Passkeys: They're not perfect but they're getting better
1–10 of 145 posts
Re: Passkeys: They're not perfect but they're getting better
#2So then I should store all my passkeys in a vault that I protect with a single password, how are passkeys safer?
Re: Passkeys: They're not perfect but they're getting better
#3[deleted]
Re: Passkeys: They're not perfect but they're getting better
#4I agree. I use Bitwarden on my Samsung Android phone and also on my Linux desktop. Bitwarden currently supports passkeys on almost all the apps on my android including firefox. The same passkeys which i used to login on my phone can be used on my Linux desktop where i use Firefox with Bitwarden extension. What's now possible was not even possible at the start of this year. I haven't switched everything to passkeys but i can see it as an alternative to passwords now(passwords really shines in some areas too).
I read about Passkey comittee being against open source passkey managers during start of this year (can't reference it, sorry) but with open source password/key managers already supporting passkeys, i don't think it turned out to be true.
Re: Passkeys: They're not perfect but they're getting better
#5Losing your device and not having any passwords is like losing your fingerprints.
>Device loss scenarios
>Users are largely unsure about the implications for their passkeys if they lose or break their device, as it seems their device holds the entire capability to authenticate. To trust passkeys as a replacement for the password, users need to be prepared and know what to do in the event of losing one – or all – of their devices.
>Backing up and synchronising passkeys with a Credential Manager makes it easier to recover access to them compared to other existing second factor options. However, this relies on the user having prepared their Credential Manager account for recovery. Users need help in understanding and implementing the right steps so they can feel ready to go passwordless and use passkeys without extra worry and hassle.
Re: Passkeys: They're not perfect but they're getting better
#6So then I should store all my passkeys in a vault that I protect with a single password, how are passkeys safer?
The better question is: how are passkeys safer given that the recovery flow will be the same SMS or email based approach everyone uses today?
Re: Passkeys: They're not perfect but they're getting better
#7So then I should store all my passkeys in a vault that I protect with a single password, how are passkeys safer?
Let's assume your vault/login has these properties:
- You have a strong unlock password that you don't use anywhere else
- You have a second factor set up for unlocking the vault (TPM in the device you're using, Yubikey, TOTP, etc.)
- The service you're logging into has good account recovery hygeine
The benefit, assuming those things, is that the passkey is phishing-resistant and social-engineering-resistant. If a user gets an email saying "omg, someone tried to transfer your paypal, click this link to log in", then when they try to log in with the passkey, the site the attacker is using won't be able to use the passkey (because the passkey is associated with a particular domain). Even if the user wanted to bypass this, there's specifically no way for them to extract the contents of the passkey.
That is very different from a user having their password stored in their vault. They could easily forget to check the domain, or get tricked by a very similar looking one, and copy/paste their password into the attacker's form.
Re: Passkeys: They're not perfect but they're getting better
#8I'm glad that someone is at least seriously talking about these problems. A couple of them are serious enough to make passkeys a real pain in the butt for me. A big enough one that the whole scheme is a nonstarter.
Re: Passkeys: They're not perfect but they're getting better
#9So then I should store all my passkeys in a vault that I protect with a single password, how are passkeys safer?
From the article... Passkeys:
- are generated securely and so can’t be guessed - can’t be phished - are unique for each website you use, so if one website is compromised it doesn’t put your other logins at risk
Re: Passkeys: They're not perfect but they're getting better
#10So then I should store all my passkeys in a vault that I protect with a single password, how are passkeys safer?
So your real issue here is with credential managers, but I'll bite. In most cases the vault is not protected only with your master password, but with other cryptographic info that prevents the vault from being opened on untrusted devices. If one of your trusted devices is compromised, I guess you have other issues.