Why Passkeys Will Be Simpler and More Secure Than Passwords – TidBITS

I've decided I'm just not doing this. I'm opting out. It's a PITA.

Passkeys are such a great idea that is for sure going to be ruined by implementers clinging stupidly hard to their “secure enclaves” making them a huge PITA to actually use.

It should be as simple as storing your private keys in your password manager, browser keychain, in a folder, or USB stick, Yubikey, or anywhere the user damn well pleases.

You should be able to easily export presigned tickets for recovery, support CA style auth for advanced users, and support passcode challenges (ie site gives you a short code you type in and your vault spits out a code) for cases where getting the two devices to talk directly is hard.

> But imagine a world in which you can securely log in to websites using any current browser on any device running any modern operating system, without having to create, remember, type, and protect passwords. It’s relaxing just to think about.

This is such a weird thing to say... it really isn't all that relaxing tbh, like why not just use a password manager separately or through browser? What's relaxing about handing all your logins over to big company or big company's operating system? That seems like the opposite of relaxing

And also what happens if the public private key pair is compromised? How will they implement device syncing of passkeys or the bluetooth technique mentioned in the article without creating new vulnerabilities? Why not just do 2FA and not put all of your eggs in one basket?

They criticize 2FA as flawed in the article, but how common are the SMS vulnerabilities that they talk about? Based off of this article, it seems like passkeys are 100% better and the solution to all of our authentication needs. Reads like a sales pitch

> Passkeys are synchronized and backed up. If you get a new Android phone or iPhone, Google and Apple can restore your passkeys. With end-to-end encryption, Google and Apple can't see or alter the passkeys.

Hate to say it, but I personally don't feel comfortable storing all of my logins on Apple or Google's servers. Sorry, not for me.

>This is such a weird thing to say... it really isn't all that relaxing tbh, like why not just use a password manager separately or through browser? What's relaxing about handing all your logins over to big company or big company's operating system? That seems like the opposite of relaxing

It's not so much about handing over credentials but authenticating a physical device. Less a password and more like a list of allowed keys.

>And also what happens if the public private key pair is compromised?

The keys are generated separately for each provider and login. Hell, even if they get the server's stored public key they can't actually do anything with it. That's the whole point of a public key.

>How will they implement device syncing of passkeys or the bluetooth technique mentioned in the article without creating new vulnerabilities? Why not just do 2FA and not put all of your eggs in one basket?

The Bluetooth authentication technique mentioned in the article doesn't ever have a private key exchanged over Bluetooth. The authenticating device grabs the public key of the new device, authenticates the user on a device inside the user's account's circle of trust using the device's security (passcode/biometrics), then the already authorized device tells the server to add the new public key of the new device to the server's list of valid keys.

Airdrop transfers private keys but you don't have to use it if you're not comfortable.

>They criticize 2FA as flawed in the article, but how common are the SMS vulnerabilities that they talk about? Based off of this article, it seems like passkeys are 100% better and the solution to all of our authentication needs. Reads like a sales pitch

Fairly frequently. Providers are improving their security but there's still giant holes in it. Do you really trust your phone provider not to balls it up? Passkeys are 100% better. That's why we use them all the time for SSH instead of password/2FA.

>Hate to say it, but I personally don't feel comfortable storing all of my logins on Apple or Google's servers. Sorry, not for me.

You don't have to. At no point do their servers have to get involved. You'll still be able to login by bootstrapping devices into the circle of trust. You can run your own keychain software that you write and can use your CPU's inbuilt TPM or a hardware security module if you want. You just won't be able to restore private keys automatically if you lose a device and have to bootstrap the replacement device back into the circle of trust.