this post was submitted on 11 Aug 2024
2 points (100.0% liked)

Privacy

31182 readers
1812 users here now

A place to discuss privacy and freedom in the digital world.

Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.

In this community everyone is welcome to post links and discuss topics related to privacy.

Some Rules

Related communities

Chat rooms

much thanks to @gary_host_laptop for the logo design :)

founded 4 years ago
MODERATORS
[email protected]
[email protected]
[email protected]
[email protected]
2
What are your thoughts on passkey login? (lemmy.world)
submitted 1 month ago by [email protected] to c/[email protected]
11 comments fedilink hide all child comments
 

A lot of services support passkeys. Microsoft even has an option to make my account "passwordless". Since they are more secure than passwords, will you be switching some / most of your accounts to passkeys any time soon? Interested to hear everyone's thoughts on passkeys. 🔑

top 11 comments
sorted by: hot top controversial new old
[–] [email protected] 3 points 1 month ago* (last edited 1 month ago)

Passkeys as password replacements reduce the total factors required to login to a service. If you use 2fa for all your services anyway then passkeys are a downgrade. That's why so many people are angry they are having security options removed.

For people who use the same username and password everywhere, then passkeys are a upgrade.

So normal people get a benefit from passkeys in exchange for getting locked into a ecosystem.

For security minded people I hate passkeys.

  • Less factors to login
  • Discoverable
    • Unlike fido2 webauthn the service the credentials attach to have to be known, so if anyone steals your hardware key, or gets access to your phone they can see all the passkeys and accounts you have

I WANT my logins to be something I know, something I have, and something I am. Password, hardware key, biometric unlock of key.

I don't mind passkeys existing, but I HATE that services are replacing hardware key flows with passkey flows. I want to use my hardware key as fido2 not as a passkey. I don't want to downgrade my security! Microsoft makes it impossible to use a 2fa hardware key as a second factor now, only as a passkey, that's strictly worse then before.

[–] [email protected] 2 points 1 month ago (1 children)

passkeys were invented for vendor lockin and will be used to add friction to migration, say if you wanted to move from apple to bitwarden well sorry you can't. fido originally made the protocol to sell their dongles and fought like hell to keep them off smart phones, platform vendors are only interested in this to lock you into their system too. there is absolutely nothing wrong with normal passwords.

[–] [email protected] 2 points 1 month ago

Random passwords and MFA all the way!

[–] [email protected] 2 points 1 month ago (1 children)

They’re FIDO keys but bad.

Here’s a great blog post from someone who knows what they’re talking about: https://fy.blackhats.net.au/blog/2024-04-26-passkeys-a-shattered-dream/

[–] [email protected] 2 points 1 month ago

Very enlightening read. That service lock-in is so real. I had some passkeys in Google Password manager (Android) just to try them out, and then wanted to move them to Bitwarden. I had already disabled Google Password manager on my phone to use Bitwarden. Imagine the headache I had to deal with to move a single passkey over to Bitwarden (really, I deleted one and added one, while dealing with UI hurdles). Until this improves (if ever), I'll probably stick to my passwords and normal 2FA.

[–] [email protected] 1 points 1 month ago* (last edited 1 month ago)

Was about to post the great blog post from my bookmarks, but another commenter beat me to it (t y !). Here's comments on that blog post on Lobsters and HN :

[–] [email protected] 0 points 1 month ago (1 children)

I use a password manager. I don't care about it. Passwords are reasonably secure.

[–] [email protected] 0 points 1 month ago (1 children)

Passwords can be leaked, mostly by bad security on server side.

Passkeys use secure keys, it checks public keys on both sides and send private key to authenticate, without both keys can't login or if the server is compromised.

It's like GPG or SSH works.

[–] [email protected] 1 points 1 month ago* (last edited 1 month ago) (1 children)

Close but private keys don't get sent.

It sends information encrypted via your public key to your client, then your client proves that it's the real owner of the key by decrypting the message, and then sending a new message back encrypted by the private key that the server can then verify.

This is what's better than a password, the information for providing authentication (the private key) never leaves your computer (where as you almost in all implementations of password based auth, send the password itself to the server).

[–] [email protected] 0 points 1 month ago (1 children)

A question, since you sound like you know what you're talking about. Is this analagous to password-free SSH? I.e., private key used to log in on the basis of a pre-agreed public key?

[–] [email protected] 1 points 1 month ago

Yeah basically. See "What is a passkey" on https://fidoalliance.org/faqs/#PasskeysFAQs

From a technical standpoint, passkeys are FIDO credentials that are discoverable by browsers or housed within native applications or security keys for passwordless authentication. Passkeys replace passwords with cryptographic key pairs for phishing-resistant sign-in security and an improved user experience. The cryptographic keys are used from end-user devices (computers, phones, or security keys) for user authentication.