Earlier quoted context omitted.
Still not secure enough, sadly. They can be captured, leaked, stolen, phished, etc, and that's if you use them correctly.
Passkeys can't be stolen, got it. :)
Yep, hardware Passkeys can't.
Tailscale doesn't want your password
291–300 of 316 posts
Re: Tailscale doesn't want your password
#292Earlier quoted context omitted.
Why? Security isn't an opinion, it's a science and art. It doesn't care about what you think of it. Perfect security leaves no room for user friendliness. The most secure system allows no users to use it. Only by reducing security do you gain user friendliness. The most user friendly (as in, triviality of use) system requires no security. The art comes in when trying to create more usability whilst giving up less sec…
> If you don't "like" that, then stick to passwords. But the passkey crowd is overtly aiming at eliminating passwords.
[deleted]
Re: Tailscale doesn't want your password
#293Earlier quoted context omitted.
Why? Security isn't an opinion, it's a science and art. It doesn't care about what you think of it. Perfect security leaves no room for user friendliness. The most secure system allows no users to use it. Only by reducing security do you gain user friendliness. The most user friendly (as in, triviality of use) system requires no security. The art comes in when trying to create more usability whilst giving up less sec…
> If you don't "like" that, then stick to passwords. But the passkey crowd is overtly aiming at eliminating passwords.
And I wish them luck. At least in my country (the same one I assume many of you also live in) our financial institutions haven't even implemented non-SMS MFA options yet. Literally the systems with the most impact on our daily lives (because they hold our money) haven't even stepped up to the security available in 2016 yet.
Re: Tailscale doesn't want your password
#294Earlier quoted context omitted.
This approach basically makes all the security provided by the passkeys void, as the whole system becomes no better than login-via-email-link or login-via-SMS-code scheme.
Every time an average user registers to a site with a passkey, they aren’t giving that their reused password that also provides access to their email (I believe that’s the main way email accounts get hacked). If they registered to their email with a passkey, great. Either way, passkeys seem to reduce the risk of the email being compromised.
I don't think password reuse is the common vector - I believe the most common one is phishing, where user is tricked into giving up their current credentials, straight for the service that attacker is interested in. But I can be wrong. And, yeah, it is an improvement for sure.
You're definitely right that passkeys drastically improve the bottom line security for the least protected folks (which are probably the majority). It is a step in the right direction, for sure. But they also make things worse for me - someone who uses different random high-entropy passwords for almost everything except local sudo and unlock PIN codes. I want to use PKI instead of shared secrets, but when I try - it's extremely inconvenient, so I know at some point I'll just give up. This, and the fact that my bottom line is not moving up at all - it still remains the same, limited by recovery processes' security - is frustrating.
Re: Tailscale doesn't want your password
#295Earlier quoted context omitted.
I don't think it is different. I mostly see people dismissing Passkeys as a technology because of X or Y thing that "they don't do", when that's either a mistaken assumption, or something they don't do right now .
Mistaken assumptions, sure. What "mostly" people do maybe, it depends on those conversations. What Passkeys might do in the future is irrelevant to whether it makes sense for people to be dismissing them now, though, and confusing/frustrating to read about in these kinds of threads (maybe not other threads). Today, you can seamlessly sync your passwords, export them, and utilize auto-fill integration across the afore…
Thank you for eloquently putting this. I am exactly in that boat. I'm reasonably IT savvy but not a security researcher. I help a large number of not tech savvy people with advice.
I don't care to either dismiss or evangelize the technology based on what it may or may not be able to do in the future. My questions are whether these are user friendly and usable today or should I wait and see. I feel all my concerns of "if I and my family adopt this right now, today, on my actual devices, what are my risks and capabilities? How can I safety my family and backup things and set them up for success?" Are answered with "in the future, in theory, somebody somewhere will come up with this solution which is not currently strictly prohibited "
Re: Tailscale doesn't want your password
#296There are still a lot of questions I'm not clear with passkeys. How do you recover your keys if you lose your hardware? What happens if you lose your phone and have no extra trusted device? There will be no more phone number, and no more trusted device. Most MFA implementation, which heavily rely on phone number, will no longer work. And, for Yubikey, how do you backup? Do you need multiple Yubikeys? Do you need to m…
It's way simpler than you think. You reset your passkey the same way you'd reset your password. So, how do you reset your password when you forget it? Well, it depends. Some apps/sites just send you a password reset email. Apps/sites like those would reset your passkey the same way: they'd send you a passkey reset email, you'd click the link in the email, and they'd let you regenerate your passkey then and there. Som…
Not really sure if that is really cleverer to be honest. I think passwords and the common password reset via capability URL is pretty fine. I use stronger credentials for banking and everything else is pretty much only protected by password. I also do cherish the privacy advantages of not using a login provider. I had accounts suspended for no reason and this dependency is just not acceptable.
Even banking with device bound credentials is a hassle everytime you switch devices or you picked up the wrong phone.
I have some apps using login with Microsoft because users are logged in anyway in a corporate environment and it is practical to provide SSO. Here accounts might also be closed and access needs to withdrawn. Practical to do so centrally.
But for cleverness I still believe nothing beats a secret in your head. Quick, fast, secure. Oauth is a mess, so I doubt passwords will be outdated anytime soon.
Re: Tailscale doesn't want your password
#297Earlier quoted context omitted.
Passkeys can't be stolen, got it. :)
Yep, hardware Passkeys can't.
Physically impossible to just take someone's HW token. And firmware/HW has no bugs, so malware taking the keys is also impossible to write. There were never ever any FIDO token vulnerabilities and never will be.
Re: Tailscale doesn't want your password
#298Earlier quoted context omitted.
Exactly! :-) Companies aren't willing to lose customers at scale, but they aren't doing anything for the customers if they won't lose them anyway. For most services, most customers except for some diehard ideologists would just bend over and begrudgingly go with the attested option. And a company won't bother using engineer's time if it's only a few people. So minimum-value random internet blog is probably not going…
The issue, though, is attestation doesn't really do much for the site either. It's not like the bank wants to enable attestation because it's somehow more secure. It's only useful in cases where a company wants to say "we only want you to use Yubikeys because that's what HR has approved", not so much for sites mandating what their customers should use. This is a bit like worrying that sites will block 1password and o…
Attestation can be more detailed than just what brand of hardware key you use. Banks probably don't care.
But attestation also informs what the capabilities are. What banks (or others) might care about is whether or not you're using a TPM or equivalent to store your key in, and attestation can tell them that.
Re: Tailscale doesn't want your password
#299I don’t understand why someone would want to store all their credentials with one of the large tech companies. It seems like this makes it really easy for law enforcement to grab access to all accounts easily.
I think it depends on your threat model. For my personal accounts, I'm more concerned about the risk from badly-managed auth than law enforcement. So from that standpoint, using an established big tech company makes sense. Other people may place different weights on various threats.
Then we are at passwords again where I can happily exclude both. Convenience might be an advantage, but I don't see me using such an auth solution for my private accounts.
Re: Tailscale doesn't want your password
#300Earlier quoted context omitted.
This doesn’t address the issue if OP needs temporary access via an Android device.
If you still have access to a device that can handle the passkeys then you can use the scan of a QR code to gain access. If you do not have access to a device with your pass key on it then using iCloud Keychain is probably not the best service to use for your use case of an Android device. Use one of the many other services that also provide Android support and passkey support. Then you can access that service and ac…
Yes, Bitwarden's pass key support is for "this summer".