To paraphrase a well-known saying: Those who don't understand ISO7816 are doomed to reinvent it, poorly.
Passkeys: A shattered dream
561–570 of 789 posts
Re: Passkeys: A shattered dream
#562Here's my opposing view: I love Passkeys. I use Firefox as my browser and 1Password as my password manager. On my iPhone, I use 1Password + Firefox. I look at https://passkeys.directory/ every so often and switch my logins from passwords to passkeys. This has included a lot of my common logins like GitHub, Google, and Microsoft. There is a lot of confusing terminology. For some reason sites will say "login with Touch…
Honest question, not a critique: what's the point of passkeys if you already use 1password? It unlocks with touch ID both on computers and phones, it autofills and autogenerates username and password. Plus you've got the option to fall back to manual input if you don't have 1password available in a particular device, and credential sharing (outside of 1p) becomes feasible. What's better about passkeys with 1p?
Re: Passkeys: A shattered dream
#563Earlier quoted context omitted.
It cuts out the necessity for a password manager browser extension to handle stuff like autofill, password generation, etc. Those extensions have had fairly significant vulnerabilities in the past. So you're reducing the attack surface, as well as getting a cryptographic guarantee against phishing (the signature the client returns include the domain that sent the challenge). Edit: The other great part is that the ser…
You don't need browser extensions to use a password manager. You can just copy&paste.
[deleted]
Re: Passkeys: A shattered dream
#564Earlier quoted context omitted.
It cuts out the necessity for a password manager browser extension to handle stuff like autofill, password generation, etc. Those extensions have had fairly significant vulnerabilities in the past. So you're reducing the attack surface, as well as getting a cryptographic guarantee against phishing (the signature the client returns include the domain that sent the challenge). Edit: The other great part is that the ser…
You don't need browser extensions to use a password manager. You can just copy&paste.
Except we're talking about protections against phishing, and as much as I love the clipboard it will paste anywhere you like, including definitely wrong and evil places.
Re: Passkeys: A shattered dream
#565The biggest issue with passkeys is that I just can't trust the companies offering them. They are locked into the platform for reasons that are ostensibly security but often indistinguishable from platform lock-in. If you make a passkey on an Apple device as far as I can tell it will never leave that device, ever, and there is no way to change this. Of course this means you can never be phished for your credentials bu…
I use 1Password to manage passkeys. It’s pretty nice. They sync across my devices, I can erase one if I need to, and generally with the exception of something odd with Firefox and one website they just work.
Re: Passkeys: A shattered dream
#566Earlier quoted context omitted.
PINs and passwords on HSM keys like this are typically very secure as they will wipe themselves or at least lock themselves after a small number of failed attempts. For example if you only allow 5 failed attempts a 4 digit random PIN has a 0.05% chance of being guessed and a 6 digit PIN is 0.0005%. So the only real risk is key extraction, hardware key extraction is always possible but likely incredibly expensive, so…
PIN+limit is still a much worse user experience than a password: - a PIN is hard to memorize, so people are more likely to use personally-relevant or common numbers, whereas a password can be easily be both complex and memorable - it's easy to burn through even 10 login attempts through any combination of temporary/permanent disability, stress, being drunk, damaged device... - a wipe-after-failed-attempts system is t…
PINs can include all characters just like a password. They're called PINs for historical reasons.
(This does depend on the specific key/protocol.)
Re: Passkeys: A shattered dream
#567It seems like most of these gripes are due to the web app's implementation, and not passkeys themselves. It's a bit harder supporting multiple passkeys, but certainly doable. As others have said, this is just FIDO2/WebAuthn.
Re: Passkeys: A shattered dream
#568The biggest issue with passkeys is that I just can't trust the companies offering them. They are locked into the platform for reasons that are ostensibly security but often indistinguishable from platform lock-in. If you make a passkey on an Apple device as far as I can tell it will never leave that device, ever, and there is no way to change this. Of course this means you can never be phished for your credentials bu…
You are able to share an Apple passkey to any nearby Apple device at any time using AirDrop. Passkeys can also be used cross-platform during sign in via an NFC/Bluetooth handshake initiated by QR code. Additionally, passkeys are just a synced-via-cloud implementation of FIDO2, an open standard that has other implementations you may feel more comfortable using. For someone who requires being able to sign in to, say, G…
But what happens if I as an iPhone user want to switch to Android next year? Can I move my Apple passkeys?
Re: Passkeys: A shattered dream
#569I like the idea of Passkeys, but the implementation of them being exclusively tied to my super account of Apple or Google makes me very cautious. I’ve read too many stories about automated systems killing someone’s account and the resulting havoc.
I understand that, in principle it’s your device, and not your account, but it feels like the fingers are too deep to hand over one more thing.
Adjacent to this, I really liked Steve Gibson’s SQRL. I wish that had taken off.
Re: Passkeys: A shattered dream
#570Earlier quoted context omitted.
Passkeys ought to be exactly like SSH keys. Unfortunately, they are not. The attempts to restrict when and how they are stored, and how you can access them - those are going to cause a lot of pain and confusion. I have all of my SSH keys stored in KeepassXC, which (imho) is a lot more secure than having them hang around in my .ssh directory. Open KeepassXC, and the keys are available. Close it, and they're gone. Sync…
I would say the exact opposite, traditional ssh key management should eventually give way to resident keys. Aka, treating them just like passkeys. We've been storing ssh keys directly on our yubikeys since before passkeys were a thing. Not only is it clearly more secure it's also been a usability lift. Plugin your yubikey, start an ssh agent, and run ssh-add -K to get all your resident keys added to your current sess…
I might add, you can already do this. OpenSSH has had FIDO support for a while now. I've found it to work better than trying to use PGP or PIV/PKCS#11