“Passkeys,” the secure authentication mechanism built to replace passwords, are getting more portable and easier for organizations to implement thanks to new initiatives the FIDO Alliance announced on Monday.
If the passkeys aren’t managed by your devices fully offline then you’re just deeper into being hostage to a corporation.
That’s a great way to lose access if your device gets lost, stolen, or destroyed. Which is why I’m against and will continue to be against forcing 2FA and MFA solutions onto people. I don’t want this, services don’t care if we’re locked out which is why they’re happy to force this shit onto people.
Well yeah, that is true. Security and convenience are usually at odds… MFA has place, unless you don’t mind some guy from russia access your online bank account ; but I definitely wouldn’t use it on all my accounts.
Yeah and since Online bank accounts can also almost always be reset if you lose the 2FA/MFA key by calling customer support, or going to your bank and speaking with themt in person, there’s almost no risk of losing access completely. It’s a service you have access to because you’re you. Something that isn’t the case with Reddit, Github, Lemmy accounts, or Masotodon. I’m not able to regain access after losing those 2FA solutions by virtue of being myself, they treat you just like the attacker in those cases. Really not worth it there, both since what is being protected isn’t worth it, and the risk far outweighs it.
Access to my main email account (outlook) is currently blocked because someone decided to try a password from some earlier leak and locked it. It can only be unlocked with SMS MFA, which I can’t use because I’m travelling abroad. There is no other way to do it. The other option they give you a form that only works if you don’t have MFA set up (it says so on the faq). I even asked someone to fill the form from my home computer so the location data matches earlier accesses, but didn’t work. You also can’t contact support without logging in. If I had lost/changed that phone number for any reason, I would lose access forever. Luckily I will be back home soon.
I had a similar scary situation like that before where the phone number linked to the account wasn’t mine anymore. Luckily I was able to get back because I was still logged in on another computer and it hadn’t kicked me out yet, I was able to go to account settings and remove the phone number, then google let me log into the account again. Had I been kicked out of the account, I would’ve lost it for sure.
The lock-in effect of passkeys is something that this protocol aims to solve though. The “only managed by your device” is what keeps us locked in, if there is no solution to export and import it on another device.
The protocol aims to make it easy to import and export passkeys so you can switch to a different provider. This way you won’t be stuck if you create passkeys e.g. on an Apple device and want to switch to e.g. Bitwarden or an offline password manager like KeyPassXC
The specifications are significant for a few reasons. CXP was created for passkeys and is meant to address a longstanding criticism that passkeys could contribute to user lock-in by making it prohibitively difficult for people to move between operating system vendors and types of devices. […] CXP aims to standardize the technical process for securely transferring them between platforms so users are free […].
That’s between platforms though. I like my stuff self-managed. Unless it provenly works with full offline solutions I’ll remain sceptical.
I like my stuff self-managed.
Bitwarden / Vaultwarden is a popular available working solution for self-hosting and self-managing passkeys (as well as passwords).
TBH I don’t see a reason why something as simple as a password manager needs a server, selfhosted or not. I don’t get the obsession with syncing everything, so would rather stick with normal KeepassXC.
Have you never lost your password device (phone, laptop, etc) suddenly and unexpectedly? That’s when you really want that file synced somewhere else. But then it’s too late. Bonus on many password vault servers is shared folders, so one can share their garage door code with the family but keep the bank account details to oneself.
No, but this is very unlikely because I do keep regular backups manually. I just don’t feel the need for it to be a constantly-online server.
Y’all here talking so smart ignore another thing - the more complex your solutions are, the deeper you are into being hostage to everyone capable of making the effort to own you.
Don’t wanna be hostage - don’t use corporate and cloud services for things you need more than a bus ticket.
You are being gaslighted to think today’s problems can be solved by more complexity. In fact the future is in generalizing and simplifying what exists. I’m optimistic over a few projects, some of which already work, and some of which are in alpha.
Thank goodness you didn’t mention any names
Projects don’t react too well to premature attention.
If you tell corporations there’s a way to increase lock-in and decrease account sharing, they’re gonna make it work.
One is a new technical specification called Credential Exchange Protocol (CXP) that will make passkeys portable between digital ecosystems, a feature that users have increasingly demanded.
I.e. I can copy my key to my friends’ device.
I believe that’s Apple talking to Google, not anything local you can own.
Read the article, it’s literally about replacing Import/Export CSV plaintext unencrypted files with something more secure.
I.e. moving your passwords/passkeys between password managers. This is not about replacing stuff like OAuth where one service securely authorizes a user for another.
It’s gonna work with KeePass and Bitwarden once it’s finalized.
I’d love to see that.
deleted by creator
That’s not how Passkey, and the underlying WebAuthn works.
(Highly simplifies but still a bit technical) During registration, your key and the service provider website interacts. Your key generated a private key locally that don’t get sent out, and it is the password you hold. The service provider instead get a puclic key which can be used to verifiy you hold the private key. When you login in, instead of sending the private key like passwords, the website sent something to your key, which needs to be signed with the private key, and they can verify the signature with the public key.
The CXP allows you export the private key from a keystore to another securely. Service providers (Netflix) can’t do anything to stop that as it doesn’t hold anything meaningful, let alone a key (what key?), to stop the exchange.
So basically cert exchange when you want to ssh without passwords?
Pretty much, yeah.
Thanks for this, from a non techie
I always feel like an old granny when I read about passkeys because I’ve never used one, and I’m worried I’ll just lock myself out of an account. I know I probably wouldn’t, but new things are scary.
Are they normally used as a login option or do they completely replace MFA codes? I know how those work; I’m covered with that.
Usually just an option in addition to a password + MFA. Or they just replace the MFA option and still require a password. I even saw some variants where it replaced the password but still required a MFA code. It’s all over the place. Some providers artificially limit passkeys to certain (usually mobile) platforms.
All of those options are to NIST-spec. MFA means multi-factor. It doesnt matter what they are as long as they are in different categories (something you know, something you have, something you are, etc: password, passkey, auth token, auth app, physical location, the network you are connected to). Two or more of these and you are set (though, location might be a weak factor).
Hey good for you, unlike everyone else in this thread making up reasons why the tech is bad, you are mature enough to recognize the fear is from ignorance. I am in the same boat. I’m currently using a manager with MFA on everything which works well for me. Might look into this tech once it’s baked longer. I don’t like the idea of early adoption to a tech when it’s security related.
Am skeptical
ITT: Incredibly non-technical people who don’t have the first clue how Passkeys work but are convinced they’re bad due to imaginary problems that were addressed in this very article.
This is a weird thread. Lots of complaints about lock in and companies managing your keys, both of which are easily avoidable, the exact same way you’d do so with your passwords.
I still have no idea how to use passkeys. It doesn’t seem obvious to the average user.
I tried adding a passkey to an account, and all it does is cause a Firefox notification that says “touch your security key to continue with [website URL]”. It is not clear what to do next.
After my password manager auto filled a password and logged me in the website said “Tired of remembering passwords? Want to add a passkey?” I didn’t know what it meant so I said no lol.
deleted by creator
Meanwhile mobile Firefox doesn’t even support YubiKey / FIDO2 for some godforsaken reason.
My password manager supports passkeys just fine, across Windows, macOS, Linux and iOS (and probably Android but I haven’t tried). Surprisingly, iOS integrates with the password manager so it’s usable just like their own solution and it works across the system (not just in the browser).
This seems to be more about finding a standard way to export/import between different password managers/platforms?
Correct. The spec is about making it easier and more secure to export your passwords and passkeys when you move from one password manager to another. People are misunderstanding this as some sort of federated authentication system to share your credentials between multiple password managers at the same time, which it is not.
It’s enough to read the title. The rest of the article doesn’t provide much else other than being one step closer. 😄
I remember when Microsoft made a big deal about this on Windows and then their “implementation” was making the local signon a number PIN.
And not a proper separate auth operation lol. You either set up almost everything with the PIN or use a regular password, not both. Makes it useless on enterprise.
Realistically we should all be using a key/pass vault since that would make using passkeys much easier, but that’s too complicated for the internet in
20042024.If it were me, I’d just issue everyone a yubikey.
What separate auth operation is needed besides authenticating with the local device to unlock a passkey?
They are really satisfying when they work. I have been impressed by how well they work cross platform in the new bitwarden. It even worked from Android one time with a key made on windows! However, I dread when my mom tells me she needs help with an account and I can’t do anything because the key is on her iOS Keychain I don’t have access to
What is the difference between a crypto wallet and a passkey?
Is it just that a passkey has less functionality (and therfore better usability)?
Passkeys are for logging into websites.
Passkeys seem to be equivalent to public addresses of blockchain wallets.
I think the main difference is that passkey are recoverable but blockchain wallet keys are private
No, and this analogy is completely unhelpful
Can you expand on why?
One argument could be that FIDO2 and WebAuthn primarily rely on algorithms like RSA and non blockchain elliptic curves, but extending the algorithms covered in standards shouldn’t be too difficult as open source libraries exist.
I’ll switch when it’s fully implemented in open source and only I am the one with the private key. Until then its just more corporate blowjobs with extra steps.
You can add them in vaultwarden.
That’s exactly how passkeys work. The server never has the private key.
KeePass has passkey support
Does it require an array of fucking containers and a flurry of webAPI calls? Then no.
No it’s actually pretty simple. No containers. Your passkeys can be managed in the browser (Google Passwords), by a plug-in like BitWarden, or in a third party hardware device like YubiKey.
I’m lost on this - is this better than GPG?
More usable for the average user and more supported by actual sites and services, so yes.
