- cross-posted to:
- linux@lemmy.ml
- cross-posted to:
- linux@lemmy.ml
A rebuttal to an anti-passkey, pro-TOTP post that has made the rounds on Lemmy as well.
You must log in or # to comment.
The biggest problem I have with passkeys is big companies aren’t implementing them to improve your security - they’re implementing them because it absolves them of liability and responsibility for implementing good security on THEIR end and allows them to implement whatever the fuck vibe-coded bullshit nonsense they want without any knowledgeable or skilled staff, and even if it’s good for me too, I’m not inclined to do these assholes any favors. It’ll just make them sloppier and lazier on other elements of security and they’ll turn around and put the blame on the user, and courts will go right along with it because nobody in the legal system can find their asses with both hands.
Using established and tested security implementations instead of rolling your own has been considered good practice since forever. It’s not a bad thing.
It’s not about the implementation - it’s about what passkeys do and don’t do.
Passkeys prevent someone from stealing hashed passwords from the SERVER, but if the server is already compromised badly enough to let someone in, all of the data stored on that server is compromised already anyway. Companies want to use passkeys because there is less involved in implementing secure login credentials, but that is only ONE tiny part of overall end to end security, and I do not for a SECOND believe that they are going to keep on highly skilled, security-minded developers at real salaries when the C-suite says “We’re using passkeys. We’re secure. Fire the high priced developers and get me some interns who can use Claude.”
TLDR: Passkeys are not a magic bullet and they aren’t a game changer, and the false sense of security they push is dangerous.
I realy dont think that’s a thing. End-user login security is a tiny footnote on page 729 of the 2000+ page security document of a large company’s cyber security department. Switching that to passkeys will not change anything about how the company handles security. AI will. But not passkeys.
And as we have seen many times, companies have been bad with security already and many password databases have been breached. Having a tool that limits the impact of bad security is a good thing.
Let’s get back to after 10 years because this was the same debate about drm in browsers and now we have this https://www.w3.org/TR/encrypted-media-2/
But they are annoying. Like it’s fine if you only use one device, but I don’t fucking know where my phone is, that’s why I am on my laptop
Agreed, but it can be better, with open solutions.
If you use a popular open source OTP solution (like Aegis), you can export your tokens (carefully) as an encrypted file from your phone, and then import them to another popular open OTP solution on the laptop.
Alternately, one can also set up each separate device as a separate authorized token for each service - for many services.
I like the import/export solution, because even for services dumb enough to only allow “one token”, I can still have that token on two or more devices.
After reading both of the posts, I’m kind of back where I started with passkeys: neutral. I’m pretty happy with my current setup of a self-hosted password manager, diceware master passphrase and strong, unique passwords for every account, along with an open source app for TOTP. I only ever see passkeys pushed on me for work-related accounts anyway, but I’m not using them there either. I do have a question though if someone can answer: are passkey protected logins also vulnerable to stolen session cookies?
are passkey protected logins also vulnerable to stolen session cookies?
Yes. 100% unchanged.
So it’s fair that you are neutral about them for your own use, clearly you know what you’re doing. It doesn’t make sense to be neutral about them, generally. On usability alone they are not good. There are so many people who don’t have a clue how they work, or their consequences, and just click okay when continually harassed into using them. Some will even go ahead and save one on a shared computers, or someone else’s, ‘because the website says so’.
Honestly, I don’t understand them well enough to recommend them either. I do IT, and I set my users up with a (managed) password manager and MS Authenticator. If I encounter a situation where a user has ended up with a passkey for a given service, I just leave it be. On the other hand, if someone is locked out because of a passkey, I reset it and get them set back up with the Authenticator app.
Hmmm, for someone complaining that another post makes logical leaps, this one has a pretty glaring contradiction that severely undermines their own argument:
The post is predicated on the idea that a feature of WebAuthn called “attestation”, which is only used in high-assurance and usually corporate scenarios, and usually with physical hardware security keys, will be leveraged to hurt people, somehow. The post posits that a website like X will bait and switch users: first, you get a passkey. Then, later, scary “attested” passkeys! This simply isn’t possible to do because attestation isn’t supported on the web for mass market, consumer authentication. Attestation for passkeys (software-based, syncable credentials) is antithetical to their mass market goals, and would freeze out independent, non-corporate-backed credential managers. It’s an explicit non-goal of the designers of passkeys, who work together in a forum anyone can join. And trust me, websites and apps like banks repeatedly asked for attestation at the beginning of the industry’s passkey journey. The platforms, browsers, and credential management apps have held firm that the goal of passkeys is reducing phishing and not some kind of trusted computing scheme. (And I will note: over my dead body!)
In other words, “attestation is bad and everyone is against it, but it’s a feature of the standard.” What they are really claiming is that there is something that for now is stopping governments and corporations from pushing attestation, but how long will that hold? I didn’t have a horse in this race when I first started reading these posts, but this counter-argument is flawed and it makes me lean toward the camp against passkeys.
It reminds me of when Netflix was big and I told everyone they’d have commercials eventually. Sure you can still buy a plan without commercials, but I suspect that eventually, when money gets really tight for them, will go away.
Same thing here. Right now passkeys are “open”, but who is to say my bank won’t require a Apple/Google managed passkey in the future. Hell, I can’t run the bank app without running a Apple/Google approved apk.
Sounds like something BigPassKey would say
Passwords are protected (for now) by the first amendment. You can’t be compelled to tell what it is. Passkeys can be seized with a warrant. This only matters in the US but it does matter and I literally never see that addressed.
That’s not really a bash on passkeys so much as it is a bash on storage methods. Anything with a password that is not no knowledge encrypted is at the exact same risk because the password doesn’t matter to the company the warrant is issued to.
Edit: You may be right about that. I spoke too soon.
Fourth amendment protects against unreasonable search and seizure. That applies to passkeys. First amendment protects speech, that’s what protects your password. You can’t be compelled to tell that because you can’t be compelled to say things, not because there’s any protection against the data being seized. IANAL, feel free to go into more detail if you still disagree
First time I am reading people orate their passwords🤣😂🤣😂🤣
Now you’re going to tell me the US has free press🤣😂🤣😂🤣🤣😂
Reads like Ricky Mondello stopped explaining half-way through why the other essay’s “theory of the case being fundamentally wrong.”
Attestation for passkeys (software-based, syncable credentials) is antithetical to their mass market goals, and would freeze out independent, non-corporate-backed credential managers. It’s an explicit non-goal of the designers of passkeys, who work together in a forum anyone can join.
The web wasn’t supposed to be controlled by corps either, and look where we are now.
If passkeys were to follow the same path as the web, here’s what it would look like. Corporate passkeys get the most users because of OS integration and convenience. Now that they have all the users they can commandeer the standards, and make them so complex and evolve so quickly that non-corporate implementations can’t keep up (think Firefox vs Chrome). Corporations convince websites to drop support for outdated passkeys, citing security issues. Non-corporate implementations are locked out. Monopoly is established.
And now that passkeys are centralized to corps, the government can exert power on them, mandating hardware attestation for things like hardware-backed id and age verification. They push for backdoors, so they can log into anybody’s account. Bye bye privacy.
Question: Why did these corps implement TOTP? You should be able to answer this from an economic perspective of them trying to save money.
Another question: why aren’t these corporations locking down TOTP to restrict them to their own validator apps, in the same way you’re proposing that they might do for passkeys?
Why did these corps implement TOTP?
To reduce support load from people getting their accounts hacked and asking support to get them re-instated. I don’t doubt that these incentives also drive the push for passkeys, but passkeys are much more opaque and tightly integrated with the OS, and is thus more vulnerable to centralization.
why aren’t these corporations locking down TOTP to restrict them to their own validator apps
They are. Authy is the biggest offender I know.
Edit: some info about how Authy locks you in: https://www.bentasker.co.uk/posts/blog/general/switching-to-aegis-for-totp-codes.html. Note that some websites integrate directly with Authy and force you to use Authy to set up the TOTP. The only way out is to use a rooted phone to transfer the codes to another app like Aegis.
what makes passkeys any different from all the other times they have embrace, extend, extinguished? what, fundamentally, stops them from using attestation in the exact way the user described? specifically, what stops the following scenario from playing out?
- passkey support becomes commonplace across the web
- many websites stop using passwords due to their inherent security issues
- most users (for brevity, say 90% or more) just use their OS to store passkeys because it’s easier
- apple provides attestation for passkeys stored in the Secure Enclave
- google provides attestation for whatever their business goals are
- google refuses passkeys that aren’t attested due to their “security issues”
- apple does the same, which has the added benefit of killing devices without a Secure Enclave
- maybe PCI-DSS requires attested passkeys because of “security issues”
- maybe financial institutions require attestation (similar to the ctsProfileMatch issue with GrapheneOS)
- 90% or more of users don’t notice or care about steps 4-9
- most of the 10% or less need to use at least one account that requires such an attested passkey
- idk what happens with firefox but i’m sure many firefox users (including me) have encountered a website that could work with firefox but chooses not to (based on User-Agent or similar)
obviously that isn’t the only scenario one could envision but i don’t really see what makes this one unreasonable to expect
Once you can correctly answer the question you responded to, you’ll see why its against their material interests to EEE logins, whether its TOTP or passkeys.
well idk about you but i have the steam guard app on my phone, and it’s a pain in the ass too so it’s not that. plus, unlike TOTP, passkeys are dead simple and integrated into the OS. so i can honestly say i have no idea what you’re getting at and why it applies to passkeys as well as it applies to TOTP.
why aren’t these corporations locking down TOTP to restrict them to their own validator apps
But they do. There are TOTP implementations that have been intentionally modified to prevent using standard apps. I don’t remember other examples right now, but I think Steam Guard is one.
I’m sure a lot of people (like myself) would refuse to install a special custom TOTP app just to be able to use one site. They’re only hurting TOTP adoption by doing that, and thus increasing the amount of support resources they need to allocate to account hacking / hijacking.
I’m sure there are other companies too willing to go against their economic interests for various reasons, but they’re going to be in the minority.
Gfy
This was on hackernews this morning.
The author is in the passkey business.
The most pertinent question there imho was : What do passkeys offer that random strong passwords + a pw manager do not?
There was a wall of comments, but no concise answer.
======== You buy a new super secure lock for your house, but to get in you go to one of the 3 conveniently located HomeDepot’s in your city. You simply prove your identity to the guy there. He verifies you in the system. Then he gives you a one time pass to your house.
If its such a great idea, you can pay me now to do it for your home.
The way i understand it, passkeys test for a combination of what you have and what you are (for those that check user presence, which is all of them I suppose); whereas passwords test what you know.
From my reading, passkeys give more control to the platform/service provider, whereas passwords do the reverse.
The former clearly benefits corps in their unique ways - motivated by profit, security, data/spying and so on.
The current iteration of passkeys is not the form that is being challenged by the earlier anti-passkey post. But rather a floodgates problem. Pretending that it will never happen is asking for trouble.
The better option (be it passwords or passkeys) needs to demonstrate that it gives control to the user.
I’m in the passwords camp, I do not see what convenience or added security passkeys might provide in any of my use cases that is worth sacrificing my level of control and choice.
I’m telling you why passkeys are garbage:
Case 1
- Login to website
- Maybe use 2FA device
- Website creates session cookie
Never have to login again for the next few months
Case 2
- Go to website
- Use password manager to auto fill credentials
Click like 2 buttons and you’re done
Case 3
- Create passkey
- Passkey is stored on propietary, trust me bro, “we will never share this with the NSA or FBI” Apple or something account where you can’t export them
- User becomes dependent on cloud provider
- User will easier forget their real login data because they don’t use them
- User is fucked if account get’s locked/deleted
- User can still be hacked by simply compromising machine
- No 2FA
Passkey is stored on propietary, trust me bro, “we will never share this with the NSA or FBI” Apple or something account where you can’t export them
No. Most FOSS password managers support them, even keepass and bitwarden. You control them, you can export them as you wish, and even use them across multiple devices. I know because I do this.
Do you really believe your average Apple, Google/Android or Microsoft/Windows user use these?
No, but the “normal, worst case” usage of passwords is still far worse than even that case. Most people just re-use the same password for everything. This is why almost all companies use phone numbers and text messages as a totp now.
If we’re comparing worst usage of passwords vs worst usage of passkeys, passkeys still wins.
passkeys can perfectly be used with third party password managers. everything you say here can apply to passwords if you use the Os provided manager.
you can absolutely have 2fa with passkeys. most platforms don’t do it since it adds little value
Os provided password manager
That’s the neat point. You don’t have to use one when you enter your normal login credentials and the average user like does not use one.
But with passkeys you are forced to use one and the average user will use the default one of their vendor.
most platforms don’t do it since it adds little value
Yeah because they obviously don’t care about security (like machine compromise - that’s why there is 2FA in the first place), which contradicts all advantages of passkeys.
every single argument I’ve seen against passkeys could be said against TOTP and 2FA in general.
- SMS token: they need to know your phone number. it’s a privacy issue. also actual lock in to one device.
- MS authenticator with push notifications: actual lock in to a single app
- TOTP: you need a manager to store it, way more phishable than passkeys
and yes, you could use third part TOTP managers, but as you said, the average user wont. I dont feel any argument against passkeys is particularly strong.
Nah, lock-in is not a safety feature. 16+ random chars are plenty, and if cracking gets better I’ll go to 20 or 30 chars. My pw manager doesn’t care what strings go in it or which device opens it up.
You can have passkeys on multiple devices. I use them on different platforms for the same sites.
How do you transfer your passkey to a new device?
If you use a self-hosted password manager like bitwarden, then its there. If you use a file-based password manager like keepass, then you can use any syncing method you choose, and its no different from passwords.
not sure about every OS but the ios password app has a menu button to export them to other apps. I have exported mine to my own self hosted vaultwarden. took 2 minutes
You don’t, you can have multiple passkeys, one for each device.
ok.
How do you add a new device to your account without a password or the old device?
Password, then get a prompt about registering a new passkey.
After that I can use the passkey registered on either device.
Edit: to clarify, most sites still let you log in with a password after you’ve registered a passkey
The the account is still as vulnerable as a password.
Yes, but you’re less susceptible to phishing when you login with a passkeys.
It’s also makes logging in faster.
That’s my workflow as well 26 random characters, a yubikey (and Aegis TOTP for sites that don’t have fido or similar) and I’m good.
I like the idea of a Yubikey but there is no way it would survive more than a month on me due to the conditions where I work. And getting a physical key then not having it on my body at all times is a non-starter.
I keep my keepass .kdbx in on a webdav server and that covers any device I can think of.
Do you work in a blender? It’s a pretty solid bit of plastic, should be fine in a pocket or wherever the device you’re using it with is.
Maintenance at a blast furnace. I am exposed to acidic vapours, caustic vapours, ambient heat in the 60c range, radiant heat in the 1000c range, rock from the nanometer up to 30cm size, phenolic resins, oil mists, and metal powders. And then there’s the crawling around over, under, and between equipment.
Not every tech-savvy person works in an office.
Cool. Hope it’s ok on your health. I suppose you have some way to keep your phone safe, and don’t need to do 2FA while exposed to all of those things. You could probably wrap one up pretty well and still have the NFC work too.
Totp with a backup of the secrets/seed qr stored in a kdbx. If my phone melts it’s a 24hr problem at most.
Passkeys also aren’t lock-in. You control them, and your FOSS password manager likely already supports them.
you are required to use a 3rd party. that third party has control. you can’t switch. that is lock-in.
I’m using a FOSS password manager for like 6+ passkeys right now, on some of the biggest sites. So this is just demonstratably false.
The author of this post works in Apple, Passwords team. They do not deny that there’s attestation; they argue that it’s only used to prevent bad actors.
Cool, we’ll trust corporations then!
and they would never violate your trust and later force this onto you because the love their users.
the more apologetics for this shit i see, the less i trust it.
Agreed. Even if you trust her words, she’s only one person and Apple could override any decisions she makes.
It makes me wonder about the people in Google who worked for, maintained, and advocated the openness of Android. Only now for Google to continually lock it down.
Corporations never, ever, act badly!
It is not like they are treated as people with rights but fewer consequences for their actions, right? Right, guys?
I have a basic question, I learned that MFA should draw from multiples of “things you have” (totp) and “things you know” (passwords). There’s all this talk of passkeys replacing passwords, but aren’t passkeys in the “thing you have” category, not the “thing you know” category? My worry is that an unlocked computer or unlocked phone will let someone access ALL of a person’s accounts because now they have the thing and don’t need you at all. Putting access to my entire digital life behind my 4-9 point lock symbol? Or worse, a fingerprint?
There are actually 3 categories (though the idea of 2FA is picking 2 out of 3):
- Something you know (passwords, PINs, security questions…)
- Something you have (hardware keys, TOTP, smartcards, SMS/push-notification…)
- Something you are (fingerprints, facial recognition, iris scans…)
But passkeys collapse 2 of those into one by having the passkey algorithm include (as a step of the key derivation) a passcode or some biometric data… that’s why most passkey systems require some form of verification. Though it’s up to your authenticator which method is used.
The idea is that they Cross the Mark on thing you have and certainty on who you are saying you are. The latter comes in the Form of biometric authentication for normies Like Face/touch id
Those two categories aren’t really meaningful, but even if you consider them to be, passwords (apart from a master password for your password manager) also should never be in the “things you know” category, because then it means you’ve memorized them, and are not using a password manager to generate completely random ones.
And unless you’ve got an incredible memory that can memorize unique passwords like “+28x@!8eaEak!” for 10+ sites, then you’re likely using a pattern or single password than can be compromised.
I do consider the master password to my password manager as my “thing I know”, and not the randomly generated passwords it stores. But you’re saying that have-vs-know is not really important in the security space, that was mostly just a handy shorthand?
so are passkeys just a simplified workflow version of the complicated dance I have to do on windows to get git commits to push easily with the public key from putty-gen? But also the private key is sometimes locked to the device it was generated on? I guess I should read some actual technical docs on em.
I have been hesitant in the same way. I have not until recently understood where the passkeys are stored, and then understood that they then become a “thing tou have”. The passkey is stored on my computer, I prove I have access to my computer, and that is the authentication.
I am still hestitant since it often is just one factor, and I feel I have to manage them much more carefully.
