6 ms·

FWIW: I find passkeys to be a very simple and easy to use concept. Simple: it's like a password that I don't have to type in Easy to use: because I use 1Passw

by rsyring 2mo ago

FWIW: I find passkeys to be a very simple and easy to use concept. Simple: it's like a password that I don't have to type in Easy to use: because I use 1Password and just have it installed on everything. On Android, it can be set as the default passkey provider so, even on mobile, I am using passkeys shared across devices. Is this "less secure" because I'm sharing the keys through 1Password. I suppose, at some level. But before that, I was simply sharing passwords through 1Password in the exact same way. So, I don't think my security posture has changed any. What has changed is the UX and IMO for the better. Now I don't have to generate/fill/copy-paste text strings for user names or passwords. 1Password knows what site I'm on and usually responds automatically when I'm in a passkey context. If I have more than one passkey available, because I have multiple accounts (for something like Google Workspace), it shows me options and I pick the one I want. Honestly, it's mostly a "just works" system and I like it a lot better than passwords. YMMV, of course.

Tarq0n 2mo ago
OK now say you're on a work/library/friend's computer and you want to look up an account in 1password on your phone so you can type in the password. Passkeys don't support this very basic and common workflow. Meanwhile there's no real security benefit over password manager generated complex and not reused passwords.
- vel0city 2mo ago
  If I'm on someone else's computer and I want to use a passkey on my phone, the computer will display a QR code. I scan the QR code with my phone, the phone signs the login request and posts it to the service's callback. Then I'm logged in on that new device. If my phone's camera is broken but both devices have bluetooth, it can do the handshake over bluetooth. If I'm on someone else's computer and I want to use a passkey on my authenticator on my keychain, I'll just plug it in and then tap the button on the authenticator. Meanwhile, if I logged in with the password and the account only has a password then they have a full copy of my entire authenticator to the account. With the passkey, once the session is invalidated the access is gone.
  - doctoboggan 2mo ago
    Does the apple passwords app work this way (log in to a public machine by scanning a QR code?)
    - vel0city 2mo ago
      Passkey on an iPhone, logging into a public-ish terminal by scanning a QR code? Yes. In fact, if you have your Apple Passwords app set to sync through iCloud, you can: - Make a passkey on your Mac for a site in the Passwords app - Go to a different computer (a friend's or whatever) - Attempt to log in, choose use another device, it'll show the QR code - Use your iPhone to scan that QR code and sign in, as the iPhone has the passkey synced through iCloud Note, the same kind of thing is also possible with other password managers as well.
  - snailmailman 2mo ago
    This is good in theory but in practice doesn't always work. It isn't just a QR code like I would like it to be, its a QR code and you need bluetooth. Maybe there is a hypothetical world where bluetooth drivers actually work on windows machines and can connect to a mobile device seamlessly but that is not my experience. Across multiple windows machines i often have a problem where windows just decides the machine doesn't have bluetooth, and will refuse to display the QR code without any explanation. It doesn't tell you that bluetooth is the problem it just says "insert a hardware token to authenticate". I would love for this feature to actually work but every time I've needed it to it hasn't. Literally this week I only had a passkey on my phone, but at the time I was in Linux with Firefox, and afaict the qr code workflow basically requires either chrome or windows 10.
    - vel0city 2mo ago
      I use this feature a bunch across dozens of different Windows and Mac devices from various device vendors with multiple Android phones and seemingly never had an issue. But I'm also a person who generally never experiences the issues some people have with Bluetooth in general. If I ever have an issue with Bluetooth on a computer, I swap out the wireless chipset with an actually good one. Its almost always just bad hardware. I've only had to do that a few times in the last decade though, more modern WiFi/BT chipsets are generally pretty OK. Its the old ones that are near worthless. Although I will say most of the time I just plug in my USB authenticator. I normally only fall back to the QR code if I don't have my keys on me. And as an edit, I wasn't aware fully that the QR code is to help assist the BT handshake, I had assumed it was posting a signed request back to the service. My bad, my above comment isn't completely correct. Thanks for cluing me in to the BT requirement for the QR code path.
- voxic11 2mo ago
  I use a passkey with discord on my phone. If I want to log in to discord on a computer it shows a QR code on the page/desktop app and I scan it with my phone to log in. I could see this become a pretty common pattern. I like it because I can use discord on even a pretty untrusted computer without providing it any credentials or access to my passkey, and then later when I'm done I can revoke the session.
  - OJFord 2mo ago
    Ok but now do a service that doesn't support that, whether or not it might in the future 'become a pretty common pattern'.
    - jeroenhd 2mo ago
      On most websites logging in through QR codes works out of the box for passkeys. You usually click "log in with device" or something like that with every desktop OS. You scan the QR code, click the confirmation button, and you're signed in. It's part of the standard UI of normal operating systems. Might not work (well) if you're on an old computer without decent Bluetooth but everything has Bluetooth these days.
      - HelloUsername 2mo ago
        Why does a passkey need bluetooth? For what? Isn't that another vulnerability?
        jeroenhd 2mo ago
        A "passkey" is a bunch of metadata and a public/private keypair. It doesn't do anything by itself, of course. A physical device, like a Yubikey or a Titan, doesn't have Bluetooth. For phones and tablets these keys do support NFC but that's a whole different story. The Bluetooth connection is how your phone exchanges the key and authenticates you through the computer. In its most secure phone, the key never leaves the dedicated security hardware/trusted execution environment that protects your key from snooping, the same way you cannot get a physical U2F key to give you the private key bits. You scan a QR code to set up the pairing/connection process (if you haven't already), then a Bluetooth Low Energy exchange happens. You confirm you want to sign in on your phone (so you don't get tricked into scanning a QR code), then the cryptography happens that authenticates you. You can find the protocol here: https://fidoalliance.org/specs/fido-v2.0-ps-20190130/fido-client-to-authenticator-protocol-v2.0-ps-20190130.html https://fidoalliance.org/specs/fido-v2.0-ps-20190130/fido-cl... It should be noted that, at least on Android, any credential manager app will support this exchange. The passkeys in the Bitwarden app on my phone work just like the native Android key store when scanning a QR code, for instance, and other apps will also work. You can switch authenticator apps in the pop-up, or set a dialog in the Android settings if you want to switch the default. Furthermore, there are also CTAP2 implementations for smartwatches (at least for Android smartwatches) that let you authenticate with a tap on the watch. That flow doesn't use a QR code for obvious reasons, you would need to manually connect your computer to the watch before it works. I believe https://github.com/fmeum/WearAuthn https://github.com/fmeum/WearAuthn is the prime open source example of this feature.
- iamnothere 2mo ago
  This is why you should use physical tokens like Yubikey. But don’t log in to important accounts on a public computer, like ever, unless it’s a dire emergency.
  - ghostly_s 2mo ago
    You can decide what appetite for risk you are comfortable with, but some people don't have any better option than logging in to accounts on a public computer. The industry is pushing this system as the new universal answer for authentication, it NEEDS to work in every scenario passwords do. (...and I’m pretty sure plugging my yubikey into a locked down public terminal is not going to solve this, either.)
    - iamnothere 2mo ago
      It would let you log in (even though you shouldn’t). Most “locked down” computers still allow things like USB drives and Yubikeys.
nlawalker 2mo ago
My problem with passkeys is that "don't have to" is actually "don't have to, and couldn't if I wanted to".
RHSeeger 2mo ago
Everything you said is _also_ true if you use a password manager than can interact with the browser (which you're already doing). Plus, that doesn't have the negatives/limitations of passkeys.
- vel0city 2mo ago
  But you still have all the negatives/limitations of passwords, of which there are tons.
cpburns2009 2mo ago
This is a big problem I have with "just works". Everyone is used to services only allowing a single password. I know the answer to this, but it's not clear in the marketing or how it's explained to normie end-users: Won't creating a passkey erase my password? How do you sign in on another device? Won't that change the passkey and lock me out from the first device?
- SpaceManNabs 2mo ago
  it just a lot of complexity and i don't want to deal with it but i have to because of all these dark patterns. sometimes i enable pass key and don't even notice.
- Gander5739 2mo ago
  Creating a passkey generally won't erase your password, no. Using a passkey generally requres a password manager or yubikey, so you can set that up on the other device and use the same passkey.
AndroTux 2mo ago
This. Honestly, most of the arguments I read against passkeys just sound like “old man yells at cloud.” It’s not that difficult. Spend 10 minutes researching the topic and you’re fine. Passkeys are so much more convenient than having to use passwords. When implemented right, it’s literally one click from opening the login page to being signed in. On all of my devices.
- kbelder 2mo ago
  It's not difficult. It's undesired. It makes simple things slightly easier and makes difficult things impossible. Exactly the sort of behavior that will suck in the unsophisticated user, and then leave them with no options when it fails.
dluxem 2mo ago
I try to use passkeys when possible as I'm also a 1Password user, but this hardly "just works". Firefox on Windows often triggers the Windows password manager for passkeys (some how this is only on some sites), making it impossible to use 1Password. I've seen the same on Android too, and I think there's a difference in how Chrome and Firefox are handling the requests. Then you get in to cases like a Microsoft Account. You need to use your account to log in to the device that has the passkeys, so the workflow never works properly and you have to fall back to another method. Amazon is another one. If an app like Libby redirects to Amazon, I get a different, passkey-less password prompt, so I need to have a password readily available. It's great when it works, but honestly 1password with straight up username/passwords is probably just a better UX in the end.

by rsyring 2mo ago

Tarq0n 2mo ago

OK now say you're on a work/library/friend's computer and you want to look up an account in 1password on your phone so you can type in the password. Passkeys don't support this very basic and common workflow. Meanwhile there's no real security benefit over password manager generated complex and not reused passwords.

vel0city 2mo ago
If I'm on someone else's computer and I want to use a passkey on my phone, the computer will display a QR code. I scan the QR code with my phone, the phone signs the login request and posts it to the service's callback. Then I'm logged in on that new device. If my phone's camera is broken but both devices have bluetooth, it can do the handshake over bluetooth. If I'm on someone else's computer and I want to use a passkey on my authenticator on my keychain, I'll just plug it in and then tap the button on the authenticator. Meanwhile, if I logged in with the password and the account only has a password then they have a full copy of my entire authenticator to the account. With the passkey, once the session is invalidated the access is gone.
- doctoboggan 2mo ago
  Does the apple passwords app work this way (log in to a public machine by scanning a QR code?)
  - vel0city 2mo ago
    Passkey on an iPhone, logging into a public-ish terminal by scanning a QR code? Yes. In fact, if you have your Apple Passwords app set to sync through iCloud, you can: - Make a passkey on your Mac for a site in the Passwords app - Go to a different computer (a friend's or whatever) - Attempt to log in, choose use another device, it'll show the QR code - Use your iPhone to scan that QR code and sign in, as the iPhone has the passkey synced through iCloud Note, the same kind of thing is also possible with other password managers as well.
- snailmailman 2mo ago
  This is good in theory but in practice doesn't always work. It isn't just a QR code like I would like it to be, its a QR code and you need bluetooth. Maybe there is a hypothetical world where bluetooth drivers actually work on windows machines and can connect to a mobile device seamlessly but that is not my experience. Across multiple windows machines i often have a problem where windows just decides the machine doesn't have bluetooth, and will refuse to display the QR code without any explanation. It doesn't tell you that bluetooth is the problem it just says "insert a hardware token to authenticate". I would love for this feature to actually work but every time I've needed it to it hasn't. Literally this week I only had a passkey on my phone, but at the time I was in Linux with Firefox, and afaict the qr code workflow basically requires either chrome or windows 10.
  - vel0city 2mo ago
    I use this feature a bunch across dozens of different Windows and Mac devices from various device vendors with multiple Android phones and seemingly never had an issue. But I'm also a person who generally never experiences the issues some people have with Bluetooth in general. If I ever have an issue with Bluetooth on a computer, I swap out the wireless chipset with an actually good one. Its almost always just bad hardware. I've only had to do that a few times in the last decade though, more modern WiFi/BT chipsets are generally pretty OK. Its the old ones that are near worthless. Although I will say most of the time I just plug in my USB authenticator. I normally only fall back to the QR code if I don't have my keys on me. And as an edit, I wasn't aware fully that the QR code is to help assist the BT handshake, I had assumed it was posting a signed request back to the service. My bad, my above comment isn't completely correct. Thanks for cluing me in to the BT requirement for the QR code path.
voxic11 2mo ago
I use a passkey with discord on my phone. If I want to log in to discord on a computer it shows a QR code on the page/desktop app and I scan it with my phone to log in. I could see this become a pretty common pattern. I like it because I can use discord on even a pretty untrusted computer without providing it any credentials or access to my passkey, and then later when I'm done I can revoke the session.
- OJFord 2mo ago
  Ok but now do a service that doesn't support that, whether or not it might in the future 'become a pretty common pattern'.
  - jeroenhd 2mo ago
    On most websites logging in through QR codes works out of the box for passkeys. You usually click "log in with device" or something like that with every desktop OS. You scan the QR code, click the confirmation button, and you're signed in. It's part of the standard UI of normal operating systems. Might not work (well) if you're on an old computer without decent Bluetooth but everything has Bluetooth these days.
    - HelloUsername 2mo ago
      Why does a passkey need bluetooth? For what? Isn't that another vulnerability?
      - jeroenhd 2mo ago
        A "passkey" is a bunch of metadata and a public/private keypair. It doesn't do anything by itself, of course. A physical device, like a Yubikey or a Titan, doesn't have Bluetooth. For phones and tablets these keys do support NFC but that's a whole different story. The Bluetooth connection is how your phone exchanges the key and authenticates you through the computer. In its most secure phone, the key never leaves the dedicated security hardware/trusted execution environment that protects your key from snooping, the same way you cannot get a physical U2F key to give you the private key bits. You scan a QR code to set up the pairing/connection process (if you haven't already), then a Bluetooth Low Energy exchange happens. You confirm you want to sign in on your phone (so you don't get tricked into scanning a QR code), then the cryptography happens that authenticates you. You can find the protocol here: https://fidoalliance.org/specs/fido-v2.0-ps-20190130/fido-client-to-authenticator-protocol-v2.0-ps-20190130.html https://fidoalliance.org/specs/fido-v2.0-ps-20190130/fido-cl... It should be noted that, at least on Android, any credential manager app will support this exchange. The passkeys in the Bitwarden app on my phone work just like the native Android key store when scanning a QR code, for instance, and other apps will also work. You can switch authenticator apps in the pop-up, or set a dialog in the Android settings if you want to switch the default. Furthermore, there are also CTAP2 implementations for smartwatches (at least for Android smartwatches) that let you authenticate with a tap on the watch. That flow doesn't use a QR code for obvious reasons, you would need to manually connect your computer to the watch before it works. I believe https://github.com/fmeum/WearAuthn https://github.com/fmeum/WearAuthn is the prime open source example of this feature.
iamnothere 2mo ago
This is why you should use physical tokens like Yubikey. But don’t log in to important accounts on a public computer, like ever, unless it’s a dire emergency.
- ghostly_s 2mo ago
  You can decide what appetite for risk you are comfortable with, but some people don't have any better option than logging in to accounts on a public computer. The industry is pushing this system as the new universal answer for authentication, it NEEDS to work in every scenario passwords do. (...and I’m pretty sure plugging my yubikey into a locked down public terminal is not going to solve this, either.)
  - iamnothere 2mo ago
    It would let you log in (even though you shouldn’t). Most “locked down” computers still allow things like USB drives and Yubikeys.

nlawalker 2mo ago

My problem with passkeys is that "don't have to" is actually "don't have to, and couldn't if I wanted to".

RHSeeger 2mo ago

Everything you said is _also_ true if you use a password manager than can interact with the browser (which you're already doing). Plus, that doesn't have the negatives/limitations of passkeys.

vel0city 2mo ago
But you still have all the negatives/limitations of passwords, of which there are tons.

cpburns2009 2mo ago

This is a big problem I have with "just works". Everyone is used to services only allowing a single password. I know the answer to this, but it's not clear in the marketing or how it's explained to normie end-users: Won't creating a passkey erase my password? How do you sign in on another device? Won't that change the passkey and lock me out from the first device?

SpaceManNabs 2mo ago
it just a lot of complexity and i don't want to deal with it but i have to because of all these dark patterns. sometimes i enable pass key and don't even notice.
Gander5739 2mo ago
Creating a passkey generally won't erase your password, no. Using a passkey generally requres a password manager or yubikey, so you can set that up on the other device and use the same passkey.

AndroTux 2mo ago

This. Honestly, most of the arguments I read against passkeys just sound like “old man yells at cloud.” It’s not that difficult. Spend 10 minutes researching the topic and you’re fine. Passkeys are so much more convenient than having to use passwords. When implemented right, it’s literally one click from opening the login page to being signed in. On all of my devices.

kbelder 2mo ago
It's not difficult. It's undesired. It makes simple things slightly easier and makes difficult things impossible. Exactly the sort of behavior that will suck in the unsophisticated user, and then leave them with no options when it fails.

dluxem 2mo ago

I try to use passkeys when possible as I'm also a 1Password user, but this hardly "just works". Firefox on Windows often triggers the Windows password manager for passkeys (some how this is only on some sites), making it impossible to use 1Password. I've seen the same on Android too, and I think there's a difference in how Chrome and Firefox are handling the requests. Then you get in to cases like a Microsoft Account. You need to use your account to log in to the device that has the passkeys, so the workflow never works properly and you have to fall back to another method. Amazon is another one. If an app like Libby redirects to Amazon, I get a different, passkey-less password prompt, so I need to have a password readily available. It's great when it works, but honestly 1password with straight up username/passwords is probably just a better UX in the end.