What the !#@% is a Passkey?
What the !#@% is a Passkey?
A new login technique is becoming available in 2023: the passkey. The passkey promises to solve phishing and prevent password reuse. But lots of smart and security-oriented folks are confused about what exactly a passkey is. There’s a good reason for that. A passkey is in some sense one of two (or t...
Missed opportunity for "What the eff is a Passkey?"
That is truly amazing. (Golf clap)
Thank you. That was the very first thing I thought.
You’re still entering the password or pin for your password manager. I genuinely do not see how this is better. It’s simply an alternative, not an improvement.
-
Password managers are, generally speaking, far more security conscious than the average website. I'd rather send a password to my password manager a couple times a day than send passwords to every website I interact with.
-
One click to confirm vs. 2-3 to autofill. Tiny gains in speed 🤷♀️ If you make a password manager even slightly more convenient than just using
gregspassword123for everything, you can onboard more normies.
-
You're entering your password into your password manager, which is stored by a company or entity whose entire job is to keep it secure. You're not giving your password, in any form, to the website or service you're accessing. When the website gets compromised, your hashed password is not in a database waiting to be cracked. All the attacker gets is a public key they can't use for anything.
The biggest difference: nothing sensitive is stored on the server. No passwords, no password hashes, just a public key. No amount of brute forcing, dictionary attacks or rainbow tables can help an attacker log in with a public key.
"But what about phising? If the attacker has the public key, they can pretend to be the actual site and trick the user into logging in." Only if they also manage to use the same domain name. Like a password manager, passkeys are stored for a specific domain name. If the domain doesn't match, the passkey won't be found.
https://www.youtube.com/watch?v=qNy_Q9fth-4 gives a pretty good introduction on them.
Here is an alternative Piped link(s):
https://www.piped.video/watch?v=qNy_Q9fth-4
Piped is a privacy-respecting open-source alternative frontend to YouTube.
I'm open-source; check me out at GitHub.
If you're using a hardware token like a YubiKey then you do need to enter your PIN before being able to use it.
The main benefit is that you cannot extract the Passkey from the secure element (the token cannot be transformed from what you have to what you know) and it cannot be phished through a fake domain as the challenge-response will not match.
I like the yubikey bio series so you use a fingerprint on the key itself. Fido2 only right now
Passkeys are asymmetric, meaning that the server only ever sees your public key. If the server gets breached, then only your public key is leaked, which isn't a big deal. Functionally, it's almost identical to SSH keys.
And all of my tech challenged family screamed out in unison, “What’s the fucking 1Password password again?!”
Wife: I don't remember my {service} password.
Me: Did you put it in {password manager}? We have a family plan.
Wife: groans I never remember it. What's the password?
Me: How would I know? It's your password.
Wife: ruffles through desk, picks up tattered handwritten note. Aha! Here's the {service} password. Same as {30 other sites}.
Me: slowly bangs head on table
[ Repeat once a month]
Password managers are also updating to allow login with passkeys. I would give each family member a physical key that unlocks the rest. Since there are multiple, someone losing one isn’t a big deal and access can be revoked.
You don't have to memorize a ton of passwords for multiple sites which helps prevent password reuse. Whatever you use to decrypt your passkey or password is not transported over the network.
It's not foolproof of course but it's a huge improvement.
Because you don't send a secret value, you only send a cryptographic asymmetric single use value which is safe to disclose
Because it's for your website logins. It just stores the key and auto logins.
Someone on slashdot correctly pointed out that these are only single factor on the server end. You enter a pin to unlock the device, the server can check if the device says you unlocked it, but there is no sending a second factor to the server. If a device was hacked to get the keys, or just says to the server that you presented a pin but didn’t really, the server has no clue. Passkey + TOTP would be multi factor on the server side.
TOTP generated on the same device as the passkey is not a secondary factor. It will have been compromised together with the passkey.
For passkeys, the secondary factors are used to access the passkey vault, not auth to the server. And these secondary factors should be a master password, biometrics, or USB keys. TOTP and SMS are out.
I understand how it works, but again, it is not two factors being used to authenticate to the server.
It is a single factor being used to access the vault. The server has no way of confirming this actually happened, the device just tells the server it has happened. A single factor is then used for authentication. This seems especially worth knowing since most cell phones deliberately weaken the security by sharing them between devices.
Passkeys would preferably not be stored on the same device as a secondary factor used for authentication. Hardware tokens have supported them for years at this point, they can also hold TOTP keys instead.
[This comment has been deleted by an automated system]
This is where PAKE algorithms for secure password checks fits in
The second factor doesn’t necessarily exist, since you’ve moved all of that to the client side now. It entirely depends on implementation and that the implementation is done correctly and is honest. The server only knows that you have the key, it’s single factor authentication.
In the past, it verifies that I know the password and that I have a key on the server side through separate challenges.
It’s still way better than username / password, it just has new (more difficult) vulnerabilities.
Passkey plus TOTP doesn't really make sense (they're both client side cryptographic keys, you don't need two protocols), at least use a PAKE algorithm with a PIN instead if you want the server to be able to check the user's knowledge of a secret without sending it in a readable form
I can see the "phone falls into the toilet" as a big problem that people will have.
Use a password manager that implements passkey like Bitwarden that syncs up to a server. Or you can host your own Bitwarden sync server with Vaultwarden if you don't like the thought of a cloud sync.
As far as I know the Bitwarden browser plugin for Firefox does not yet support WebAuthn/Passkeys, as it's still on the September release. Chrome is already on the October version. A build of Vaultwarden from yesterday onwards should support storing it, once your browser is ready.
It's already a huge problem now. Lots of people only have one auth device they depend on for everything. At least passkeys come with standards which should help spread the use of vault sync and backups and hopefully those practices become the norm.
They mention it in here. I don’t know about Android, Apple synchronizes them between devices. The way they do it seems pretty secure but it is still less secure than the keys being untouchable. Using multiple will be a necessity.
Yubikey ftw
Permanently Deleted
FYI Yubico (who makes them) have devices compatible with each. You can technically use the passkey standard with a yubikey security key since it's all FIDO2 protocols, but it's certainly not standard
It's just a question of device bound keys (the default for yubikeys) vs platform / exportable keys (passkeys), but the websites can't tell the difference if you don't tell it
Damn I was wondering exactly that a few days ago. Once again lovely job from eff to clarify here.
RIP local sexpot.
Here is an alternative Piped link(s):
Piped is a privacy-respecting open-source alternative frontend to YouTube.
I'm open-source; check me out at GitHub.
something from a corporation that cannot be trusted?
Except passkeys are an Open Authentication standard from the FIDO alliance. Soooooo, not from a corporation.
https://fidoalliance.org/passkeys/
You can use passkeys in KeePassXC, if I understand correctly.
They are the equivalent of using a hardware key like YubiKey or SoloKey, except the passkey is stored on your phone/PC instead of a USB thumbstick.
They are fine, just ssh public private keypairs but for "the web".. worse than fido2.. so not really sure why they are being pushed so much above fido2
They are FIDO2. This is the passwordless stuff yubico has been talking about and working on for ages, plus a marketing name.