"TOTP is phishable."
i can safely say both articles were made by insane people. all i can say is, to keep using generated passwords and offline 2fa codes. dont click on the naked lady in the spam folder.
have a good night, kids.
Let's just go ahead and add a third, fourth, AND fifth authentication factor so maybe I'll kill myself first thing every morning
Passkeys are 100% not a trap, but they've been fucked over by being allowed to be portable. Now your passkey is only as good as the portable password solution you're using to store it. They're meant to be 1:1 computer->service. Then there's the issue that most of the sites that accept passkeys let you bypass them with passwords or TOTP anyway.
TOTP, however, is REALLY fucked. Even a rudimentary phishing email can get your time-based key, get in and fuck your account over in real time.
Passkeys are extremely phishing-resistant. They are the best thing we have short of a YubiKey at the moment.
Yubikeys are amazing, But they're not meant to be permanently carried, just used to stitch your securred devices together.
I use hardware keys to connect to my own self-hosted services and login on (some of) my devices. There is no 3rd party involved.
Some of them like NitroKey are even open hardware. I have backup hardware keys.
It's amazing. I can't believe it took me so long to rely on them.
So... IMHO if you don't like (hardware) passkey it's because you dislike services relying on them, no the keys themselves.
The biggest problem I have with passkeys is big companies aren't implementing them to improve your security - they're implementing them because it absolves them of liability and responsibility for implementing good security on THEIR end and allows them to implement whatever the fuck vibe-coded bullshit nonsense they want without any knowledgeable or skilled staff, and even if it's good for me too, I'm not inclined to do these assholes any favors. It'll just make them sloppier and lazier on other elements of security and they'll turn around and put the blame on the user, and courts will go right along with it because nobody in the legal system can find their asses with both hands.
Exactly, people keep focusing on whether passkeys are secure as a concept, and they are. However, what we actually need to talk about is how they're going to be used in the wild, and what companies are likely to do with them. That's what's going to affect vast majority of the people.
Using established and tested security implementations instead of rolling your own has been considered good practice since forever. It's not a bad thing.
It's not about the implementation - it's about what passkeys do and don't do.
Passkeys prevent someone from stealing hashed passwords from the SERVER, but if the server is already compromised badly enough to let someone in, all of the data stored on that server is compromised already anyway. Companies want to use passkeys because there is less involved in implementing secure login credentials, but that is only ONE tiny part of overall end to end security, and I do not for a SECOND believe that they are going to keep on highly skilled, security-minded developers at real salaries when the C-suite says "We're using passkeys. We're secure. Fire the high priced developers and get me some interns who can use Claude."
TLDR: Passkeys are not a magic bullet and they aren't a game changer, and the false sense of security they push is dangerous.
I realy dont think that's a thing. End-user login security is a tiny footnote on page 729 of the 2000+ page security document of a large company's cyber security department. Switching that to passkeys will not change anything about how the company handles security. AI will. But not passkeys.
And as we have seen many times, companies have been bad with security already and many password databases have been breached. Having a tool that limits the impact of bad security is a good thing.
Passwords are protected (for now) by the first amendment. You can't be compelled to tell what it is. Passkeys can be seized with a warrant. This only matters in the US but it does matter and I literally never see that addressed.
Let's get back to after 10 years because this was the same debate about drm in browsers and now we have this https://www.w3.org/TR/encrypted-media-2/
FWIW I don't have DRM enabled and I can don't even remember what part of the Web I can't browse.
Before you ask, no I don't use Netflix, or Disney+ or audio streaming service nor do I plan nor want to.
When you use librewolf it pops up when websites try to access drm, ex. finance.yahoo.com wants to access it. It's not streaming services but lots of news webistes that also serve video.
Right, I've also seen warnings too from time to time and yet I didn't seem to miss enough content to even notice.
After reading both of the posts, I'm kind of back where I started with passkeys: neutral. I'm pretty happy with my current setup of a self-hosted password manager, diceware master passphrase and strong, unique passwords for every account, along with an open source app for TOTP. I only ever see passkeys pushed on me for work-related accounts anyway, but I'm not using them there either. I do have a question though if someone can answer: are passkey protected logins also vulnerable to stolen session cookies?
are passkey protected logins also vulnerable to stolen session cookies?
Yes. 100% unchanged.
So it's fair that you are neutral about them for your own use, clearly you know what you're doing. It doesn't make sense to be neutral about them, generally. On usability alone they are not good. There are so many people who don't have a clue how they work, or their consequences, and just click okay when continually harassed into using them. Some will even go ahead and save one on a shared computers, or someone else's, 'because the website says so'.
Honestly, I don't understand them well enough to recommend them either. I do IT, and I set my users up with a (managed) password manager and MS Authenticator. If I encounter a situation where a user has ended up with a passkey for a given service, I just leave it be. On the other hand, if someone is locked out because of a passkey, I reset it and get them set back up with the Authenticator app.
Hmmm, for someone complaining that another post makes logical leaps, this one has a pretty glaring contradiction that severely undermines their own argument:
The post is predicated on the idea that a feature of WebAuthn called “attestation”, which is only used in high-assurance and usually corporate scenarios, and usually with physical hardware security keys, will be leveraged to hurt people, somehow. The post posits that a website like X will bait and switch users: first, you get a passkey. Then, later, scary “attested” passkeys! This simply isn’t possible to do because attestation isn’t supported on the web for mass market, consumer authentication. Attestation for passkeys (software-based, syncable credentials) is antithetical to their mass market goals, and would freeze out independent, non-corporate-backed credential managers. It’s an explicit non-goal of the designers of passkeys, who work together in a forum anyone can join. And trust me, websites and apps like banks repeatedly asked for attestation at the beginning of the industry’s passkey journey. The platforms, browsers, and credential management apps have held firm that the goal of passkeys is reducing phishing and not some kind of trusted computing scheme. (And I will note: over my dead body!)
In other words, "attestation is bad and everyone is against it, but it's a feature of the standard." What they are really claiming is that there is something that for now is stopping governments and corporations from pushing attestation, but how long will that hold? I didn't have a horse in this race when I first started reading these posts, but this counter-argument is flawed and it makes me lean toward the camp against passkeys.
It reminds me of when Netflix was big and I told everyone they'd have commercials eventually. Sure you can still buy a plan without commercials, but I suspect that eventually, when money gets really tight for them, will go away.
Same thing here. Right now passkeys are "open", but who is to say my bank won't require a Apple/Google managed passkey in the future. Hell, I can't run the bank app without running a Apple/Google approved apk.
Attestation for passkeys (software-based, syncable credentials) is antithetical to their mass market goals, and would freeze out independent, non-corporate-backed credential managers. It’s an explicit non-goal of the designers of passkeys, who work together in a forum anyone can join.
The web wasn't supposed to be controlled by corps either, and look where we are now.
If passkeys were to follow the same path as the web, here's what it would look like. Corporate passkeys get the most users because of OS integration and convenience. Now that they have all the users they can commandeer the standards, and make them so complex and evolve so quickly that non-corporate implementations can't keep up (think Firefox vs Chrome). Corporations convince websites to drop support for outdated passkeys, citing security issues. Non-corporate implementations are locked out. Monopoly is established.
And now that passkeys are centralized to corps, the government can exert power on them, mandating hardware attestation for things like hardware-backed id and age verification. They push for backdoors, so they can log into anybody's account. Bye bye privacy.
Sounds like something BigPassKey would say
Not much of a rebuttal imho. We still have the problem that passkeys are ok in theory, but in practice they're being pushed as a way to increase lock-in and don't offer compelling advantages over well-managed passwords.
The author of this post works in Apple, Passwords team. They do not deny that there’s attestation; they argue that it’s only used to prevent bad actors.
Cool, we’ll trust corporations then!
But they are annoying. Like it's fine if you only use one device, but I don't fucking know where my phone is, that's why I am on my laptop
This was on hackernews this morning.
The author is in the passkey business.
The most pertinent question there imho was : What do passkeys offer that random strong passwords + a pw manager do not?
There was a wall of comments, but no concise answer.
======== You buy a new super secure lock for your house, but to get in you go to one of the 3 conveniently located HomeDepot's in your city. You simply prove your identity to the guy there. He verifies you in the system. Then he gives you a one time pass to your house.
If its such a great idea, you can pay me now to do it for your home.
The way i understand it, passkeys test for a combination of what you have and what you are (for those that check user presence, which is all of them I suppose); whereas passwords test what you know.
From my reading, passkeys give more control to the platform/service provider, whereas passwords do the reverse.
The former clearly benefits corps in their unique ways - motivated by profit, security, data/spying and so on.
The current iteration of passkeys is not the form that is being challenged by the earlier anti-passkey post. But rather a floodgates problem. Pretending that it will never happen is asking for trouble.
The better option (be it passwords or passkeys) needs to demonstrate that it gives control to the user.
I'm in the passwords camp, I do not see what convenience or added security passkeys might provide in any of my use cases that is worth sacrificing my level of control and choice.
I'm telling you why passkeys are garbage:
Never have to login again for the next few months
Click like 2 buttons and you're done
Passkey is stored on propietary, trust me bro, “we will never share this with the NSA or FBI” Apple or something account where you can’t export them
No. Most FOSS password managers support them, even keepass and bitwarden. You control them, you can export them as you wish, and even use them across multiple devices. I know because I do this.
I have a basic question, I learned that MFA should draw from multiples of "things you have" (totp) and "things you know" (passwords). There's all this talk of passkeys replacing passwords, but aren't passkeys in the "thing you have" category, not the "thing you know" category? My worry is that an unlocked computer or unlocked phone will let someone access ALL of a person's accounts because now they have the thing and don't need you at all. Putting access to my entire digital life behind my 4-9 point lock symbol? Or worse, a fingerprint?
Nah, lock-in is not a safety feature. 16+ random chars are plenty, and if cracking gets better I'll go to 20 or 30 chars. My pw manager doesn't care what strings go in it or which device opens it up.
Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.
In this community everyone is welcome to post links and discuss topics related to privacy.
much thanks to @gary_host_laptop for the logo design :)