- cross-posted to:
- security@lemmy.ml
- cross-posted to:
- security@lemmy.ml
cross-posted from: https://lemmy.bestiver.se/post/1390699
You must log in or register to comment.
This is another way they’ll lock out Linux as an OS. It won’t pass passkey attestation or age check attestation so it just won’t be allowed to access the web because clearly you’re a bot or some other bad actor for failing those.
That or they’ll create a special government backdoored and approved Linux that has attestation in among a bunch of other blackbox modules that you have to trust aren’t an NSAKEY right into your system.
The future looks so bleak with all this online, Flock, Axon, etc cameras IRL controlling all movement and all fed into Palantir for one online and offline profile of you for the police state.
Basically the problem is that Passkeys are designed to allow a particularly bad enshittification once everyone uses them. So it’s not about downsides of using them now, but about them being used in general and then abused.
I like the article and agree with the problem, but I’m skeptical that this works as a strategy to fix the problem. First off, individual responsibility or boycott doesn’t really work. Most people will just use what their phone gives. Second if the corporations do want to do this, they could implement it separately in their apps, like twitter or google chrome requiring quasi-attested “homebrew” passkeys stored in cryptoprocessors. Ultimately I do not think we have any power to prevent them from doing that.
The time of democracy and pluralism is over. We’re already seeing the author of the article being maligned and personally attacked for talking about AI - how dares he? On all fronts we have lost the culture war and lost power, economic power, information power like access to truth.
Passkeys give me anxiety because it’s like “Hope you can go the rest of your life without a phone or USB drive getting lost or stolen LMAO”
Passkeys are intentionally badly designed but as long as you use them with an open source password manager they can be an immense security improvement. Alternatively if you’re using a cryptographic USB token register a second passkey in your password manager.
Corporations want what they’re terming phishing-resistant passkeys, which have two approaches: hardware-based or synchronized passkeys. If they are forced upon us for certain services or jobs, the least harmful to a worker is a synchronized passkey. Password managers like Bitwarden support this, so that you don’t have vendors and employers tracking your cell phone. If an employer uses something like Microsoft, the administrator settings may not allow synchronized passkeys…but at least we can advocate for them when these auth methods are forced upon us.
Please just stop using a service when it gets unbearable. There is no online service you -need- except maybe bank and tax stuff.
The problem isn’t you or me, the more technically aware… it’s when the majority of users switched to passkeys and then subtly get switched to attested passkeys and sites don’t offer other choices. Once the majority are under-thumb, sites won’t have a reason to offer open solutions to the same number of objectors.
Yeah the technology is cool but I stay away from passkeys and tell people not to use them because there’s too much room to permanently screw up.
Maybe they’ll remove the non portable type from the spec or roll it into an enterprise equivalent like with ad.
dude speaks about not being able to write down his passkey, then he acts like it can only be saved in bigtech clouds, then some random ai rumbling starts about ads being show to us? can you guys stop posting these god damn fearmongering password articles written by ai?
It’s wild seeing people spaz out over passkeys, clearly venting at something that isn’t passkeys.
Despite the attention-grabbing headline, the only negative thing I can find in the article about passkeys are this section:
Attested passkeys7 are the last but most important type of passkeys you need to know about. These types of keys use what’s known as remote attestation to cryptographically verify – using the aforementioned tamper-proof cryptoprocessor that lives in all your modern devices – that you are using one of the several approved passkey managers, and not using a custom one that you vibecoded yourself and which can lie.
This is the feature that means you no longer get to make the calls about your passkeys. Fortunately, attested passkeys are not yet required on most websites.
I don’t see why we should assume this hypothetical is going to happen. There is a lot of different software that supports passkeys (I use keepass for example), and going against the open standard and forcing all their users to use a specific software would basically make them unusable.
Overall every password / login style has its dangers and bad ways to use it, including passkeys. That doesn’t make them “traps”.
Ooohh, don’t think corpos and banks won’t go for that hypothetical. A lot of apps already turn haywire if you have developer options enabled, accessibility options enabled, have a specific installed or using a custom ROM. If the optional attestation is enforced by your bank that they only accept passkeys from google’s password manager or apple passwords, then using something like Keepass or Bitwarden isn’t an option.
Look… I love passkeys. They are convenient and more secure. But if a service cares about on what device and software it was created then it is pointless and just an ecosystem lockdown mechanism.
The only area I could really see this taking off is with internal company stuff. Like forcing employees to use a very specific and weird way to do 2FA is already a thing in a lot of companies. They won’t let you just use any old authenticator app. You need the “special” one that sucks ass. So maybe they’ll do the same to passkeys, but for normal users I don’t think they’d do that. Users are way too bad at doing things. It would cause too much of a tech support burden or just user bleed.
finally people are waking up to this garbage.
I didn’t even know what they were until now. And still don’t. Every explanation sounds like a long convoluted MLM pitch. They smell fishy as hell. They may need more grameters to prevent side fumbling.
Zero trust is the end station, if you allow organizations to treat your personal devices as being theirs. Organizations that could actually benefit from the increased security (which isn’t Twitter, except for some high-profile individuals, maybe), should provide the user with resources to do so, at their expense (issuing a dedicated TOTP device for example).
But what tends to happen instead, is enshittification of service, while offloading it onto the client. A similar trend can be observed with car parking: where operators remove parking meters, and require the customer to use their device and data plan, to make a payment to the operator…
We’ve been on this trajectory for quite a while now: from Outlook enforcing IT-policies of email administrators (dictating screen locking requirements as device administration app), to SMS-based 2FA requiring one to have a mobile phone number and tying all to this tamper-resistant identifier. So why not a black box snitch, paid for by the client, further restrict their freedom for “security”?
It seems perfectly in line, and I think this article draws all the right parallels.
So… Uh… What’s a passkey? The article is saying they’re pure evil. Everyone here is saying they’re good. Everyone knows what they are except for me.
What’s the difference between a passkey and a password?
Imagine if a romantic partner said “I will send you a unique string, probably exactly 8 characters” to verify that I am your partner. You would laugh and remind them it takes less than a second to generate every 8 character combination possible.
Instead, your SO makes a key and keeps it with them at all times, and you promise to talk to them using a machine that makes secret messages only their key can decipher. For fun, they give you a key and make a machine too… Explaining this shit is complicated I’m sorry for what you’re about to read.
They send “heyy”, You send “whatup”, They send “send pics”, You take one, encrypt and send the pic, They say “huh? Wtf?”, You remind them about the secret key, They have no idea what you’re talking about -fail OR they send something in return back (which you decrypt) -success
That’s basically the same thing as authentication with a passkey oversimplified and only slightly wrong but good enough. There’s shitloads of devices that do it, yubikeys, authenticator apps, but they’re all doing that.
It’s something you pass around–like a word, but a key instead. If you’re familiar with passwords–instead of a word–imagine a key: a passkey. That’s what passkeys are. The issue with passkeys is–as you pass them around they begin to open more and more stuff; everyone is opening stuff with your key as it’s passed. So they need to be sanitized every now and then. Deposit them into a furnace and buy a new passkey. Every two to three days. If you have more questions please feel free to ask!
Okay. I think I’m understanding. A passkey is a virtual key? That we have to buy? And some company makes these virtual keys? And there’s a virtual locksmith who makes virtual locks? And you have to hire them to install them on your computer? Is this what’s going on?
I apologize. The reply you responded to was entirely satirical. It was written in frustration. From my point of view passkeys are the way to do authentication. More specifically public-key cryptography. It has a lot of desirable qualities. Governments and ‘tech platforms’ should have been using it from the start–we’ve had the software to do this since the 1980s and it was libre-software by the 1990s.
Any criticism of passkeys (as brought up in this thread) are more so applicable to the private-dictatorships that are Microsoft, Apple and Google. The contrary behavior of continuing to use these private-dictatorships whilst decrying passkeys is tantamount to hypocrisy? stupidity? To give a tiny bit of context: the quality of attestation in passkeys are also applicable to SSL-certificates, yet no one is decrying SSL-certificates. It’s also applicable to every GNU/Linux distribution and libre-software at large.
That’s to say the criticism is written from a place of ignorance. “Privacy” forums on the internet are not interested in reality. Their users are full of users with static behaviors. More often than not any questions asked in these places amount to “how can I continue doing what I was doing before? Big-corp has introduced a change I don’t like. I want to do the exact same thing on big-corp that was previously permissible.” When the factual observation is stated: “big-corp is a corporation designed for surveillance-capitalism therefore if you desire liberty and privacy whilst computing you cannot use such a corporation in any manner” it’s met with unfounded hostility, hypocrisy and lies. Any use of such software is contrary to your stated desire: digital-privacy. Even when responses illustrate how you could achieve what the OP wanted, but with libre-software and privacy-preserving-software you’re often met with: “no. I want to use Google/Microsoft/et al.” Users are lazy idiots.
Technical and correct responses are ignored whilst a flood of ignorant, emotional or status-quo enforcing responses are brought to magnified attention. I’ve abandoned restraint and started to shitpost as every one else appears to be doing.
I suppose this is all a criticism of ‘social-media’ and how it’s a waste of everyone’s time.
That’s to say the criticism is written from a place of ignorance.
The praise is also written from a place of ignorance too. People love it and they don’t know what it is. If you can’t explain it to a five year old, then you don’t understand it. And if we don’t understand, it’s a horrible idea to fork over our security to it. We don’t want to rely on a box full of ADE 651 bomb detectors.
Sounds like a turbo encabulator.
Also, that website is full of sand traps. Every time I accidentally mouse over something, a huge menu covers up the definition.
If your security relies on a password, you will always be anxious that somebody, somewhere, has somehow figured out what it is and already has access to your bank account.
No I won’t. All my passwords are something like
I0!2b6KJ!eA04WiJ&&MFToCQ7CN*4mvband each is used for only one thing because I’ve been using a password manager for over a decade.This is some weird doom and gloom take on a real improvement in public security that we don’t see very often. Of course there are a lot of stake holders. Of course every protocol is complicated. I run security for a company, and my auth systems mandate attested (i.e., company-provided) hardware keys. You’re not using a passkey on my systems that I’m not providing you. Pretty simple concept, yes?
Do you have any examples of any public service requiring attested keys? No, because it really doesn’t make sense. But because the protocol supports it, people shouldnt use passkeys? Shitty hot take.
I agree it would be helpful to make the feature set clearer to the end user, but the UX are still a mess across OS and websites. IMO that’s not a reason to not use them.
Passkeys are much more phishing resistant. They apply unqiue-credential best practices. I’ve been managing unique passwords for decades, and passkeys are a great improvement. Very few companies are going to completely remove other forms of auth, and so suggesting passkeys are ruining people’s ability to share passwords is really premature. And even so, companies have been pursuing other strategies for identifying shared accounts much more effectively than shared credentials. Thinking that’s a reason to not use passkeys just tells me you aren’t valuing how passkeys elevate public opsec.
Passkeys are projected to overcome TOTP market share next year. That is honestly amazing. I like the writeup on the features, but this nefarious, conspiratorial narrative doesn’t fit what’s actually happening.
My background is very much not in this world so caveat my questions/response below with that mind set. I do however try to practice decent personal opsec such 2fa (TOTP), password manager with random generation, etc.
I feel like a lot of what you stated was covered in the article. For example the article states that problem isn’t the number of stakeholders, it’s that none of them are consumer advocacy groups.
I understand that the author maybe leaned on the password sharing example too much but I think that was in an effort to present the material in a friendlier manner to the average reader. The closing statement makes it clear it’s not really about Netflix, etc. The main concern is that attested passkey requirement will now be the easiest way to force specific software and hardware upon user. The GraphenOS example is a good one.
You might not use the attested flag in that manner but I have zero doubt that once passkey adoption rate passes a certain threshold Google will be more than glad to miss-use that flag to lock people out of their gmail account unless they have the most recent phone and software.
Do you have any examples of any public service requiring attested keys? No, because it really doesn’t make sense. But because the protocol supports it, people shouldnt use passkeys? Shitty hot take.
I think this is a bad take. “Because this potential is not being misused right now it won’t be a problem in the future” has not really served us well thus far.
My understanding is that the article is saying that passkeys are giving away too much control to the second party. That can and will be abused.
But again, layman’s understanding from my end.
The main concern is that attested passkey requirement will now be the easiest way to force specific software and hardware upon user. The GraphenOS example is a good one.
Exactly, and it doesn’t take any effort to come up with software that will make it impossible for most people to even consider doing things a different way than big tech wants them to. Download the wrong app, use the wrong OS, attempt in any way to reclaim your privacy, and all of a sudden you can’t be authorized to open your own banking app because of some bullshit “security” message. What option does that leave you? Either become a hermit and reject all technology with whatever cost that has for you, especially in a decade or two as technology transitions to something completely mandatory for everyone, or fall in line and use everything the way they intend you to.
This is already the reality without passkeys. The correct response is to bank with a bank that isn’t enabling Google’s monopoly. Pretend passkeys don’t exist–nothing’s changed. You still can’t use your bank’s app without a Google Account if your bank is an enabler of Google’s monopoly. So… again, myopic dimwits are getting angry at something, but don’t know what. They’ve latched onto passkeys though. Amusing.
Happy to discuss a few points you’ve brought up.
it’s that none of them are consumer advocacy groups.
I would put that more as a curiosity than a red flag. I doubt they were excluding groups, but happy to hear about if they were (e.g. donation minimums or something to that effect). The author actually says that whole paragraph is “notable” – great, noted. I hope that doesn’t mean they were using it as an argument for “Do not use [passkeys]” (the title of the article). FWIW, W3C recommends use of passkeys. EFF has had blog articles for 3+ years suggesting advantages of Passkeys. I also don’t know what a consumer advocacy group would suggest differently here – DONT implement an attestation spec? Attestation is a massive improvement for specific types of security.
The GraphenOS example is a good one.
I went and looked for what you were referring to and didn’t find anything. What do you mean by this? I use GrapheneOS. I use passkeys. Google being hostile to third party OS doesn’t seem related but maybe I am missing something.
I have zero doubt that once passkey adoption rate passes a certain threshold Google will be more than glad to miss-use that flag to lock people out of their gmail account unless they have the most recent phone and software.
Well this seems like a reasonable point I should expand on. Maybe I can plant a seed of doubt about this hypothesis. A few comments:
-
People being locked out of their email is actually one of the biggest logistical nightmares for email providers. Proving someone is who they say they are is actually fairly difficult as well as doing it at scale. People lock themselves out of their own email. People get locked out of their email because of phishing attacks. In practice, Passkeys reduce phishing rates significantly. That’s a massive win for email providers in reducing their burden. Intentionally locking out a massive number of their customers is an unthinkably bad move, comically bad. It wouldn’t happen.
-
Email is the most important mechanism of communication for people’s security. Bank and financial accounts, paid services, government notices… they are almost all through email. The idea that they will vendor-lock email to specific hardware… it’s not realistic. They would face such massive PR And public blowback. Email is also accessed from more than just your phone. “Requiring” an attested phone would kill a massive use case.
-
People already feel locked to their email provider – it’s extremely difficult to change all contacts you have to a new email address. Passkeys don’t change that. Phone hardware doesn’t change that. So I’d say it’s just a continued problem, and not a reason to not use passkeys.
-
The FIDO Alliance had like three phone manufacturers out of 250 members.
Overall, I don’t see how passkeys, or attestation, could lead to a world where any public service would want to require attestation, and even if they did, there’s no reason it would be “requires my X branded phone”. These companies supported the development of this protocol for the specific reason of NOT wanting to cater to specific vendors. This is a vendor-neutral specification. There are many hardware and software providers. They all have their own motivations, and they hope implementing the spec brings in more customers, improves consumer security, and reduces their operational costs. Do you still have zero doubts about a future world with vendor-locked attested passkeys for public services?
passkeys are giving away too much control to the second party.
There are already dozens of hardware and software passkey vendors. It’s honestly amazing how little lock-in there is. There’s a half dozen FOSS authn services providing passkey services. You can buy dedicated hardware for passkeys from multiple independent companies. What “control” are you referring to? Companies could always force rotate your password, make it invalid, etc. Any control you thought you had was an illusion.
Cheers
There are already dozens of hardware and software passkey vendors. It’s honestly amazing how little lock-in there is.
If my passkeys are spread across dozens of vendors I wouldn’t call that good, first of all, it’s just a headache.
Secondly, just because there’s many of them doesn’t mean there’s no lock-in. Can I get my passkeys out? Can I migrate them freely between any vendors? Can I take backups for myself from all the vendors? Can I restore the backups into each vendor? Can I replace those vendors with a self-hosted solution?
If my passkeys are spread across dozens of vendors
You’re picking what vendor you want, not picking unique vendors for every unique passkey.
Can I get my passkeys out? Can I migrate them freely between any vendors? Can I take backups for myself from all the vendors? Can I restore the backups into each vendor? Can I replace those vendors with a self-hosted solution?
It depends. It sounds like you just don’t like or want hardware-locked/TPM passkeys. If you generate that type of passkey, then no you can’t do much of that. Maybe your major complaint is that some major OS’s default to hardware-bound passkeys?
My reference to “vendor” meant to include self-hosted/FOSS solutions.
You’re picking what vendor you want, not picking unique vendors for every unique passkey.
I don’t get to pick anything, in fact. Most often you’re told “that’s how it is, that’s where the passkey goes” and there’s nothing you can do about it.
It sounds like you just don’t like or want hardware-locked/TPM passkeys. If you generate that type of passkey, then no you can’t do much of that.
Again, _I_ typically don’t get to make that choice, it’s being made for me. And that’s a problem.
I replied to someone else asking the same thing, but we can avoid this infinite-universe syndrome. Which service is forcing a specific passkey provider, and doesn’t offer alternatives? I just need an example to understand because I don’t know of any and I have been using passkeys for awhile, so I’d appreciate being informed.
-
Thanks.
There are lots of reasons to like passkeys from a technical/enterprise standpoint, but I do think you’re missing the critical issue the article is speaking to: digital sovereignty.
Passkeys, while more secure in the average usecase, shift the balance of control over your access to services. Yes, you can no longer write your password down on a post-it and leak it in a photo—thats’s a good property. But trading that at the expense of your freedom to run software as you see fit on hardware you bought and paid for? For many people, myself included, that’s not an acceptable tradeoff. There are plenty of tools and systems around passwords that folks can use to make passwords+2FA match or even exceed the security properties of passkeys.
The thing that should chill everyone is the fact that built into the standard is a switch (given to service providers, not users) that locks out the people that do want to have control of their digital infrastructure. Not everyone can or should be expected to run like that, but they should not be blocked from doing so. Similar with the Right to Repair; not everyone can exercise that right on their own, but no one should be prevented from repairing what they bought.
Similary, I do believe it’s my neighbor’s right to practice a religion of their choosing. So if the government tries to prevent them from doing that, I’m going to go grab my pitchfork, not because I share their religion, but because they should be able to make that choice. Likewise, while I might not want to exert control over how my credentials are backed up, I still reserve the right to do it, and support anyone else’s ability to do it.
And to address the slippery slope objection, I have to point out that this is not particularly theoretical. When Big Tech has provided service providers with the opportunity to enforce restrictions on your device, service providers have used it. Widevine DRM, Google Play Protect, etc… It’s why my LineageOS phone can’t use banking apps, which is a shame since some features like Zelle payments are specifically a mobile-only feature, and so I cannot use it anymore. I either run my phone to the exact specs and settings that my bank and Google prefer, or I’m denied access to basic banking anywhere but my desktop (and who knows how long until the block my access there, I run Linux afterall).
I do not trust Big Tech with my devices, and passkeys increase their capability to deny anyone who doesn’t buy into their ecosystem, and further entrenches those who already are. I for one find that despicable, and an unacceptable tradeoff. There’s no reason it has to be this way though, passkeys could have been the best of both worlds. However, they’ve been compromised with features that serve platforms at the expense of user freedom. It’s the kind of disempowerment that happens when you give the reins to power-hungry, profit-seeking corporations.
There are plenty of tools and systems around passwords that folks can use to make passwords+2FA match or even exceed the security properties of passkeys.
Likewise, while I might not want to exert control over how my credentials are backed up, I still reserve the right to do it, and support anyone else’s ability to do it.
Widevine DRM, Google Play Protect, etc…
I do not trust Big Tech with my devices, and passkeys increase their capability to deny anyone who doesn’t buy into their ecosystem
I can only speak for myself, but I hold all of those values you claim. I see no evidence, technical or otherwise, that passkeys are subverting or acting counter to any of these principles. Frankly, it’s a baseless claim that passkeys lock people out of their own control/infrastructure. I think people conflate non-transferable, TPM passkeys with passkeys. Just don’t use that if you don’t want to.
FWIW, passwords were never “yours”, they are PSK (Pre-Shared Key) with a service. Maybe you invented the credential, but it’s not yours. You have historically enjoyed being able to bulk export credentials, and if that property is important to you, then you should be using transferable passkeys. Passkeys have a well-defined transferable format – if they are the type that can be exported.
I can only continue repeating that the passkey spec is public and transparent. If the service is not supporting passkeys in a way that you want to use them, then complain to that service. I don’t decide that service X doesn’t support transferable passkeys, but they should.
DRM and other gate keeping efforts, IMO, are tangential to passkey support. Passkeys are fine, vendor-locking and walled gardens are not.
I see no evidence, technical or otherwise, that passkeys are subverting or acting counter to any of these principles. Frankly, it’s a baseless claim that passkeys lock people out of their own control/infrastructure.
The evidence is in the fact that the passkey standard provides the means to deny service to anyone whose passkeys do not match the service provider’s preferences. This is a non-issue with passwords, since there’s no way for a provider to tell whether or not, for example, a password is simply remembered, stored in your password manager, backed up, shared, etc… The threat model of the user can inform what choices they make there. The platform may require certain things of the password, like length requirments or another factor, but it ends there.
You’re correct in that the standard supports passkeys with similar data sovereignty properties; however, the standard includes controls that allow service providers to dictate that those properties be configured to the provider’s preferences, not the user’s.
Just don’t use [locked down passkeys] if you don’t want to.
It would all be well and good if that were actually entirely my choice, but it’s not. The standard specifically includes a trump card for the service provider in the form of remote attestation. You seem to think that’s tangential, but I reject that. It’s kinda the whole point.
Authenticating based on a shared secret is an interface with a special property: there’s no way for a service provider to know how you remember a secret. That guarantee is extremely important. Service providers accepting password based authentication are guaranteed to not be able to enforce requirements on how you remember your password.
The Passkey standard removes that critical protection by explicitly supporting remote attestation in the standard. It does not matter that the standard is public if it does not preserve that guarantee.
Passkeys are fine, vendor-locking and walled gardens are not.
If you’re not a fan of walled gardens, I would recommend against giving corporations the mortar, bricks, gates, and locks with which they use to build them. Maybe they won’t use them in ways you don’t like, but you’ll never have a guarantee that they won’t.
means to deny service to anyone whose passkeys do not match the service provider’s preferences. This is a non-issue with passwords, since there’s no way for a provider to tell whe
Yes it is. I have had to work with many companies that set password specifications, and sometimes they prevented secure passwords. My bank maxed out at 11 characters for many years!
You dont own the specification for a password, the service provider does. I always wanted to use deterministic password generation (i.e. hash(servicename + memorable password), but never could because every provider has different “password rules” about different character types, etc.
IMO you’re reading way too much into the value proposition of passwords. Services can “deny service” for arbitrary reasons already with zero consequences, but your idea is that they will ban based on… passkeys? You’ve got people banned from youtube for arbitrary comments. You’ve got MS locking out non-profits for arbitrary reasons. But in your mind, those all pale in comparison to what will happen if we all start using passkeys? I’m not buying what you’re selling.
You seem to think that’s tangential, but I reject that. It’s kinda the whole point.
I didn’t say it was tangential. Attestation is for very specific purpose. Non-attested credentials are not sufficient for government and corporate security. I cannot allow BYO hardware to authenticate my users on my services. I highly doubt any public service would require attested passkeys. I doubt passwords will stop being allowed, almost ever, so you probably have nothing to fear. Maybe you can throw that comment back in my face in 20+ years, heh.
Here’s another counter-point: Google, Apple, et. al already implement proprietary authentication mechanisms. Sign-in prompts on recent devices, email codes, etc. are all proprietary. None of these companies killed passwords despite having implemented the tools to do exactly that with vendor lock-in. All the evidence is the opposite. This is one of the first times we’re even getting an open standard authentication, the exact opposite of “walled garden”.
Authenticating based on a shared secret is an interface with a special property: there’s no way for a service provider to know how you remember a secret.
The same special property that allows rampant attacks on the public. I deal with so many people with compromised email inboxes, malware installs, stolen credentials, etc. Passwords are not the end solution to end user security, and I welcome improvements that also simplify UX.
I think we’ve probably hashed out enough of the sides of the argument. Good luck to you.
But in your mind, those all pale in comparison to what will happen if we all start using passkeys? I’m not buying what you’re selling.
Because you appear to be misunderstand what I’m saying. Be careful to not put words in my mouth. I said nothing regarding bans.
I am, however, arguing that a service provider can reject your passkey if they dont like how you manage it, (e.g make it copiable). To access that service using a passkey, you’ll have to accept storing your credential on their terms.
And to be clear, I’m in no way blind to the issues with passwords. We’ve had to tack on a bunch of extras to have password based security keep up, like TOTP, password hashing, recovery methods, phishing resistant tokens, security questions, and so on. I’m not arguing that passwords are perfect; I’m arguing that they preserve the users ultimate control over the credential. I’m totally open and hopeful for improvements to authentication as long as they similarly preserve the user’s freedom to manage their credentials as they see fit.
And this may be where the difference in our values shows, since it appears that you view the user’s freedom as more of a problem than a boon:
The same special property that allows rampant attacks on the public. I deal with so many people with compromised email inboxes, malware installs, stolen credentials, etc. Passwords are not the end solution to end user security, and I welcome improvements that also simplify UX.
I’m sorry you’ve had to deal with that, but I simply don’t think some users making mistakes justifies allowing a service provider to remove a critical freedom from the user. I dont believe that improved UX and security has to come at the cost of user freedom, but that’s what passkeys explicitly allow for by design. I fundamentally disagree with that.
I didn’t say [attestation] was tangential. Attestation is for very specific purpose.
Fair enough, I tend to thow it in the same category as “DRM and other gate-keeping technologies” which you did call “tangential.” At the end of the day, for the purposes of my argument, they are the same: a service wishes to exert control over how a client runs, and I object to such limitions broadly speaking. The computers I own work for me, not the service. (Of course this changes in enterprises that own their own clients, like the workstations used by their workforce. But even in those situations, however, I would argue that there are generally more effective measures than remote attestation. But I digress…)
I highly doubt any public service would require attested passkeys.
Ah, but how can you be sure? You’re missing the guarentee that they can’t flip the script on you. The standard allows them to start forcing users to rotate their passwords and passkeys for ones that require attestation of their preferred settings. Maybe it’s unlikely, but “unlikely” is still a massive downgrade from “impossible.” IMO, it’s unacceptable.
Here’s another counter-point: Google, Apple, et. al already implement proprietary authentication mechanisms. …
Just because a standard is open does not mean it isn’t rigged in the favor of closed platforms. This is especially the case with passkeys, where platforms use them to further entrench you into their ecosystem, often under the guise of “look how good the UX is!” For example, MacOS really, really wants you to tie your passkeys to their keychain, so that they can control how it’s backed up, transferred, and stored. Remote attestation only makes this worse, opening the possibility that a service provider can enforce that you have to use MacOS’s keychain. Sounds like a walled garden to me.
Apologies if I miss-stated your point and conflated service’s other arbitrary decisions with what you’re suggesting may happen with passkeys.
Maybe I have one follow-up question, there are a number of websites that just don’t use passwords at all. It’s always one-time codes sent to emails. Where does this fall on your freedom spectrum?
Do you have similar arguments about HTTP 3? QUIC? Web RTC? There’s so many protocols that could be used in a way to lock in users. Just because it has some bits in the schema, doesn’t really mean much. Particularly when it’s actually supplying a very real need in other contexts. Nobody wants 30 versions of passkey-alt protocols.
Cheers
Consumers are pent up and lashing out at passkeys. It’s wild. Like, you all still want to use the dictatorial software that is YouTube, Google and Microsoft, but passkeys are the hill to die on? lmao “No! How dare you provide cryptographic security!”
Maybe you’ll prefer more practical criticism then:
To put it simply, every passkey is locked into a large combination of factors: device + platform (OS) + app + the service being used. It is not trivial and often downright impossible to change any of these factors or to render them agnostic. This makes it complicated or impossible to backup passkeys or make them portable.
It’s fine for them to not be portable when they’re used on a work phone, running the company mandated OS, authentication app and passkey store, to login into a suite of apps that are also company-approved.
I do need portability and backup as an individual who wants to be able to login into multiple services across multiple apps running on multiple OS on multiple devices. But I can’t, because the big tech players (Microsoft/Google/Apple etc.) are actively trying to capture passkeys into their platforms and make it hard to get out in any practical way.
With passwords and TOTP I can run something that will sync them across devices and fill them in into any app in a unified manner (or use copy & paste if all else fails). With passkeys I can’t.
Passkeys can be transferrable and syncable ( see keepassx, bitwarden, and relatives). But ideally, eventually, you never sync them because every time you log into a service with a new device, that device gets its own passkey. No need to sync them and you can revoke a devices access if it is lost or stolen without effecting any other device. They are closer to client certs than passwords in that respect.
FWIW, the article may be a bit outdated. I’m not a FIDO expert by any means, but there have been improvements in the spec to help define how to transfer passkeys (CXF and CXP). The situation should be better than 2024, but if you’re using TPM-locked passkeys, you’re just in that locked box already.
I think there’s somewhat of a conflation of concerns. It sounds like your concern is, I have a credential manager and want to migrate to a new credential manager. I just want it to be simple to migrate my massive number of passwords, right? I need to bulk export + bulk import. EASY. But… what if your first password manager has a bug in the seed generator? Oops, you have to rotate 500 passwords now… there is no easy, off the shelf solution for that. It’s basically the same for hardware-bound passkeys. If you generate hardware-bound passkeys, you’re not going to simply replicate them to another hardware-bound passkey. The whole purpose of that type of credential, is to make it hardware-bound. There are a lot of meaningful reasons to do that from a security POV.
Now, I think what probably needs to be made clearer, is that if you do want that kind of credential, you shouldn’t be using TPM-backed passkeys. You should be purchasing independent hardware (FIDO2 hardware keys) or only make software+transferable passkeys. Personally, I have several hardware keys and I register them with one being a backup. If the vendor posts a vulnerability notice that there’s some big gap in their hardware, I will have to go and rotate every passkey. I know that is what I am signing up for, but maybe not a lot of people do.
It sounds like your concern is, I have a credential manager and want to migrate to a new credential manager.
No. My concern is that I want to choose my own credential manager, and I want it to work with any passkey usage out there. And that’s impossible.
Which credential manager, and which service is not working with it? Just looking for an example to understand what you’re struggling with. I feel like I don’t have these problems heh.
What do you mean, which. All of them have this problem. You can’t force any platform owner to use your favorite credential storage when they decide they don’t want to. All of them will tell you “for my services you use my storage, period”.
Literally just name a service that forces this. If it’s all of them, it should be pretty easy.
OK, Apple. How do I use passkeys created on iOS for accessing Apple services, on a Linux laptop?
I haven’t found this to be the case in practice (IE passkeys are plenty portable). I’ve successfully used passkeys on multiple browsers, OS’s, and apps, all stored using a FOSS password manager (keepass). Any FOSS password manager that is either self-hosted, or syncs, should work just as well with passkeys as it does for regular passwords or TOTP.
My issue with passkeys is the fallback. For instance, when the biometric fails, you can use a fallback login. That’s fine (and good that it exists). But the fallback for me is a pin number. That pin is far less secure than my password or a randomized TOTP number.
How do you handle that for your setup?
Yeah good question, and more people should give consideration to account recovery. Are you referring to recovery PINs? There’s really a couple aspects to the design:
-
They are single use – this is really just to make sure users aren’t coming to rely on these PINs. It’s also a simple fact that passwords that are typed are more likely to be leaked than passwords that are never typed. Single-use do a great job taking advantage of that.
-
They lock after very few attempts and generally have more aggressive anti-hammering/brute force/backoff protection than password/TOTP attempts.
-
They help get new devices registered without already having a passkey.
Securing/backing them up has the same challenges as TOTP secrets management. Storing them in a password manager is what I generally do, but there are a few that warrant keeping offline completely and storing it in a fire-resistant/water-proof enclosure.
The other reliable recovery is just registering several passkeys and keeping one as the recovery credential. I always issue two hardware keys per employee, and we have a pretty lax policy if more are needed or replaced. We also don’t allow employees to recover their own accounts. If we’re at that situation, we need to know in order to help. And FWIW, I don’t use biometrics.
-
Thanks.
