ago
    Definitely this. I think the worst aspect of Passkeys is that the noble goals (public key crypto! unphisability!) seem to somewhat unavoidably wipe out one of the--in hindsight--really valuable aspects of passwords-in-a-password-manager: That you can always just copy them out, put them in a different password manager, or write them on a post-it. That said, I think this is a byproduct of the design space being complex (as you suggest) and not, as the author seems to feel, "thought leaders" or malice.
    • rekoil 2y ago
      I've been using Passkeys saved in 1Password, I thought that gave me the power to transfer them, but I just looked and apparently the export feature of 1P doesn't allow exporting the Passkeys, it just tells you you need to create new ones in your new password manager, so that's pretty crappy...
  • dariosalvi78 2y ago
    I am exploring this now, actually got 2 students doing their thesis on this. It's very complicated and unnecessarily so. My conclusion so far is that it's a promising technology, but no way as mature as I'd like it to be. Unfortunately we are stuck with emails and passwords for the foreseeable future, at least as a back-up mechanism for credentials recovery, which, funnily, makes the whole thing pretty much pointless.
    • knallfrosch 2y ago
• cmdli 2y ago
  Honestly, I think a big part of the problem is that passkeys have been tied to hardware devices and they don't have to be. A passkey is just a public key credential, and it can easily be provided by software as well as by hardware. You would still get many of the benefits (better UX, automatically secure, prevents phishing) and the overall customer experience could be a lot better. Imagine if passkeys could be saved, transferred, and imported as easily as a PDF. Instead, we get a bunch of walled gardens where Apple/Google/Microsoft/etc are trying to be the only provider you use.
  • renewiltord 2y ago
    I have my passkeys in bitwarden.
    • minebreaker 2y ago
      Does BitWarden support passkey export now?
      • renewiltord 2y ago
        Export to JSON and then grep for `fido2Credentials`
• austinallegro 2y ago
  Johnny Hates Jazz.
• echoangle 2y ago
  Is the author suggesting he’s not traveling to the US out of security concerns? Is that really a thing?
  • youngtaff 2y ago
    Yes, there are plenty of people who avoid travelling to the US
    • echoangle 2y ago
      I know that, but I didn’t think it was because of security. I don’t think of the US as particularly dangerous, but maybe my perception is wrong…
      • RVuRnvbM2e 2y ago
        The homicide rate is 8x Australia's, so yeah it is by comparison.
      • _ZeD_ 2y ago
        I know that US is vast, and there are millions of good places where one could feel safe, but I assure you, from the outside sometimes is seems you live in a mad max alternate universe
        • echoangle 2y ago
          I’m from Europe, but I would have no problem going to a tech meeting with some google engineers in Silicon Valley.
      • JonChesterfield 2y ago
        It's the guns and the police. People get angry or frightened. It's better for everyone else if they're not carrying a firearms at that point. Policing a nation where everyone is armed means the police are heavily armed and the non-insane ones very frightened all the time. See above.
• vbezhenar 2y ago
  Passkeys are pretty useless for me. At first I was somewhat hyped, but it seems that everyone just ignores them. Chrome does not support them. I set it up on mac, today I tried to login to icloud using passkey, but it just didn't work. Few websites implemented them, but overwhelming majority of websites don't. So, yeah, useless technology for now. Passwords and TOTPs are the way.
  • dariosalvi78 2y ago
    Chrome supports passkeys
    • vbezhenar 2y ago
      It does not. Not for Linux, anyway.
      • test20201 2y ago
        It is because desktop linux does not have passkey interface built into the OS. There needs to be TPM, systemd, etc need to talk altogether.
        • deleted 2y ago
          [deleted]
        • wiktor-k 2y ago
          Linux most definitely has a TPM interface, it's called /dev/tpmrm0 and plenty of libraries for accessing it (eg. https://github.com/parallaxsecond/rust-tss-esapi/ https://github.com/parallaxsecond/rust-tss-esapi/ full disclosure: I'm co-maintaining it). Systemd is not needed for that.
          • lll-o-lll 2y ago
            So where are things falling down? I seem to be unable to get passkeys to work in linux; Chrome or Firefox. I’m suspecting the issue is something to do with bluetooth.
• cjk2 2y ago
  I still use Keepass (well MacPass) and naively "cache" what I use regularly in Keychain because I completely distrust anyone else handling the keys to my castle. Whenever I get a Passkeys notification it's an irritation as I don't actually see what the supposed benefits of this are and I'm not really interested in changing how I work. Just feels like I'm being dragged into something complex I will never be able to escape.
  • DecoPerson 2y ago
    Try Keepassium on iOS. It removed my need to “cache” anything in the keychain.
    • Filligree 2y ago
      Do you know how to turn the dratted thing off, by any chance?
  • BillinghamJ 2y ago
    Password managers can store the passkeys just like they store passwords. 1Password has had strong support for them for quite a while now
    • cjk2 2y ago
      Yeah probably can. But why do I need Passkeys?
      • jf 2y ago
        If you’re asking in earnest: For the majority of users, Passkeys offer a pragmatic alternative to passwords that is far superior in terms of security. For you, based on what I’ve read in your comments, I would say that Passkeys are the first workable alternative to passwords. They are built on WebAuthn which (roughly summarized) was the standard developed by Google and Yubico in direct response to the Operation Auora attack. While the Apple/Microsoft/Google implementations of Passkeys likely won’t meet your personal standards, they’re built on a proven and well designed open standard. Which means you can benefit from the technology without buying into a corporate ecosystem.
• saagarjha 2y ago
  The biggest issue with passkeys is that I just can't trust the companies offering them. They are locked into the platform for reasons that are ostensibly security but often indistinguishable from platform lock-in. If you make a passkey on an Apple device as far as I can tell it will never leave that device, ever, and there is no way to change this. Of course this means you can never be phished for your credentials but if Apple decides to delete your key or you want to leave your iPhone behind, what are you supposed to do?
  • sevanteri 2y ago
    This is why services need to support multiple passkeys per user just like they should support multiple 2FA methods...
    • Nextgrid 2y ago
      Big problem with this is that enrolling the secondary passkey requires the authenticator to be present. This is super inconvenient and risky as it always requires both authenticators to be present at the same machine/physical location, exposing both to local, physical threats (faulty USB ports on your machine frying anything you plug in? Congrats, you've now fried your main and any backup authenticators before you realized what was happening). Ideally, you should be able to get an authenticator's public key and be able to enroll one without presenting the authenticator itself, allowing you to keep it in a safe/etc. This would enable an easy workflow - enroll main authenticator as normal, then enroll your safely-stored backup by pasting its public key. If you lose your main, go to your safe, get your backup and "promote" it to primary and enroll a new backup one which goes in the safe.
      • 4ad 2y ago
        This is why you need to enrol the secondary passkey at the same time you enrol the first one, not later when you might not have the authenticator present. In reality websites should not allow setting up a single passkey.
        • 2y ago
• nevi-me 2y ago
  This is quite concerning, because I've recently started a project that uses webauthn-rs. I want to minimise spam on the project while I don't want to collect PII like emails for login. I wonder if it means that the author will stop working on the library after their next release, and more importantly, if the UX is going to be horrible with people unable to log in and other issues they mention. On a tangent, I share their discomforts about travelling to the US. The last time I was there, I felt uncomfortable being out on the streets alone. Maybe the portrayal of police brutality towards POC is a factor (for me).
  • wiktor-k 2y ago
    > I wonder if it means that the author will stop working on the library after their next release, Just FYI it seems the library will still be maintained: https://infosec.exchange/@firstyear/112337225055591544 https://infosec.exchange/@firstyear/112337225055591544
• keepamovin 2y ago
  Question for the author regarding: within a business where we have policy around what devices may be acceptable the ability to filter devices does matter. Is a solution to this on desktop to use GPO policy to add a mandatory "attesting" extension (that you build yourself which just verifies the device is what it says it is), and on mobile to use a webview inside an app with similar attesting info injected into the page context??
• politelemon 2y ago
  > At this point I think that Passkeys will fail in the hands of the general consumer population. Actually, I think it might be worse. The predators like Apple/Google have already pounced on passkeys as a consumer capture mechanism, so they'll ensure it doesn't fail.
  • throwawayqqq11 2y ago
    Just you wait for governments to require platforms to only accept gov-signed keys. I was sceptical about something-you-own auth vs. something-you-know auth from the beginning and recieved backlash from my tech peers for it. I hate to be able to go "told you so" on this one. Lets hope im wrong about the government involvement, but i dont think i will.
    • DyslexicAtheist 2y ago
      not to diminish your point, but since at decade or so I'm a more worried about corporate surveillance capitalism than I'm about government surveillance.
      • ajsnigrutin 2y ago
        With a bit of a change, you can mostly avoid most of those corporations... you lose out on some tech goodies, but you can still live quite normally. You cannot avoid the government.
        • thejohnconway 2y ago
          You can’t avoid these corporations if you want to remain active on the internet. They keep shadow profiles. They sell and share your data from one service to another (I stoped using Facebook for example, but Netflix shared its watch data with Facebook.) I don’t think it’s possible to avoid them. Confuse them maybe.
      • pcthrowaway 2y ago
        I mean, same, but only because I realized a new undesirable thing was becoming a tacit reality that we'd have to accept on top of already undesirable thing
• _nalply 2y ago
  I can't help feeling this... In an adverse world software and electronic data is too ephemeral to entrust with authentication and authorization. What if we had something solid like a Yubikey, but: - credit card sized - completely airgapped - standardized - controlled by a non-profit association - hard- and software open sourced - built-in camera to scan data - built-in display to show data - configuration mode: scan human-readable configuration - data is QR code or something like Base58 to copy by hand - backup by supporting applications: scan and print out data - browser integration by an extension using a webcam
  • arch-choot 2y ago
    If you ignore the last 6 points about cameras and displays, then this is kinda what "Smartcards" are, I think? https://en.wikipedia.org/wiki/OpenPGP_card https://en.wikipedia.org/wiki/OpenPGP_card In fact the Estonian Id-Card is one of these if I'm not mistaken
    • _nalply 2y ago
      The problem with smartcards is: I don't see what's on them.
    • wiktor-k 2y ago
      Just to clarify Estonian Id-Card most certainly implements the PIV applet while Yubikeys implement both PIV and the OpenPGP Card (the latter has a benefit of natively supporting ed25519: https://github.com/wiktor-k/age-plugin-openpgp-card https://github.com/wiktor-k/age-plugin-openpgp-card).
• vaylian 2y ago
  > But of course, thought leaders exist, and Apple hadn't defined what a Passkey was. One of those thought leaders took to the FIDO conference stage and announced "Passkeys are resident keys", at the same time as the unleashed a passkeys dev website (I won't link to it out of principal). I'm trying to follow the developments in the 2-factor-auth space and this was one thing that confused me a lot. I've read a lot of hype on Passkeys being the next big thing but it was really hard to find an actual explanation what they are and how they work. And once I found out that these are keys that are stored on the security key, I was rather disappointed, because I really like the idea of generating keys on the fly based on the domain name that I'm authenticating against. This way I can "store" an infinite number of keys. The upside of Passkeys is supposedly that you do not need to remember which username you have on a website, but I think that's a minor upside. Related question: What is the official name for the (FIDO2-based?/WebAuthn-based?) technology that calculates and reconstructs keys on the fly based on the domain name of the service that I'm authenticating against? It is really difficult to learn the right terminology in the area. Edit: I think I found the answer here: https://fy.blackhats.net.au/blog/2023-02-02-how-hype-will-turn-your-security-key-into-junk/#what-is-a-resident-key https://fy.blackhats.net.au/blog/2023-02-02-how-hype-will-tu... A key that is reconstructed on the fly is called a "non-resident credential".
  • tucnak 2y ago
    > I really like the idea of generating keys on the fly based on the domain name that I'm authenticating against. You could do it on a USB cryptoprocessor, and securely, too. https://tillitis.se/ https://tillitis.se/
• macrael 2y ago
  Passkeys can't actually replace passwords, right? I will always need a username and password with a website, then can generate a passkey as a separate auth mechanism, which if I lose, I will recover by setting up again using my username and password? I don't get how we can get to a place where passkeys are all, how do you get a passkey on a new device when you only have passkey auth on some other device enabled?
  • arianvanp 2y ago
    They are stored in your platform's password manager. So they're available on all the devices you're logged into. If you're enrolling a new device (say you buy a new android phone) you can scan a QR code from your previous phone go log in.
    • macrael 2y ago
      I see, so you can use one device to auth and create a passkey on another
    • Filligree 2y ago
      “My platform”? So, like, the BIOS? What if I want to use both a PC and an iPhone?
      • arianvanp 2y ago
        Platform as in "ecosystem". iCloud Keychain, Google Password Manager, Bitwarden, 1Password, your Yubikey. Anything that can store passkeys. If you want to use both you simply enroll both your PC and your iPhone. There's nothing stopping you from doing this. You can register multiple passkeys from different providers to the same account. You can also log in to your PC with your iPhone by scanning a QR code. And then afterwards enroll your PC as a secondary passkey.
  • nusl 2y ago
    This is how I'm using them. Still have a username/password, with a passkey as an additional factor. I use 1Password for passkeys rather than Apple's solution, which enables me to use them wherever I have 1Password.
• vanburen 2y ago
  Usernameless always seemed like an optimization too far to me. I think it's totally reasonable, and probably a good thing for users having to use their username at login. Especially as it reminds them what username they are using for that service. I could totally see a situation where a user uses a Usernameless passkey for years to access a service and for some reason loses access to the Usernameless passkey, and then has also forgotten the username for the service, so cannot even start an account recovery process.
  • knallfrosch 2y ago
    There's no account recovery process for passkeys. I thought they are your identity?
    • skybrian 2y ago
      No, that's like having only one key to your house. If you have two passkeys from different providers, they serve as backups for each other. And there are other alternatives, like a printout of recovery codes.
    • tsimionescu 2y ago
      No, your person is your identity. Passkey don't pay for services, people do. So there is always a recovery process, at least for any business that actually values you as a customer.
  • klabb3 2y ago
    > Usernameless always seemed like an optimization too far to me. I think it depends on the service. But aside from the occasional forum or social site, usernames are just an extra step. I don’t want or need one for banking/administration/ordering a product. For better or worse, email is usually a better identifier, assuming you already need one for other reasons (like you say recovery is typically needed). > Especially as it reminds them what username they are using for that service. Like passwords, forced usernames are hard to remember, if you use different ones. If you use the same, then it leaks privacy across services. (Technically usernames can be private but the expectation from decades of social sites is they are public) > […] loses access to the Usernameless passkey, and then has also forgotten the username for the service Correct, no identifier at all can’t be recovered. Hence, email.
• frereubu 2y ago
  I've had Apple silently delete music from Music when I had iTunes Match, and I've stayed paying for Dropbox despite wanting to use iCloud, which would be no extra cost for me, because their mechanisms for dealing with conflicts are different - Dropbox saves a version with "Name's conflicted version 2024-04-26" in the filename, whereas AFAIK iCloud silently decides what to keep and drop so you can't manually decide how to merge a conflict. I too find it hard to imagine how someone can lose all their passkeys three times, and I guess they may be doing something funky given their profession, but I think many of these events just happen too easily in the Apple ecosystem and my trust in them managing things like that is relatively low - hence my use of 1Password instead of iCloud keychain. The Music thing in particular really stung as I never got a good handle on what was missing - I'd just occasionally come across a "this file is missing" error when I tried to play a song, and I'm left with this kind of cloud of unknowing when it comes to my Music library.
• myspy 2y ago
  I think I'm a tech guy and know my fields. I still have no real clue how passkeys work, how it is better, what it really is. When your security feature is not as simple as - remember a name and a password and store it somewhere safe - it doesn't work. Something about keys that are on devices. But what happens when I use a phone and a pc? How to get access then? Do I need a User/PW for the first time? Or do I need one of those keys I have to plug into the device first?
  • 4ad 2y ago
    Passkeys are exactly like SSH keys. You should use them exactly like you use SSH keys.
    • tux3 2y ago
      "Exactly" is under a lot of strain here. SSH is nice because you don't have to think about it. Your private key sits in your .ssh folder, and then everything is transparent. You _can_ put an SSH key in a smartcard if you want, but you have to opt-in to this kind of pain. And even if you do, almost all SSH servers will support that login method without issue. Passkeys don't sit in your .passkey folder. Your browser doesn't look for passkeys in a standard folder at all. You don't just do passkey-keygen like you would ssh-keygen and forget about it. Websites might support various combinations of FIDO/U2F/TOTP security keys, your USB security key might support various combination of FIDO2/CTAP/WebAuthn, and the user will be left confused what any of this mess means, why there are so many competing standards, and why they're asked to scan a QR code when they plug in their dongle, and it doesn't just work at all.
      • bradley13 2y ago
        Passkeys ought to be exactly like SSH keys. Unfortunately, they are not. The attempts to restrict when and how they are stored, and how you can access them - those are going to cause a lot of pain and confusion. I have all of my SSH keys stored in KeepassXC, which (imho) is a lot more secure than having them hang around in my .ssh directory. Open KeepassXC, and the keys are available. Close it, and they're gone. Synchronizing the KeepassXC-file across devices means that I have access to the keys on all of my devices. The big companies pushing passkeys are trying very hard to prevent this kind of convenience.
• vouaobrasil 2y ago
  Passkeys are horrible because the design encourages the need for a smartphone, which is itself a disaster.
  • threatofrain 2y ago
    Passkeys only encourage the need for a password management tool, which is funny because if everyone had password management tools to begin with then we wouldn't need passkeys.
    • vouaobrasil 2y ago
      True, the technical aspect of passkeys does that. But in practical Apple and others want to heavily push for the smartphone as that tool, because it locks people further into that system.
    • arianvanp 2y ago
      This is not true. Passkeys still protect you from additional things that password managers don't protect you against: 1. Your credential can't be phished as it's cryptographically bound to the domain. You could stil be tricked into entering your password and TOTP into a malicious website. 2. Your credential can't be leaked by sloppy servers as it's public key crypto. This makes your security not depend on believing the website your logging into does proper password hashing and doesn't accidentally log password in plaintext.
      • freeAgent 2y ago
        Most password managers tie credentials to domains. In fact, this is a good indicator of possible phishing attempts when your password manager doesn’t offer to auto-fill your expected credentials.
    • nottorp 2y ago
      > Passkeys only encourage the need for a password management tool The dependency on a password management tool. Be it Yubikey or Apple secure enclave or whatever, it's a shit piece of hardware that will eventually break. Have fun replacing all your credentials at the same time when your phone dies.
• airtonix 2y ago
  [dead]
• nurumaik 2y ago
  Why couldn't passkeys just be a user-friendly wrapper around assymetric key pairs tech people already using?
  • Shank 2y ago
    That’s basically what they are?
  • michaelt 2y ago
    They kind of are, except... 1. SSH keys, as they're normally used, let you be tracked between hosts. That's fine for SSH, because nobody's trying to SSH into their Grindr account. But for web login stuff you want a different key pair for every site. 2. Adds a bunch of 'attestation' features that corporate types think they need. 3. Tries to make it so an attacker who gets access to your machine can't make a copy of the credential. The success of this is implementation-dependent. 4. With barely any setup, Google/Microsoft/Apple will keep a backup copy, in case you lose your phone. This is useful for non-technical people.
    • FdbkHb 2y ago
      > With barely any setup, Google/Microsoft/Apple will keep a backup copy, in case you lose your phone. Not Microsoft. Their implementation has no synchronisation feature and provides no way to back it up or transfer to another device either. You lose the computer you lose the passkey. Their implementation is very daft and goes counter to the point of passkeys since you will need a less secure way of authentication to remain enabled on the accounts you use a Windows Hello passkey for, for the sake of being able to recover those accounts. Remember, the best security schemes are only as secure as the least secure scheme that is available to access the account. If you're still on an account that can be recovered by sending a 2fa code to email or SMS/texting then you have achieved nothing.
• frizlab 2y ago
  My biggest issue with passkey is not passkey itself, which, when it works, is great, but more the implementation of it done on most websites. Use a passkey on https://www.passkeys.io https://www.passkeys.io and it works great! On google too. But use it on PayPal, it does not anymore. Who’s to blame?
  • larsnystrom 2y ago
    I've added a few passkeys to 1Password. It works pretty well on github.com, and sometimes on google.com. But apparently, passkeys.io bypasses 1Password and asks the OS for passkeys? So passkeys.io doesn't actually work for me, unless I want to store the passkey in the OS keychain. Which I don't, because I don't want to be locked into that. How can it be that the website decides which password manager I should use to store the passkeys? That's crazy and goes against all intuition.
    • vbezhenar 2y ago
      My assumption is that there's no proper browser API for third-party passkeys, so this extension probably monkey-patches website JavaScript which is not reliable.
    • frizlab 2y ago
      Interesting. What OS/browser do you use?
    • FlxMgdnz 2y ago
      Hey, founder of Hanko.io here, we run passkeys.io. That behaviour is not intended. We've recently changed the demo to require authenticator attestation on passkey creation, that may have an impact on authenticator selection. But a quick test on my system (macOS, Chrome) resulted in the 1Password UI intercepting the "Create a passkey" flow - as expected. It would be awesome if you could help us understand why your experience is different. With that being said, we are not happy with how password managers have implemented passkey intercepts, but ultimately that's a decision the user can make, as it can be disabled in the browser extension settings.
  • 2y ago
• graton 2y ago
  As someone who happily uses Yubikeys, I really don't want to use a Passkey. I want to still use a username/password and the Yubikey. Not just username and Yubikey. Google tries to force use of passkey now that if you enroll a Yubikey it will now be a Passkey, instead of a second factor. With no option to disable it. I have to run the Yubikey Manager tool and then disable "FIDO2", so that I can force it only be used as a 2nd factor.
  • Jnr 2y ago
    Yubikey + PIN works as a very nice passkey
  • eloeffler 2y ago
    You can open your Firefox about:config and set security.webauthn.ctap2 to false. This will cause a fallback to FIDO/U2F where possible and your browser will appear to not support FIDO2. I've observed this with the default Keycloak flow for Security Tokens. May be a bug, too... I don't know if this works with Google but if you try it, let me know :) This needs no restart of Firefox, so you can use it to quickly disable it instead of fully disabling it on your Hardwaretoken.
  • stavros 2y ago
    > I want to still use a username/password and the Yubikey. Why?
    • brabel 2y ago
      Definitely not for security... so yeah, seems quite pointless.
    • crote 2y ago
      Because of the whole "multi-factor" thing, and not making account recovery impossible? Passkeys are always going to be less secure than username + password + Webauthn, why would you intentionally make your account less secure and give yourself a massive failure mode in the process?
      • 2y ago
• karlkloss 2y ago
  Did you know that you can turn every $2 Raspberry Pi Pico clone board into a FIDO2 stick, and even make it Yubikey compatible? https://www.picokeys.com/ https://www.picokeys.com/ Well, not as secure as a commercial key, because the Pico doesn't have encrypted storage, but still much more secure than login/password.
• hlandau 2y ago
  I've never tried to use passkeys, but determined a while ago my hard, non-negotiable, a priori requirements which would have to be met for me to be willing to use them: 1. I can, if I choose, have a passkey in software (no hardware enclave, no captive key, no TPM) even if the security of that sucks: => Implication: I can backup and copy a passkey without restriction, e.g. putting the key material in an airgapped password safe, and without that being visible to a website. => Implication: Websites can't discriminate by whether I have a passkey in software or have any part in deciding whether I get to backup, copy or transfer a passkey. 2. I can disable any attestation functionality to do my part to prevent any online service from making it mandatory. I haven't looked into this yet, so: do, or can, passkeys, or the contemporary WebAuthn implementations in Firefox or Chrome on Linux, meet my requirements?
  • ezfe 2y ago
    1Password includes Passkeys in archive/exports of the 1Password database. Safari developers have stated that it is a planned feature to support Passkey exporting (but not currently supported) including between apps. I'm not aware of any restrictions at this time on your second point. I also haven't seen any examples of attestation and Passkeys being used in practice.
    • vluft 2y ago
      > 1Password includes Passkeys in archive/exports of the 1Password database. They explicitly do not.
      • ezfe 2y ago
        That's new, in the past I tested and was able to export my database and it included the Passkeys.
  • TacticalCoder 2y ago
    > I can backup and copy a passkey without restriction ... We were so very nearly there with U2F... I did extensive testing and you can have a U2F (Fido2/webauthn) device deriving it's private keys, never leaving the device's HSM, from a BIP-44/BIP-39 seed. You write 12, 18 or 24 words down (out of a dictionary of 2048 words) and with these words, you can always reinitialize another Ledger Nano (a cryptocurrency hardware wallet but I didn't care: I was after the U2F "nano app"). It just worked. It was beautiful. My seed were written on paper sheets which I'd store in a safe at the bank / at my parents' home, etc. As a bonus the hardware device would display, on its little screen, if you were enrolling or login (a useful info) and, for known provides, it'd display the name. For example "login to google?" / "enroll to dropbox?". Pure beauty. Then sadly this trainwreck that passkeys are happened, greatly lowering not only the security of 2FA (someone is in control of all your keys and they can be "backed up": what a concept!) but also making you lose the ability to backup your own keys/seed. I do really hope at some point we see a future "passkeys nano app" for hardware devices on which the user is in control of the master seed used to derive the keys. It worked for FIDO2/webauthn. I hope it'll work again at some point in the future for passkeys.
• donatj 2y ago
  The problem with passkeys, beyond the painful UX that will scare any casual users away and the fact that they are being wielded as an extreme vendor lock-in mechanism is just that the design and implementation is so over complicated with second system syndrome. If you’re going to push a replacement for passwords and want it to be universal, it should be EASY to implement. Even if the backing cryptography is complex, the actual handshake / implementation shouldn’t be. TOTP as an example is insanely easy to implement. Password auth of course is as well, despite needing to know what you are doing to get it right. Both can easily be handled entirely without JS. I should quite frankly be able to just <input type=“passkey-public-key”> in a standard POST form for registration and be able to call it a day. It doesn’t justify how complex it is to set up. A fitting password replacement should just be as smooth and easy as ssh. I give a website a public key, I use my private key. I manage my private keys however I see fit. I don’t need a third party involved holding my private keys hostage.
  • Mindless2112 2y ago
    If you want passkeys without Javascript, leave a thumbs-up on [1]. [1] https://github.com/w3c/webauthn/issues/1255 https://github.com/w3c/webauthn/issues/1255
    • donatj 2y ago
      Good to know, thank you for the link!
• joshstrange 2y ago
  I’ve avoided passkeys so far because I just don’t have a good mental model of them. All my passwords are randomly generate and stored in a password manager so I really haven’t felt the need to switch or felt constrained by my existing set up. I fully understand username/email + password and remembering the pain of things like “app specific passwords” makes me worry that some tools (open source, cli, etc) might not integrate well with password less so it’s best to stay where I am until things settle out better.
  • geertj 2y ago
    Nice phrasing, I lack that mental model as well. Anyone here willing to distill down the whole thing to a few sentences? Who stores what kind of secret, and is there some kind of challenge/response at auth time?
    • triblemaster 2y ago
      A physical device which is not your computer stores some secret information which can authenticate you. This can be passwords, passkeys, GPG keys, your retina etc. The physical device can be password protected. So you have two step authentication: 1. your physical device 2. your password to that device Phones are currently being promoted for various reasons, but I believe something like Yubikeys or other FIDO2 fobs will be a better device. You can have multiple of them, you can store one of them in your bank safe. Someone stealing it of you is proper theft which can be traced in a usual manner by police. Stealing is not enough because you still need the password. The difficulty of asking you for password remains equal to difficulty of hitting you with a wrench. You don't need to remember stuff anymore, because you can just use your physical keys. You will need to travel with those keys, but its just same as your house keys. It is probably an extra key in your key fob. To add to it, the U2F/FIDO2 standard will make it vendor independent, and so no lock-in.
      • vbezhenar 2y ago
        Safari on macOS uses passkeys without phone. So unless you consider security chip inside macbook a separate device, that's not true, that's just one of modes.
• cosmosgenius 2y ago
  I wanted to use Passkeys from the initial spec stage. The UX seemed far more superior (the closest I think is passwordless via email). But the more I wanted to use Passkeys are more scary it got, basically the gut feeling of losing control. If we could use something akin of derived, reproduceable-ish (???) Passkeys maybe then. As of right now it feels wrong.
  • cosmosgenius 2y ago
    (derived, reproduceable-ish) sounds like a security horror O_o.
    • knallfrosch 2y ago
      You can set up a new Ledger (crypto wallet) and deterministically recover your keys using a sheet with 24 words written on it. I've got my sheet in my gun safe, but you can also hide it anywhere in your house.
• jchw 2y ago
  Yeah, unfortunately passkeys are confusing and the UX is generally fucking awful. I hesitate to just blame the tech companies for being greedy, as a result of my experience with passkeys I'm starting to wonder if maybe they've legitimately just lost the skills and knowledge necessary to actually make usable software. What's most disappointing is, password managers have already solved the problem of syncing credentials securely between multiple devices across different form factors and ecosystems, and they're perfectly usable for providing software passkey support. So of course.. there's no standard API for them to implement it. Instead, vendors are patching the WebAuthn APIs using WebExtensions. This is sabotage.
  • arianvanp 2y ago
    FWIW: MacOS and iOS allow third party password managers to ingrate directly into AuthenticationServices and list passkeys in the native passkey UI through a "Credential Provider" extension. And it's documented how: https://developer.apple.com/documentation/authenticationservices/ascredentialproviderviewcontroller https://developer.apple.com/documentation/authenticationserv... This is the same Credential Provider API they already have to integrate with to show the password autofill in iOS so there is already _some_ code for this. 1Password _could_ just integrate with the native UI. But they chose not to. This however means shipping a native app which is a lot more heavy-weight than shipping a web extension. I opened an issue in the webauthn repo about giving an API for WebExtensions to hook into the passkey autocomplete but there hasn't been any traction or appetite for it unfortunately :( https://github.com/w3c/webauthn/issues/1976 https://github.com/w3c/webauthn/issues/1976
    • jchw 2y ago
      > 1Password _could_ just integrate with the native UI. But they chose not to. This however means shipping a native app which is a lot more heavy-weight than shipping a web extension. I mean, I kind of understand this; they're going to have to do the WebExtension either way, since there's no standard API across platforms.
      • arianvanp 2y ago
• G3rn0ti 2y ago
  Hm. The main criticism is you get locked into a cloud platform storing your private key(s) when using „passkeys“. This can be convenient as you can use your favorite smart phone to authenticate everywhere or even choose to rely on local TPM storage on your laptop or PC through MS Windows. This trades convenience with the risk of a vendor lock-in. But AFAIU the FIDO2 protocol you are free to use a dedicated USB key storage instead to store your private key (protected by a PIN or passphrase) on your own. This a bit less convenient but gives you peace of mind if you hate MS/ABC/Apple.
  • tux3 2y ago
    >you are free to use a dedicated USB key storage instead to store your private key As long as the server supports the device/protocol/options you want, and doesn't enforce attestation against a small list of enterprise vendors. For instance Microsoft Azure AD's Entra ID authentication service, the one that keeps changing name, has a hardcoded list which you can consult here: https://learn.microsoft.com/en-us/entra/identity/authentication/concept-authentication-passwordless#fido2-security-key-providers https://learn.microsoft.com/en-us/entra/identity/authenticat... In theory there's no vendor lock-in. As long as Azure adds your vendor to the Azure-approved list, and as long as every other provider refrains from making their own list. For the Apple/Google ecosystems specifically, it's also important to keep the compatibility matrix for each service in mind. For instance with Azure again: https://learn.microsoft.com/en-us/entra/identity/authentication/concept-fido2-compatibility https://learn.microsoft.com/en-us/entra/identity/authenticat... In theory any FIDO2 implementation could work with any service that accepts passkeys. In practice, compatibility matrices and allowlists are the reality.
• dudeinjapan 2y ago
  At TableCheck we rolled our own passkeys SP implementation primarily for our internal users, so they can access admin-level accounts without passwords. Personally I love the convenience of passkeys (coupled with 1Password pw manager), however, for whatever reason it doesn’t “feel” like Passkeys replace passwords but rather they complement them. I treat Passkeys as ephemeral—it is lovely when they work, but sometimes I still need to fallback to trusty ol’ password login.
• PaulHoule 2y ago
  Passkeys always had a bad smell to me.
• crabbone 2y ago
  Somewhat related: last New Year the company I work for gave us, the employees, presents. Something I assumed to be a USB disk. Couple weeks ago I had to migrate from my old personal laptop to the desktop I finally put together and needed a USB key to put an OS on the new computer. I recalled I had what I thought was a spare USB key... plugged it in only to discover it wasn't a USB disk. Wasted some time trying to figure out what it was only to discover it was some form of electronic key. Not sure how exactly it works... but, of course, Linux had no drivers for it, so it couldn't even recognize the device. I tried to think about any possible uses I could want from it and whether it's worth the effort of trying to find an out-of-kernel driver for it... and after some time pondering this idea, I realized I have no use for this thing. There's no scenario in which I would like to have a device to perform this function. So, bundled it with the broken pieces of my old laptop and together they went to the garbage dump. Passkey would be virtually the same thing. I cannot imagine what problem does it solve, no matter how it works. Everything about this idea seems like a bad idea. So, I'm kind of happy it's a shattered dream now. Better late then never, I guess.
• crote 2y ago
  The part I hate most about Passkeys is that it essentially killed the FIDO1/U2F ecosystem. Just about every website which implemented Passkeys removed the option to use hardware tokens with "non-resident" credentials. This means you're stuck using your Yubikey as either an insecure TOTP token, or as a practically-useless Passkey. We had the perfect 2FA method with U2F hardware tokens, why did they have to take that away?!
  • TacticalCoder 2y ago
    > We had the perfect 2FA method with U2F hardware tokens, why did they have to take that away?! It deeply saddens me too. But I think we shouldn't discard one of the obvious reason: the U2F system was too secure. Let's not forget this: the original U2F system even had a way for the user to know if its device had been cloned, for they'd be using a counter. And they silently removed this. When Apple+Google+MSFT team up to lower security, I'm pretty sure three-letters agencies and their backdoors aren't very far. The whole concept of passkeys that can be copied around is honestly hilarious. FFS: we had the perfect solution... I don't think it's only incompetence at work here: there has to be mischief or at least mischief shouldn't be discarded.
    • MarkMarine 2y ago
      Passkeys are a godsend when compared to weak passwords and SMS 2FA. Try to think through how to protect a bank account or retirement account for the average consumer, some banks send you a OTP and have you read it back to prove who you are when you call CS, some think the OTP is sacrosanct and will never be read back. I 100% agree with you but there has to be something for regular consumers to safely log into a website that may have 10s or 100s of thousands of dollars on the other side of it, and be secure.
  • Ferret7446 2y ago
    > Just about every website which implemented Passkeys removed the option to use hardware tokens with "non-resident" credentials Which ones? AFAIK they support passkeys in addition to password+U2F 2FA
• kmlx 2y ago
  > Apple Keychain has personally wiped out all my Passkeys on three separate occasions. There are external reports we have recieved of other users who's Keychain Passkeys have been wiped just like mine. i have been using passkeys on apple since they launched it. i have also converted all of my 2fa’s to passkeys (where supported) or enabled them as password alternatives. a lot of website support passkeys nowadays. i never encountered what the author encountered and it seems like something seriously wrong happened. did anyone encounter this issue? is it logged somewhere? i seriously considered dropping passwords completely for future projects, but it looks like there are still issues…
• aktuel 2y ago
  This was so obvious from the start. Whenever big tech creates "standards" now you already know it's going to be total horse shit. Look back at the old threads when passkeys launched. HN was full of fanboys thinking it's the best since sliced bread and passwords are so yesterday. Managing your passwords takes a bit of effort like everything in life where you don't want do give away control completeley to some corporate aholes. Whenever you let someone else manage your stuff you set yourself up to getting ducked.
• nottorp 2y ago
  Translation: the solution is overcomplex and has so many failure points that it has already proven to be worse than passwords.
• AlexandrB 2y ago
  I've noticed a few websites I frequent have quietly started using passkeys (or something very similar) outside of the normal channels. My bank now asks me to go through a second factor on my phone app that seems very similar to how passkeys work and Outlook has a similar login flow but with an additional 2 digit challenge code for some reason. With both of these I have little sense of what is going to happen if I lose my phone or switch to a new one. So typical passkey problems.
• 8organicbits 2y ago
  I gave up on passkeys after running Google's passkey demo and getting started example. They impement session expiration client side only. I reported it, but they said it had been reported already and they didn't intend to fix it. Seems a little careless for a tool promising improved security.
• noirscape 2y ago
  The main thing that hurts Passkeys was how the implementation was so deeply tied to letting the browser do stuff rather than making it something like TOTP where any password manager can implement it and it's usable, agnostic from the browser. Everything about Passkeys is defined around using your browser as the agent that authenticates. The problem is that browsers are infamous for randomly losing things like localstorage, settings and saved passwords. It's way too volatile software to do authentication with besides a "stay logged in" checkmark. In both of the main desktop browsers, a corrupt profile is often only "fixable" by just nuking it and having the browser recreate it. That's what killed Passkeys; people you want as early adopters (technical folks) don't use it because browsers aren't a trustworthy storage and the implementations all severely stalled in providing alternative methods that are tied to more reliable storage mechanisms. The hyper aggressive vendor lock-in is also not helping much (to the point where KeePassXC got yelled at for providing an export mechanism).
• shepherdjerred 2y ago
  Here's my opposing view: I love Passkeys. I use Firefox as my browser and 1Password as my password manager. On my iPhone, I use 1Password + Firefox. I look at https://passkeys.directory/ https://passkeys.directory/ every so often and switch my logins from passwords to passkeys. This has included a lot of my common logins like GitHub, Google, and Microsoft. There is a lot of confusing terminology. For some reason sites will say "login with Touch ID" or "login with Windows Hello" instead of "login with Passkey". Aside from that quirk, I love it. 1Password syncs my passkeys between devices. I can use them both on my laptop and my phone. It would be inconvenient if I needed to login to a shared computer e.g. at a library or friend's house, but I don't do that often enough to care (though of course some people do, which is totally valid).
  • sedatk 2y ago
    I went through passkeys.directory site and it's underwhelming. Too few sites implement it, and many implement it inconsistently: - PayPal only allows one passkey and don't support logging in with it on Firefox on Windows. You still have to use your password. - Twitter only offers it if you pay for a subscription. - Playstation Network doesn't implement usernameless, and still asks for your email to log you in with a passkey. It seems like we still have some way to go before we figure it all out.
    • shepherdjerred 2y ago
      > It seems like we still have some way to go before we figure it all out. You're 100% right, though I'm actually surprised that so many sites already support passkeys. If passkeys is a good idea and consumers use them, then gradually sites will shift over. Changing how everyone in the world does auth is not going to happen overnight, or even in a year.
  • kstrauser 2y ago
    I’m with you on that. Also, 1Password’s built-in Watchtower tells you which of your saved accounts could have passkeys added to them.
  • mrinterweb 2y ago
• butz 2y ago
  Why did it took so long to figure out that passkeys was a bad idea?
  • CatWChainsaw 2y ago
    Because if something is new, then it's automatically better, even if it's not, so it gets a hype cycle. Honestly I'm just relieved this appears to be crashing and burning on the runway. Crypto bullshit's gone through several destructive hype cycles by now and the main consequence of the latest round of the AI craze will be a nuclear wasteland of an internet.
• icf80 2y ago
  passkeys are ok, but passwords should also be an option if you want only passkeys is a problem
• m3kw9 2y ago
  You use it because a concensus of security experts is cool with them, a normal person has no way of analyzing it properly. I see a few post regarding “I rather stick to generated passwords and have a program memorize it for them” it’s rather funny the way they rebuke new vetted tech
• powera 2y ago
  Please, stop with the "anything that happens that I don't like is enshittification" trend. Please.
• m3kw9 2y ago
  Passkeys has a good UX and security balance. The other method would be to memorize a 20 length random password all inside your head or let grandma create a “password” so she can easily memorize it.
• exabrial 2y ago
  How about we stop reinventing the fricken wheel every 3 years and let users adopt something? U2F keys were pretty danged good and they were easy to explain to my 70 year old parents "This is like your front door key to your house, it's a physical key to your Google account".
• formerly_proven 2y ago
  > Within enterprise there still is a place for attested security keys where you can control the whole experience to avoid the vendor lockin parts. It still has rough edges though. Just use PKI / X.509 with hybrid smartcards for enterprise use cases. Sure, it’s “legacy” and you need an PKI expert to set it up, but it actually works and is genuinely platform-, vendor- and protocol-agnostic. FIDO is smelly poo poo in comparison. Also, smartcards had usernameless for 30 years. Edit: actually we’ve been here before. Remember the <keygen> tag? Platforms (browsers) could generate a key pair for you, store the private key in their key store (I think <keygen> actually supported smartcards as well), and forward the public key to the server for enrollment. The server then sent the signed certificate back. That’s pretty much exactly passkeys. This was somewhat widely used for “high security” applications at its peak, circa 2007. Similar problems like passkeys caused issues, it was difficult for users to get their keys and back them up, most people were just one hard drive crash away from loosing access.
• jslakro 2y ago
  I suppose this means OTP's would continue gaining traction as an alternative to password managers, a convenient approach but a risky single point of failure
• tunesmith 2y ago
  Every time I see a long inscrutable discussion about Passkeys, I see a weird avoidance of the "something you know" part of security. Here in the US, courts and law enforcement have every right to get your username, fingerprint, retina scan, face ID, whatever. But they don't have the right to extract something from your brain. Unless I'm missing something basic (which at this point, I don't think is my fault since this whole thing appears incredibly difficult to explain), Passkeys skips past that whole thing in favor of making it a heck of a lot easier to replace "something you know" with "something you have". Which is a security nightmare.
  • victor106 2y ago
    > But they don't have the right to extract something from your brain. Most folks store passwords in password managers and don't use their brains to retrieve them.
    • SkyPuncher 2y ago
      But my password manager locks….requiring something stored in my brain.
      • Fire-Dragon-DoL 2y ago
        Doesn't your password manager use biometrics to unlock though?
        • fabrice_d 2y ago
          Not necessarily. I use bitwarden with a master password to unlock the vault.
        • doubled112 2y ago
          I stick with passphrases so nobody steals my retina or thumb.
        • SkyPuncher 2y ago
          Yes, but that’s locked behind an OS level pass screen.
• jgalt212 2y ago
  > when the room is in a country that has a list of travel advisories including "Violent crime is more common in the US than in Australia", "There is a persistent threat of mass casualty violence and terrorist attacks in the US" and "Medical costs in the US are extremely high. You may need to pay up-front for medical assistance". What's wrong with these Aussie technocrats?
• skybrian 2y ago
  I don't trust passkeys, and yet so far, I'm not bothered by them. This is because I use them as an additional way to log in. The other day I noticed that for some reason GitHub couldn't seem to find my Android passkey. Weird. So I logged in using my Yubikey and recreated it. But this would be a lot worse if it were your only way of logging in. Always have multiple authentication methods for important accounts.
  • sedatk 2y ago
    You can have multiple passkeys (using different devices or passkey providers) for a single site too. You don't need to fall back to another login mechanism.
    • skybrian 2y ago
      Yep, that too. It's especially convenient if you have both iOS and Android since you can easily log in using either.
• FlxMgdnz 2y ago
  The solution to most of the author's criticisms lies in not forcibly mixing Passkeys and WebAuthn-based 2FA. As long as you are satisfied with passkeys being "usernameless" (i.e. discoverable), you can offer a nice login flow with a "Sign in with a passkey" button and Passkey Autofill. For 2FA use cases, you should provide a second WebAuthn configuration that does not require discoverable credentials, for example, and does not necessarily require user verification. This allows a user to have both fully-fledged passkeys and, for example, security keys as a second factor to secure username/password-based login. Users can choose what they want to do (create a passkey on e.g. iCloud or add security keys as 2FA without using precious key storage resources on the hardware tokens). GitHub has done a very solid implementation of that model, and we are working on adopting it to our services and it's looking very good so far.
• qudat 2y ago
  Likewise frustrated by the passkey implementation but like the idea. I’ve been experimenting with passkeys leveraging SSH tunnels. You can read more about it with a demo here: https://pico.sh/tunnels https://pico.sh/tunnels
• throw7 2y ago
  Just wanting to get rid of "passwords" means getting rid of "something i know" as an authentication factor. That should not be the goal. The issue is that the other authentication factors have real drawbacks. It's tradeoffs all around. 'something i have' means carrying something around and also the possibility of it being forgotten/stolen/broken/taken by authorities (legally even!) and the repercussions of that. i'm fine with this, only if i am allowed to access/export/copy/store the keys myself. I can do that with totp auth and i do. people say this "breaks" security. but the point is: i control what i own; i control me (not you). 'something i am' has the worst drawback. you can't change it! the other issue is you are not the unique snowflake you think you are. Also, side note of a personal experience: India has mass fingerprinted everyone, yet in trying to do some bank transactions in India the fingerprint read/auth kept failing for an acquaintance.
• 0xbadcafebee 2y ago
  There is no auth panacea. There's too many different use cases, too many players involved. You cannot create one "thing" that solves all the problems for all the people. It was hubris. Instead, if "the industry" wants to solve "the problem", they need to write down all the use cases. Then we can argue about how to do that, and the result will probably be a couple different things that solve a couple different groups of use cases. But what will always suck is letting "the industry" dictate to us "tech peons" how that should happen. They always come up with bloated standards that are a pain in the balls. So rather than let "the industry" solve the problem, I think we need a loose confederation of open source contributors and corporate goons to meet on some forum somewhere and hash it out. Let the solutions (plural) come organically without a single player controlling the conversation.
• bloppe 2y ago
  This feels overly cynical to me. The article is a bit rambly so let me try to distill the problems: 1. Most relying parties support resident keys only. This makes a bad user experience because users are surprised when they run out of space, and may have to wipe their device to get more. 2. Most authenticators do not allow you to export your keys. If a relying party only allows a single credential per account, this creates authenticator lock-in, which is a bad user experience. 3. Chrome is uncooperative about the Authenticator Selection Extension, and that can make a bad user experience if the relying party rejects the device attestation after enrollment. Yes, these are all bad user experiences, but they don't indict the technology. It sounds to me like the relying party can mitigate all of these issues: 1. Support non-resident keys. Seems like it really doesn't have to be a bad user experience. Usernames are easy to remember. Just use their email address. 2. Support multiple keys per account. Most users will have multiple authenticators. Let them enroll several and they're not locked into any one in particular. Most users won't care about this, but for important services it's an option. 3. As a relying party with strict authenticator requirements, just explain those requirements on the passkey registration page. People can read. They don't have to be that confused when their unsupported key doesn't work. I get that there's nothing users can do when the relying party creates a bad experience, but if a relying party has all the power to create a good experience, is it really worth being this gloomy about the technology?
  • skywhopper 2y ago
    If the underlying technology is poorly specified and confusing enough that it doesn’t get implemented well in 95% of cases, then yes, that does indict the technology. See also: PGP and email encryption in general. But even if on balance the tech is worth implementing, it’s clearly not easy and your suggestions to “just” do several things that aren’t happening ring a little hollow.
    • bloppe 2y ago
      I only used "just" twice, and they were both justified. Having people remember their email addresses, and explaining something in a couple of sentences, are both pretty easy. Points #1 and #2 are not entirely trivial, but they're not much more complicated than the alternatives. A relying party has to store the public key counterpart to a user's private passkey no matter what. Is it really that much harder to associate that public key with their user ID? Point #2 is probably the hardest to overcome if you already baked in the assumption of 1 key per user. That's concerning. But that problem can also be mitigated by the authenticator, by supporting export. I'm not saying the article fails to identify real issues. I'm saying it fails to identify insurmountable issues. The nice thing about software is that a good canonical implementation can be used by everybody for free.
• tonymet 2y ago
  Tech articles have gone the way of online recipes. I had to read his grandfather's biography to understand he had a bad experience logging in with passkeys
• DavideNL 2y ago
  > "If you really want passkeys, put them in a password manager you control. But don't use a platform controlled passkey store" That is my main reason for avoiding Passkeys; I will only use Passkeys, when i can export/backup them easily and store an offline backup, without depending on some Big Tech company or whatever. (KeepassXC can export them, but not sure if it's released and fully functional in the stable build yet.) What also worries me however, is that apparently if i read correctly, each server/service/website can decide/restrict "which password managers/apps" are allowed to be used for the Passkeys they offer...
• mantra2 2y ago
  “…if you do want to use a security key, just use it to unlock your password manager and your email.” This feels like the best advice, imo.
• chrisjj 2y ago
  > Just like ad-blockers, I predict that Passkeys will only be used by a small subset of the technical population Hmm... "As of Q3 2021, 37.0% of internet users worldwide use ad blockers, according to GWI data cited by Hootsuite." https://www.emarketer.com/insights/ad-blocking/ https://www.emarketer.com/insights/ad-blocking/ "
• jrm4 2y ago
  Yeah, good riddance. I get the capitalist inclination and desire to make things easier for people (and often infantilize them) but this just ain't it. There is no easy solution here. Security is difficult and there are no shortcuts that involve "make things easier for the general public" that don't ALSO involve "make things MUCH HARDER (either in complexity or LIABILITY for getting it wrong) for the company providing the security."
• nivenhuh 2y ago
  For folks who don't know how passkeys work at a technical level, take a look at this implementation guide: https://webauthn.guide/ https://webauthn.guide/ I don't get the passkey hate -- moving to public key challenge for authentication is a strong step forward for web security. Each browser / OS safeguards & backs up the private key (and even if that's lost, you can still reset your auth credentials using a normal "forgot password" flow).
  • jjav 2y ago
    > I don't get the passkey hate The linked article does a quite good job explaining why hating passkeys make sense. Here's a key quote, but I do recommend reading the whole article. > Since then Passkeys are now seen as a way to capture users and audiences into a platform. What better way to encourage long term entrapment of users then by locking all their credentials into your platform, and even better, credentials that can't be extracted or exported in any capacity.
    • tadfisher 2y ago
      I don't believe this is necessarily true, as far as intent goes. I think Apple and Google focused on a core use case, shipped it, and subsequently lost interest or fired everyone involved. Unfortunately, this scenario is indistinguishable from one in which they deliberately mishandled the specs in order to lock in users.
      • skarra 2y ago
        Thanks for your faith. I work on the team shipping passkeys at Google. We are very much hard at work to realize the full potential of passkeys. Platform lockin serves no one. That is no one's intent - independent password managers storing passkeys is already a thing today. More interop will come once relevant standards are blessed.
        • jiggawatts 2y ago
          I’m sorry, but you’re either naive or lying. This is precisely like the imaging standards trying to replace JPG. After two decades of vendors like Google trying to establish a new standard, I can’t send anything other than an SDR sRGB JPEG to anyone, especially to an Android user. The current post-JPG formats may as well be called “the Apple format”, “Google image”, and “Netflix pics”. There is no practical interoperability to speak of. I’m seeing the exact same dynamics play out with PassKeys: lip service to interoperability, meanwhile consumers are left twisting in the wind, locked out of their lives because Google can’t play nice with Apple. Or Microsoft. Or anyone else. “Interoperability is coming” is a statement in the same category as communist dictatorships promising true socialism and freedom… you know. Eventually. Just not now. Or next year… maybe later.
• kobieps 2y ago
  When Apple announced passkeys it was obvious that this would be the end result. I remember quite clearly complaining to a friend of mine at the time.
• latchkey 2y ago
  I just went through the dance of logging out of all my google accounts and then logging back into them. While I was doing that, I added passkeys as a security layer. Using bitwarden, it adds them in just fine. But, if you go and try to log into a Google account with Brave, it tries to use the Brave system builtin instead of the Bitwarden one. Presenting a dialog too. As an end user, I don't know if it is bitwarden, brave or google screwing this up and I can't be bothered to figure it out, so it is back to just using passwords and 2FA...
  • cchance 2y ago
    Just add a passkey for brave too
    • latchkey 2y ago
      No, I don't want to be tied to a single browser for my passkey, what happens if I want to log into a site on my phone using safari or chrome? I also don't want it tied to my apple keychain. What if I want to share my passkey with my partner?
      • cchance 2y ago
        lol it’s a passkey… why would you want 1 that can be shared and… lost you just register another one Being like “I don’t want to add another passkey” is really a semantic issue what exactly is the difference to you or adding a passkeys to an account vs copying a passkey to another device except the fact that if you can copy it/share it… it’d be far less secure with more ways to leak
        • latchkey 2y ago
          > why would you want 1 that can be shared My partner and I share a single account for XYZ service. We don't want separate accounts. > it’d be far less secure with more ways to leak There is nothing "less secure" with sharing an account credentials with my partner through bitwarden. Especially for accounts that are things like "pay my electric bill" or "online shopping".
• Izkata 2y ago
  > This library ended up with Kanidm being (to my knowledge) the very first OpenSource IDM to implement passwordless (now passkeys). The experience was wonderful. You went to Kanidm, typed in your username and then were prompted to type your PIN and touch your key. Simple, fast, easy. > For devices like your iPhone or Android, you would do similar - just use your Touch ID and you're in. The fingerprint scanner on my phone is so finicky this would've been a dealbreaker from the get-go. I regularly have to just enter my PIN because it refuses to recognize my fingerprint.
• jdthedisciple 2y ago
  This was foreseeable. Sometimes you just know when a thing isn't practically feasible. https://news.ycombinator.com/item?id=36717356 https://news.ycombinator.com/item?id=36717356
• MarkMarine 2y ago
  I am fully invested in the Apple keychain ecosystem, I’ve got multiple Apple devices (laptops and a phone) and passkeys have been incredible. Haven’t seen any of these issues. I can understand the frustration from the author’s point of view, but I live with the other side of 2FA through weak SMS every day. My users can easily be tricked into giving up their 2FA code while being social engineered, and passkeys offer me as a developer a way to give them a more secure solution that I don’t have to worry about them reading aloud to someone calling and pretending to be CS. This is a weakness in the core of 2FA via SMS, and the author seems to be just hand waving away from that. No one SIM swaps their way to compromising a passkey, and no user can share their passkey with a scammer as far as I know.
• userbinator 2y ago
  To paraphrase a well-known saying: Those who don't understand ISO7816 are doomed to reinvent it, poorly.
• awwwithy 2y ago
  It seems like most of these gripes are due to the web app's implementation, and not passkeys themselves. It's a bit harder supporting multiple passkeys, but certainly doable. As others have said, this is just FIDO2/WebAuthn.
• sircastor 2y ago
  I like the idea of Passkeys, but the implementation of them being exclusively tied to my super account of Apple or Google makes me very cautious. I’ve read too many stories about automated systems killing someone’s account and the resulting havoc. I understand that, in principle it’s your device, and not your account, but it feels like the fingers are too deep to hand over one more thing. Adjacent to this, I really liked Steve Gibson’s SQRL. I wish that had taken off.
• tempodox 2y ago
  > We missed our golden chance to eliminate passwords through a desire to capture markets and promote hype. Enshittification in a nutshell. The victory of greed over utility.
• notpushkin 2y ago
  I think passkeys can be used just like biometric authentication is used in mobile apps right now: you sign in just like you usually do (e. g. username + password + TOTP or something), then on subsequent visits you can skip that and go through passkeys instead. New device? Just sign in with a password again.
• nektro 2y ago
  good article and another reason why ppl really need to stop using chrome
• infotogivenm 2y ago
  I’m surprised no one has written a tool (probably would involve disabling SIP) to import/export passkeys on macOS. They’re in memory, right?
• BrandoElFollito 2y ago
  Authentication has become incredibly complicated for normal users. I work in cybersecurity and need to think hard and draw diagrams to understand how modern authentication systems work (modern = something more than passwords). The implementation part is hidden from users but they only understand "password". Sometimes "fingerprint". Anything above that is really tough. While Passkeys are an interesting development, it will take time before they are part of the authentication routine of standard users.
• lupire 2y ago
  Is passkey just OTP + vendor lockin because the vendors accidentally allowed OTP key export and are embarrassed about removing it?
  • jasode 2y ago
    >Is passkey just OTP + vendor lockin because the vendors accidentally allowed OTP key export No, TOTP and passkeys had different motivational concepts: - TOTP Time-Based-Onetime-Password of a "rolling numeric code" is conceptually similar to "trusted hardware" such as RSA SecurID tokens: https://www.google.com/search?q=securid&tbm=isch https://www.google.com/search?q=securid&tbm=isch - passkeys are conceptually similar to "trusted hardware" such as biometric USB vault from Yubikey that cost $50: https://www.yubico.com/product/yubikey-5-series/yubikey-5-nfc/ https://www.yubico.com/product/yubikey-5-series/yubikey-5-nf... ... or Nitrokey: https://shop.nitrokey.com/shop?&search=nitrokey%203 https://shop.nitrokey.com/shop?&search=nitrokey%203 In both cases, you can put secrets into the hardware but can't extract them back out. You can _use_ the secrets stored in the hardware via your fingerprint to facilitate logins but you can't extract/copy the digital data from one Yubikey to another Nitrokey. This restriction for USB vaults is deliberately designed for security but typically isn't disparaged as "vendor lock-in" However, increasing website security via "trusted hardware" by making everybody spend an extra $50 for a USB vault is not ideal. Instead, a bunch of security experts noticed that billions of people are already carrying smartphones that have built-in biometric security such as face-id and fingerprint readers. Ok, let's just piggyback on existing smartphones and make them "act like the $50 Yubikey/Nitrokey" -- which means mobile passkeys managers like Google not allowing simple export/copying of passkeys. Yeah but desktop managers like 1Password, Bitwarden, KeePassXC allow export of passkeys! True, but there's controversy and disagreement about that because they're not restricted like the Yubikey hardware is. Will some websites that are very strict reject some clients that allow passkeys export? It's a wait & see. If the "ideal" passkeys ("ideal" from the RP Relying Parties point-of-view) are for them not to exportable/transferrable to another device, how do they expect people migrate from Apple to Android or whatever? By generating new passkeys for that new device and adding it the list of approved passkeys the website accepts. Instead of transferring the secrets, you re-generate new secrets.
• JAKC056 2y ago
  Passkeys are being pushed by Government and Law Enforcement because PASSWORDS WORK and frustrate them. Police access 95% of the phones they seize so they want passkeys to be the norm because once they own the phone they own EVERYTHING you secured with passkeys. There is nothing wrong is passwords. There is everything wrong with biometrics. Wake up!
• augunrik 2y ago
  I use Strongbox and store my Passkeys in a Keepass File. Vendor agnostic, private syncable and locked by my passphrase. I like them and wish more services would implement them properly.
• _zoltan_ 2y ago
  I use 1password stored passkeys. Works. I don't care about the whining.
• SXX 2y ago
  Good riddance. Any system that limits my options as power user I will not promote. Lots of services only let you enroll single passkey and "hardware attestation" would only make it even bigger lock-in. I like passkeys as idea for stonger security, but author somehow thinks that discrimination against devices is a good idea. Sorry, no. Just no. I dont want my bank or paypal require me to use iPhone in order to login to my account.
• MollyRealized 2y ago
  I may be mistaken in its implications, but given the 9th Circuit's decision in U.S. v. Payne this week [1], I don't know if moving all our password knowledge to biometrics is a secure idea. [1] - https://arstechnica.com/tech-policy/2024/04/cops-can-force-suspect-to-unlock-phone-with-thumbprint-us-court-rules/ https://arstechnica.com/tech-policy/2024/04/cops-can-force-s...
  • CatWChainsaw 2y ago
    I suspect that's part of the eagerness to move everyone to passkeys.
• hnarn 2y ago
  I always set up two passkeys, one in iOS and one in bitwarden. I use the former on my phone (obviously) and the latter on desktop, in addition to “normal” logins with 2FA. I haven’t had a single issue yet, and while I accept that it would be annoying if iOS suddenly wiped my keys, I really feel like it shouldn’t matter: ideally you shouldn’t have only one passkey to begin with, but even if you lose it, all services I use still allow “normal” logins as long as you can 2FA with a phone number or email.