Understanding Passkeys

dang wrote: post #2

Recent and related: Passage by 1Password: Add passkey support to your app or website - https://news.ycombinator.com/item?id=35988348 - May 2023 (114 comments)

Also:

Passkeys: A Loss of User Control? - https://news.ycombinator.com/item?id=35854216 - May 2023 (175 comments)

Re: Understanding Passkeys

#6

Post by jmclnx » Fri, May 19, 2023, 6:24 PM UTC

psanford wrote: post #3

> ...I’d much prefer GNU Pass to support it Nit: Pass[0] is not a GNU project. [0]: https://www.passwordstore.org/

Good to know, I would trust GNU as opposed to a proprietary solution.

Re: Understanding Passkeys

#7

Post by throw7 » Fri, May 19, 2023, 6:32 PM UTC

Is it the _goal_ of FIDO to get rid of passwords? If it is, I am against this industry group.

Passwords should always be kept as a valid authentication method.

The OP brings up a point about not having access to the private key... I agree with that. If I don't have access to the private key (like I currently do with ssh) then it's dead in the water to me.

Re: Understanding Passkeys

#8

Post by secabeen » Fri, May 19, 2023, 6:35 PM UTC

Is there any company actually providing anything resembling emergency access for Passkeys? A critical feature of password vaults for me is the ability of my heirs to get access to my passwords when I am incapacitated or dead. I can't print out my passkeys and store them in a safe, nor does there appear to be any system for allowing someone access to my passkeys.

Features like this seem like table-stakes to me:

https://www.lastpass.com/features/emergency-access

Re: Understanding Passkeys

#9

Post by cmdli » Fri, May 19, 2023, 6:43 PM UTC

Just because this is a common misunderstanding of passkeys, I'm going to state it again here: passkeys don't have to be locked to a hardware chip inside your device in order to work. It is entirely possible to have use passkeys only in software (shameless plug to the passkey manager I'm building, https://bulwark.id), and that is most likely the way that most people will interact with them.

I think it's unfortunate that Apple and Google are the ones who are most visible in the passkey space because it gives people the idea that passkeys are a locked-down authentication mechanism when they aren't.

Re: Understanding Passkeys

#10

Post by cyberax » Fri, May 19, 2023, 6:44 PM UTC

secabeen wrote: post #8

Is there any company actually providing anything resembling emergency access for Passkeys? A critical feature of password vaults for me is the ability of my heirs to get access to my passwords when I am incapacitated or dead. I can't print out my passkeys and store them in a safe, nor does there appear to be any system for allowing someone access to my passkeys. Features like this seem like table-stakes to me: https:…

In practice, as long as your heirs have access to your email, they should be OK. Password reset flows still work with passkeys.

You also should be able to back up passkeys onto a flash drive and encrypt them with a strong password. I don't think there's a good tooling for this right now, though. On macOS you'll need to go to Keychain Access and manually export the keys.

(I store everything important in an encrypted container, with the 128-bit recovery code printed on paper and stored in a safe deposit box)