Passkeys are one exception to the familiar pattern of “we give you more SeCuRiTY so we can spy on you more and control your behaviour better”. They actually are more secure. Problem is, a lot of technical issues with it still, a ton of stuff not working correctly yet
Unless I’ve missed something big, passkeys are pretty easy for me if the website supports them imo.
Using KeePassXC, I click register on the website, register the passkey with KeePass, then it just works when I need to authenticate or login. My database is then synced across all my devices.
Passkey support is yet to come to KeePassDX on Android though, so I’ll be awaiting that feature
For me it’s just inconvenient to have to type my computer’s login, but the fingerprint on the phone is nice
On the contrary i want more services using passkeys instead of 2fa methods that are less secure (sms).
Passkey is “something you own” right?
I have something I own, it’s a Yubikey
I thought passkeys had to be behind biometrics, so “own” + “are”?
How i interpretted it is that the biometrics provide access to the tpm which is like a built in yubikey you “own”.
My primary and backup yubikeys: “Am I a joke to you?”
Of course, yubikeys implement passkey… Passkey is the new buzzword after lackluster success with the words used, webauthn…
ITT: people who think only SMS, email and TOTP exist as 2FA.
And people who think only your phone can be used as passkey.
When those are the only options given by some services, yeh it kinda is. I’d love to be able to just use my flipper as a u2f for everything, but unfortunately most websites are all “no” and you have to use a chrome browser instead of Librewolf even when you could use a yubikey, so fine I guess text me, oh whoops I changed my number and I’m now locked out of my acct, cool.
I just wish Google would stop overriding my passkey on Android for specific apps including their own.
Passkeys are phishing resistant, or so they say… but the web app still needs to let you in with password + 2FA… So I’m not sure how much that’s really worth.
I guess if the users are typically never seeing a 2FA prompt then it should be more suspicious when they see one?
I have no idea what a passkey is and I will probably only learn what it is when they become mandatory
I will just use passwords + 2FA for the moment
Passkey is essentially a branding of webauthn. Instead of typing some code that changes, you just do something with some sort of device or key manager.
Plug in a yubikey and touch the button to authenticate. Easier.
There’s been a lot of pain in the attempt to portray it as “Just click the passkey button, and that’s it! Your login is secured for life!”
No - Buddy. It is secured for this one specific device that I have biometric authentication for. What about my computer? What about my other computer that isn’t on the same operating system? I have a password manager that stores these things, why didn’t you save to that when I registered? Why is it trying to take this shit from my Apple Keychain when it’s in Bitwarden?
And, the next ultra-big step: How would a non-techie figure this shit out?
I use both Bitwarden and Apple’s native Passwords.app and just save a passkey for each app. Usually you can name the passkey on the website/in the app as well.
This is also the system I use when saving 2FA TOTP codes as well so I guess I’m used to it, but it makes good sense to me to have reduncancy in my password apps. Also I lock up *the apps themselves* with passkeys in the respective app for ease of use.
:mastozany:For some people it is that easy.
When it is saved to a cross-platform password manager, it is secured on all devices that password manager runs on including your computer on other operating systems. You can also choose other in the OS prompt & redirect to a device with your passkey or use a hardware security key (I don’t). If your preferred password manager isn’t the primary one on all your devices, then fix that or use the other option mentioned before.
How would a non-techie figure this shit out?
The same way they figure out passwords & multifactor. Their pain isn’t ours for those who’ve figured this out & have a smooth experience.
I mentioned Bitwarden in my comment, and my frustration specifically comes from occasions that I had Account X ready in Bitwarden, started up an app that relied on Account X, but loaded an HTML login page that had no discernable controls to use that Bitwarden passkey; expecting entirely for it to exist in my Apple keychain, which I never use.
I think it’s very easy to claim this specific app / account was not implementing passkeys well. But if that’s the case, how can I guarantee any other accounts I move over won’t fuck it up somewhere? I haven’t seen anyone get the concept of passwords wrong, and even if they don’t understand how managers work, I have control of the copy-paste function and can even type a password myself if needed.
This was roughly the state of affairs before but the state of things have relented where software password managers are now allowed to serve the purpose.
So if a hardened security guy wants to only use his dedicated hardware token with registering backups, that’s possible.
If a layman wants to use Google password manager to just take care of it, that’s fine too.
Also much in between, using a phone instead of a yubikey like, using an offline password manager, etc.
I have my passkeys saved in 1password. (With a yubikey as backup for important things).
No - Buddy. It is secured for this one specific device that I have biometric authentication for. What about my computer? What about my other computer that isn’t on the same operating system?
Then use a Yubikey.
I tried a yubikey but most websites want you to use the pin for that which requires windows hello, and if you reset windows you lose that.
OnlyKey seems to be a better choice than Yubikey, from what I can see. The only reason I haven’t switched is that I have a few accounts that I share with my partner, and I want to be sure that I can have two different keys work for the same account.
I just looked over their site and other than a physical pin, it looked basically the same to me. Can you tell me what seems to be better? Only issue I’ve ever had with Yubikey was NFC use to log into Bitwarden, but I think it was user error.
Bitches don’t know bout my awesome passkeys. It’s like ssh key authentication for web apps. Just save the passkeys to my password manager & presto: use same keys on all my devices.
It replaces opening a TOTP app to copy a token with a click to select the passkey in a prompt from my password manager.
Ancient meme
The amount of people in this thread that don’t understand passkeys surprises me. This is Lemmy. Aren’t we the technical Linux nerds of the Internet?
You understand that technical people often are the least likely to trust new technology and are often stuck in the mud when it comes to technology? Doubly so if you are anti-corporation. It seems anything that isn’t the Unix way of doing things can be questioned.
There is a good meme about people who love technology vs people who actually work with the stuff. The former using IoT devices to turn their lights on while the latter uses a light switch and has a gun in case the printer starts making weird noises.
Good point, and I love that meme.
2FA is just dead simple. I contact you, you contact me, handshake achieved. If you call me out of the blue I raise the alarm. If you get a login attempt with a failed handshake you raise the alarm.
Putting it all behind a pop up screen just isn’t trustworthy to the human brain.
SMS 2FA is notoriously compromised by various means.
I’m not debating that.
TOTP 2FA is less secure than passkeys. 2FA TOTP keys can be phished. Passkey authentication cannot be phished. This is a security improvement which can make people completely immune to phishing attacks. That’s huge. And it doesn’t have any privacy risks, no loss of anonymity. It’s an open standard.
This is, objectively, a rare example of new technology which will make the world better and safer for us.
I get that, the problem is human psychology.
Yes, this point exactly, thank you for explaining this.
But I also worry about new areas of weakness with passkeys - anyone accessing the device with the passkey on it, or hacked that device, gets access automatically to the accounts. Also if logins are too fluid I worry that anything out of the ordinary during sign ins won’t be noticed.
yeah that’s totally true, but usually modern devices ensure that the passkeys are protected with a PIN or some biometric security, so I think it’s at least as strong as having a password manager on your device that can be unlocked with a PIN.
not really sure what you mean about “out of the ordinary” logins - it sounds like you’re thinking about phishing risks? but remember - passkeys cannot be phished. they verify the identity of both sides of the authentication token exchange - the server verifies you, and you verify the server. If you only use passkey authentication, you are safe from being phished. the most secure system would be one entirely without passwords/oath totp
Passkey is multifactor: something the user has (key), something the user is (biometric) or knowns (password) to unlock the key. Yes, dead simple.
Yup, I’m not talking about the actual tech. Rather the human perception of it.
2FA is great, right up until you’re also the victim of a sim swap attack.
2FA is not SMS. SMS is the least secure, shittiest, and simplest form of 2FA, designed as the bare minimum for the average chucklefuck. Everywhere implemented it hastily because the average idiot still uses the same password for everything. It should be illegal as the only form of 2FA, but our governments are run by criminally corrupt dinosaurs.
Fun story! Back in 2017 I tried to remove SMS 2FA entirely, and switch to a data only mobile service. I use 2FA everywhere it’s available, but was able replace SMS with TOTP everywhere except banks, even on big tech platforms where you could only activate TOTP after adding a mobile number and enabling SMS 2FA (you could then remove the mobile number). I ultimately had to keep the voice service because banks required SMS 2FA, with no alternatives beyond their own custom 2FA apps, that can only be registered by SMS. Almost a decade later I have more SMS 2FA than ever before.
The moral of the story is we live in a clown world capitalist dictatorship.
Text has always been insecure. An authenticator app is better.
The synchronization part is the annoying part. And when you have multiple accounts on one site you can end up with multiple passkeys for it.
I thought passkeys were supposed to be more secure?
They’re using the same standard as FIDO2 / WebAuthn hardware security keys. The protocol is phishing resistant, unlike TOTP and similar one time code solutions.
I prefer the physical ones, because they’re easy to organize. Passkey synchronization can be annoying.
I use passkeys through 1Password and it’s vastly less irritating to me than anything involving passwords, especially 2fa. I really don’t like having to wait for email to arrive or copying down digits from a text message, which seems to be how 2fa typically works 90% of the time.
Y’all are my people.
