Passkeys: A shattered dream

Post by tsimionescu » Sat, Apr 27, 2024, 7:56 AM UTC

vbezhenar wrote: post #646

tsimionescu wrote: post #639

Earlier quoted context omitted.

Edit: everything I say below is not just wrong, but confidently wrong... "Communicate over bluetooth" doesn't mean anything. What app or BT device would they be using? How would a PC communicate with a YubiKey over bluetooth? I have no idea where you got this strange concept from, but registering multiple passkeys from multiple devices on the same account on a site requires no communication between the devices - it o…

That's how it works. You open Google Chrome on Linux, press "Log in with PassKey", scan QR with iPhone, then iPhone contacts Google Chrome via bluetooth to do its crypto magic (which doesn't work 50% of times) and may be it'll work. No idea how Yubikey works, never used it.

Post by 4ad » Sat, Apr 27, 2024, 9:41 AM UTC

steve_rambo wrote: post #652

crote wrote: post #196

Earlier quoted context omitted.

This isn't a viable option in practice, because Passkeys use "Resident Keys". This means the credential needs to be stored on the Yubikey - which has a limited number of key slots. Need to log in to more than 25 (I believe) websites? Tough luck!

Use a better token. YubiKey is the most popular one, not the best one by a long shot. My (cheaper) alternative supports 300 resident keys per each hardware key.

Post by int_19h » Sat, Apr 27, 2024, 10:07 AM UTC

vbezhenar wrote: post #594

int_19h wrote: post #531

Earlier quoted context omitted.

I'm curious as to why the number of slots is so small. Surely this is not some kind of fundamental limitation on what's possible (or cheap) with hardware?

Because yubikeys were designed long before passkeys become a thing. And hardware people love cutting cost to the bare bone to save one cent of $50 device.

Post by pydry » Sat, Apr 27, 2024, 10:24 AM UTC

littlestymaar wrote: post #627

sroussey wrote: post #578

Earlier quoted context omitted.

Agreed. I self hosted the key 100 bitcoin in like 2010. Machine crashed. Oops.

That's a fundamental problem with cryptographic security: you cannot trust people to manage your keys for you (because due to lack of regulation preventing that companies have this bad habit of pulling the rug under their customers' feet) but you cannot trust yourself doing that either, because you can, and will, make mistakes.

Post by lupire » Sat, Apr 27, 2024, 10:38 AM UTC

apple4ever wrote: post #632

akie wrote: post #623

Earlier quoted context omitted.

Then don’t change phone OS, or put your passkeys in a third party password manager.

Or... use passwords and 2FA which we have been using forever and for years respectively.