Missed opportunity for “What the eff is a Passkey?”
Thank you. That was the very first thing I thought.
You’re still entering the password or pin for your password manager. I genuinely do not see how this is better. It’s simply an alternative, not an improvement.
-
Password managers are, generally speaking, far more security conscious than the average website. I’d rather send a password to my password manager a couple times a day than send passwords to every website I interact with.
-
One click to confirm vs. 2-3 to autofill. Tiny gains in speed 🤷♀️ If you make a password manager even slightly more convenient than just using
gregspassword123for everything, you can onboard more normies.
Most people that have password managers are already using different passwords for each website. Usually randomly generated. What’s the difference between that and a passkey?
A pass key is the private key in a private/public key pair. The private key is stored in the TPM on your device. The website contains the public key. When you use your “one password” you’re in effect giving your device permission to access the key storage in your TPM to fetch the private key to present it to the site.
What this means in practice is that if a website has a data breach they won’t have your hashed password, only your public key which… is public. It doesn’t and can’t do anything on its own. It needs the private key, which again only you have and the website doesn’t store, to do anything at all.
If you want to read more about it look into cryptographic key pairs. Pretty neat how they work.
Right. Most people that have password managers. Making a password manager easier and more convenient to use means some portion of people who aren’t using one may start.
Passkeys use cryptographic keys held client side which are never transmitted, they user cryptographic challenge-response protocols and send a single use value back. You can’t intercept and reuse it unlike with passwords.
But does their advantage in security overcome the fact that they’re a much larger target?
It’s similar to how money under a pillow could be safer than money in the bank; depending on who you are.
In general, yes. Big sites get hacked all the time. Passwords from those sites get cracked all the time. Anyone who uses the same password on multiple sites is almost guaranteed to have that password stolen and associated with a username/email at some point, which goes on a list to try on banks, paypal, etc.
Conversely, to my knowledge, there has been one major security breach at a password manager, LastPass, and the thieves got more-or-less useless encrypted passwords. The only casualty, at least known so far, is people who used Lastpass to store crypto wallet seed phrases in plaintext, who signed up before 2018 when the more secure master password requirements were put in effect, chose an insecure master password, and never changed it once in the four years prior to the breach.
It’s not perfect, but the record is lightyears better.
Put it this way: Without a password manager, you’re gambling that zero sites, out of every single site you sign on to, ever gets hacked. From facebook, google, netflix, paypal, your bank, your lemmy or mastodon instances, all the way down to the funny little mom-n-pop hobby fansite you signed up for 20 years ago that hasn’t updated their password hashing functions since they opened it. With a password manager, you’re gambling that that one site doesn’t get hacked, a site whose sole job is not to get hacked and to stay on the forefront of security.
(Also, you don’t even have to use their central servers; services like BitWarden let you keep your password record locally if you prefer, so with a bit of setup, the gamble becomes zero sites)
I use a different password for every site tho. Using same pw for every site, that’s another extreme entirely.
Most people do not. The average user has one or two passwords, and maybe swaps out letters for numbers when the site forces them to. Because remembering dozens of passwords is hard. If you, personally, can remember dozens of secure passwords, you’re some kind of prodigy and the use-case for a password manager doesn’t apply to you, but it still applies to the majority.
One doesn’t have to remember dozens. Just a basic algorithm for deriving it from the name of the site. Complex enough that it’s not obvious looking at a couple passwords but easy to remember.
This method works for me. I understand its dangers (can still correlate. Dozen passwords and figure out the algo). But it’s my current approach. I hate even discussing it since obscurity helps.
Okay, I’m glad you have a system, but it’s not really relevant? I didn’t say you should use a password manager. I said it’s good for the majority of people who can only remember one or two passwords.
-
You’re entering your password into your password manager, which is stored by a company or entity whose entire job is to keep it secure. You’re not giving your password, in any form, to the website or service you’re accessing. When the website gets compromised, your hashed password is not in a database waiting to be cracked. All the attacker gets is a public key they can’t use for anything.
The biggest difference: nothing sensitive is stored on the server. No passwords, no password hashes, just a public key. No amount of brute forcing, dictionary attacks or rainbow tables can help an attacker log in with a public key.
“But what about phising? If the attacker has the public key, they can pretend to be the actual site and trick the user into logging in.” Only if they also manage to use the same domain name. Like a password manager, passkeys are stored for a specific domain name. If the domain doesn’t match, the passkey won’t be found.
https://www.youtube.com/watch?v=qNy_Q9fth-4 gives a pretty good introduction on them.
Here is an alternative Piped link(s):
https://www.piped.video/watch?v=qNy_Q9fth-4
Piped is a privacy-respecting open-source alternative frontend to YouTube.
I’m open-source; check me out at GitHub.
This is something being sold in favor of passkeys but I can’t ser how “more secure” it is for me.
I use Bitwarden, the domain name matching works exactly like passkey’s. How more secure a passkey is, if it has 0 changes to this domain name detection?
That’s the part where the server doesn’t story any information that an attacker could use to log in. The attacker would need the private key, which is stored inside a secure chip on your device (unless you decide to store it in your password manager). All that’s stored server side, is the public key.
When you’re using a password, the server will store a hashed version of that password. If this is leaked, an attacker can attempt to brute-force this leaked password. If the server didn’t properly store hash the password, a leak simply exposes the password and allows the attacker access. If the user didn’t generate unique passwords for each site/server, that exposes them further to password spraying. In that case an attacker would try these same credentials on multiple sites, potentially giving them access to all these accounts.
In case of passkey, the public key doesn’t need to be secret. The secret part is all on your end (unless you store that secret in the managed vault of your password manager).
I do agree that your risk is quite small if you’re already
- using a decent password manager
- doing that the right way
- have enabled 2FA wherever possible
With a breach of the server then they can get your password the next time you log in and maintain persistent access until they’re both kicked out and everybody has changed passwords.
With passkeys you don’t need to do anything, they never had your secret.
If you’re using a hardware token like a YubiKey then you do need to enter your PIN before being able to use it.
The main benefit is that you cannot extract the Passkey from the secure element (the token cannot be transformed from what you have to what you know) and it cannot be phished through a fake domain as the challenge-response will not match.
Passkeys are asymmetric, meaning that the server only ever sees your public key. If the server gets breached, then only your public key is leaked, which isn’t a big deal. Functionally, it’s almost identical to SSH keys.
deleted by creator
If they get your password they can impersonate you to the server. They can’t do that with just the public key part of your passkey.
deleted by creator
And all of my tech challenged family screamed out in unison, “What’s the fucking 1Password password again?!”
Wife: I don’t remember my {service} password.
Me: Did you put it in {password manager}? We have a family plan.
Wife: groans I never remember it. What’s the password?
Me: How would I know? It’s your password.
Wife: ruffles through desk, picks up tattered handwritten note. Aha! Here’s the {service} password. Same as {30 other sites}.
Me: slowly bangs head on table
[ Repeat once a month]
Sounds like you need to get the latest patch for your wife. While you’re doing that, you can add the password manager extension which should fix the issue.
Put your wife’s password in your password manager genius
Also write that password down somewhere in case you pass away in an accident or whatever. If you can afford it, a safety deposit box is great just because it can’t get lost but is also wayyyyyy overkill.
For this bitwarden has a solution: the emergency contact. You can designate an emergency contact that can request access to your account at any time.
If you don’t manually deny the request they can get access to your bitwarden passwords after X days (X can be configured)
deleted by creator
You don’t have to memorize a ton of passwords for multiple sites which helps prevent password reuse. Whatever you use to decrypt your passkey or password is not transported over the network.
It’s not foolproof of course but it’s a huge improvement.
Because you don’t send a secret value, you only send a cryptographic asymmetric single use value which is safe to disclose
Because it’s for your website logins. It just stores the key and auto logins.
deleted by creator
TOTP generated on the same device as the passkey is not a secondary factor. It will have been compromised together with the passkey.
For passkeys, the secondary factors are used to access the passkey vault, not auth to the server. And these secondary factors should be a master password, biometrics, or physical keys. TOTP and SMS are out.
deleted by creator
I’m not sure I follow you - if someone can compromise the key material on my phone that is protected by a different factor, then it doesn’t matter whether the 2FA is server-side or not, it’s compromised either way.
deleted by creator
It seems like you are trying to protect against a compromise of the user’s device. But if their device is compromised then their session is compromised after auth anyway and you aren’t solving much with extra auth factors.
deleted by creator
If the user can perform all steps on the same device then it doesn’t make sense to assume only specific set of keys will be disclosed, you have to assume everything on the device can be compromised
Passkey plus TOTP doesn’t really make sense (they’re both client side cryptographic keys, you don’t need two protocols), at least use a PAKE algorithm with a PIN instead if you want the server to be able to check the user’s knowledge of a secret without sending it in a readable form
I can see the “phone falls into the toilet” as a big problem that people will have.
Use a password manager that implements passkey like Bitwarden that syncs up to a server. Or you can host your own Bitwarden sync server with Vaultwarden if you don’t like the thought of a cloud sync.
As far as I know the Bitwarden browser plugin for Firefox does not yet support WebAuthn/Passkeys, as it’s still on the September release. Chrome is already on the October version. A build of Vaultwarden from yesterday onwards should support storing it, once your browser is ready.
It’s already a huge problem now. Lots of people only have one auth device they depend on for everything. At least passkeys come with standards which should help spread the use of vault sync and backups and hopefully those practices become the norm.
deleted by creator
Yubikey ftw
That’s not a passkey. It’s a security key. RTA.
deleted by creator
Which I would lose in a time period so short it is not yet measurable by science.
Think we have five of them taped to the wall at work.
Glassless breakglass :)
Hopefully you don’t open the door to your house with a key lol
FYI Yubico (who makes them) have devices compatible with each. You can technically use the passkey standard with a yubikey security key since it’s all FIDO2 protocols, but it’s certainly not standard
It’s just a question of device bound keys (the default for yubikeys) vs platform / exportable keys (passkeys), but the websites can’t tell the difference if you don’t tell it
RIP local sexpot.
Here is an alternative Piped link(s):
Piped is a privacy-respecting open-source alternative frontend to YouTube.
I’m open-source; check me out at GitHub.
Damn I was wondering exactly that a few days ago. Once again lovely job from eff to clarify here.
deleted by creator
Except passkeys are an Open Authentication standard from the FIDO alliance. Soooooo, not from a corporation.
https://fidoalliance.org/passkeys/
You can use passkeys in KeePassXC, if I understand correctly.
They are the equivalent of using a hardware key like YubiKey or SoloKey, except the passkey is stored on your phone/PC instead of a USB thumbstick.
deleted by creator
Except Google was only mentioned in terms of whether or not they support it.
You’re commenting on an article from the Electronic Frontier Foundation, an organization dedicated to fighting for internet and digital freedoms, about an open standard that has only just begun being implemented widely.
Look, I hate corpos as much as anyone, but please let’s please tone down the alarmism.
I’d like to thank you for providing context to reactivism based solely on an emotional reaction without doing any research first.
I am guilty of that as well, but you put effort in, explained things and that takes time. Thanks.
