- cross-posted to:
- hackernews@lemmy.bestiver.se
- pulse_of_truth@infosec.pub
- cross-posted to:
- hackernews@lemmy.bestiver.se
- pulse_of_truth@infosec.pub
You must log in or # to comment.
This isn’t a good article @ouch. It’s dull, meandering and conflates issues.
Both Apple and Google want your identity anchored to their operating systems.
That’s true regardless of passkeys and why is Microsoft excluded here?
Logging into accounts on devices you own is the ideal scenario for passkeys. When you have to handle a colleague’s computer, it gets much more inconvenient. You could plug in a hardware key, but you don’t always have access to the ports.
What sort of drivel is this? Is anyone reading the article? I doubt it. Sorry, I’m not logging into important accounts on a colleague’s computer, regardless of being unable to squat and plug in a usb-dongle. The last statement even concedes that passkeys are an improvement for 99% of the user-population. It’s an improvement for 100% of the user-population. Like usual this is just drivel generated from friction around ‘newness’. It’s different–which automatically becomes scary for some users. The writing is just not coherent and there’s zero critique on passkey’s design and technicalities, of which there are things to criticize.
Get a physical passkey and if you have more than 100 accounts you have a problem. Buy two and use one as a backup in case you lose your first. Keep it in a safe and if you forget your safe’s combination… well, I guess we should abolish safes too: terrible account recovery support there. Yikes!
Passkey’s themselves can be protected with a PIN–the software I’ve used does not limit it to numbers. It can be your ‘master password’ if you want. This is a technical complaint of mine as all software I’ve used reference it as a PIN (personal identification number), which means numbers only. Except other characters are allowed. I’m not sure what the official spec. states.
🎶Security is Theatre🎶
Good article.
Currently passkeys are too much of a vendor lock-in to big tech.
Bitwarden support alone does not change that.
Microsoft 365 implementation of passkeys is sacrilegious somehow.
It requires only the Authenticator app from Microsoft and can use nothing else to create the passkey. The way this is implemented on iOS means that Authenticator comes up as an autofill option BUT IT ONLY SUPPORTS M365 and is useless for anything else. Leave it to Microsoft to take an open standard and bastardize it to the point of it being MORE CONVENIENT to just type a damn password.
I agree the passkey user experience needs work, but man do I enjoy it over the haphazard ‘passwordless’ website login that just sends you an email.
I get it, they’re just skipping an attack vector and basically relying only on ‘2FA’. But now I have to go to a different app/tab, copy a code, and return to the site instead of letting the password manager fill stuff in for me. Some, like kickstarter, let you still have a 2FA code enabled so you have to grab your code from whichever authenticator and go to your email. Really nice login experience out of nowhere one day. \s
The best implementation of this I’ve seen has to be Ghost, an open source self-hostable newsletter/patreon thing. They detect what email provider you have and when you enter your email, will display a link to open your inbox. It’s super neat, and I haven’t seen it anywhere else, and I’m also not sure how they do it. For something self-hostable, I’ll definitely take one less attack vector.
bitwarden went from working great to buggy on browsers. sometimes the browser passes the request to the extension but most times goes to the os
What browser
i have had issues on Firefox, Chrome and Safari between Windows, Linux, and macOS
Passkeys and 1FA were always just a duct tape solution for users resuing basic passwords without having to set a stronger password requirement or relying on users to use a strong password.
I think Chrome and Firefox should have decided on making an API for their builtin password generation and filling functions, that way any password manager would be able to integrate with foolproof functionality out of box.
People already use browser auto gen passwords for the reason that its faster and usually has an account sync built in. Now it would work with any 3rd party solution as well which covers enterprise and security minded users as well.
Users won’t use a password manager if it means you have to manually make an entry everytime you make an account.
I really wish that SQRL had taken off, as it solved most of the problems noted. It was effectively passkeys that you generated on the fly based on your private key (which you can back up and restore to other platforms if necessary) and the website domain by scanning a QR code (or clicking rh QR code if your on the same device) and sends the signed challenge to the website to auth you.
No need to login to your manager on random systems, no issues with platform lock-in, no worries about dedicated hardware, no worry about losing your access if your device dies (assuming you backup your shit).
Steve put so much time into it too. SQRL really is the superior method of the two.
SQuiRreL!
Yeah, no idea why not popular.
it does not depend on the name. like, we all use Transmission Control Protocol and HyperText Transport Protocol, and nobody cares because they don’t need to know. things can also be renamed before starting use in production, like we aren’t normally calling tech by their RFC numbers
Because it doesn’t encourage vendor lock in to big tech.
There is still nothing better than passwords.
I don’t want my access to be tied to a specific device. Devices get lost, or break.
I don’t want someone to be able to use my face or finger or eyeball to access my data. You can legally be compelled to unlock a device with your biometric security.
So current biometric security sucks. And passkeys suck.
Also, though…passwords suck for all the reasons that we all already know.
There has to be some better method that the owner can have full agency over, I just don’t know what. I don’t have the answers.
This pretty much matches my feeling for the last 20 years or so. Passwords suck and are outdated technology. But every single alternative that has been developed over the years has sucked more, not less. They all have single-point-of-failure, vendor lock-in, assumptions about your “device”, etc.
There’s a fantastic paper from a while ago that did a great job of covering what you’re getting at. It’s one of the most cited papers in password security research. Basically, everything we’ve ever found sucks but passwords seem to suck the least. Great read if you have the time - https://www.cl.cam.ac.uk/techreports/UCAM-CL-TR-817.pdf
That is a damn nice paper, thanks for sharing that! The comparison table is, if a little wacky-looking at first glance, a pretty great overview. I skimmed it for the abstract and conclusion but now I think it’s worth reading it in full.
Every attempt at using passkeys has been a step into murkier, less easily understood, less convenient security.
Passkeys may be a “step up” from password + TFA in terms of usability, but there’s such a variety of implementations and explanations of how those implementations “keep me secure” - I feel like any idiot who grabs my phone when I’m not looking and can follow my unlock finger smudges on the screen can use my pass keys… No thanks.
For users who previously reused passwords across all their sites, passkeys are a huge step-up.
That is exactly why passkeys are a good thing. Basically everyone reused passwords everywhere.
A password manager is better than passkeys in 2026
Really depends on what you mean by passkey, since it’s actually a fairly vague term for a bundle of technologies.
I don’t really care for password manager passkeys; just use a password, all it really does is save you from needing to enter a username in a login flow.
But I’m a big fan of hardware 2fa using non-resident keys (“passkey” lite); I’ll use a regular login flow with a password manager, then the 2FA step with a hardware token. Basically bulletproof (ditto if you secure your PW manager with hw 2fa) and painless.
Some password managers can sync passkeys for you! Bitwarden can handle it
android doesn’t allow 3rd party apps to use passkeys nor autofill 2fa consistently. For passkeys, you are forced to use google services for it, or loose access, making it pointless. TOTP codes meanwhile can at least be copied and pasted manually from a password manager.
Maybe 5 or 10 years ago, but who doesn’t use a password manager these days? They generate random passwords and remember them for you
I just remember my passwords idk lol. I never understood the logic of a password manager, someone hacks your manager they have everything in your life? Rather just run the risk of getting hacked one account at a time rather than they all get hacked at once when they get my password manager.
Do you know any non tech people, especially over 40? Literally none of them uses a password manager.
Most of the non-techy people I know use the password manager built into their Web browser at the very least.
“use” I bet it just saves everything automatically, and they don’t even know their passwords are there. just “oh look, my password has appeared, lets click it!”
Huh I thought it was going to be the correcthorsebatterystaple comic
In my experience you’re more likely to find a sticky note on the desk with passwords than someone using a password manager, 2fa, or an ounce of ‘common’ sense.
My current employer will not authorize the use of a password manager. I have a key fob for my Microsoft account, and another account does phone verification. I use one password. If they don’t want to put the effort in for account security then neither do I. I use a password manager for nearly all my other accounts.
So we should be using passkeys to access our password managers that generate random passwords and remember them for us! Ultimate protection.
I dont understand the issue. Arent passkeys and password in any case just stored in a pw manager nowadays?
He talks about that if you read the article
Maybe im just lucky but proton pass and bitwarden (vaultwarden) both work fine for me. None of my accounts are linked to google or microsoft.
This article does a great job of articulating a lot of the uncomfortableness I have around passkeys. I’ve always said they make a lot more sense in an corporate environment but the level of control you lose in a personal setting is not commensurate with the protections and possible lock-in they offer.
I just don’t like passkeys. They are an overly technical solution to what is mostly a human problem.
Idk, when I want to log into my personal GitHub a bitwarden window opens from the extension, I click the GitHub profile I wanna sign in, and I do.
It’s a great implementation since it’s not linked to a physical device and it lets me authenticate in place. It’s still MFA, it’s just more comfy.
It’s not MFA if all you need is your bitwarden password.
Unless your bitwarden has MFA and locks after an amount of time commensurate with your security needs
True, but how does GitHub know your bitwarden has MFA? It only knows something has a valid credential.
I don’t think that github has to know that. You could be using a password manager and choose to make it a minimum character boring password or meet minimum complexity requirements or use the same password on a million sites. You have to secure your credentials; complying with the minimums of a service isn’t security.
Github doesn’t need to know how you implement it, just that your browser is handling it (and in this case the browser lets Bitwarden handle it lol)
It technically is, it’s not about the amount of actions you need to do, it’s about the amount of actions the platform you are logging in needs to do with you. That both interactions interface with a bitwarden local device makes the weak link your local device, which already was anyway.
Github only asks me for (bitwarden’s) passkey. That’s just a single factor.
A securely stored modern certificate is going to be magnitudes more secure than password plus MFA.
The certificate path uses cryptography to prevent disclosure of your secret, and can’t be compromised when the site inevitably gets hacked.
I wouldn’t classify passkeys as MFA tho, they are a passwordless method that’s more secure than most MFA methods. Afaik it’s based on signed certificates or something like that and that’s virtually unhackable unless someone gets physical access to your device (and that’s game over anyway).
But bitwarden uploads it to the cloud to be used on any computer, AFAIK.
Bitwarden uploads the whole vault (the whole json of passwords, passkey codes, MFA identifiers, credit card info…) encrypted with your master password. Meaning that whatever is on the cloud should be virtually unbreakable. That’s why every time you write the password in the extension or Android app or whatever it takes a second or two to open, because it’s downloading and decrypting everything locally.
When you update a password they need to reencrypt the whole vault and re-upload it again even though it’s wasteful since that’s their whole security plan.
If you’re using software that properly uses your device’s SE / TPM chip then it’s much more secure against malware, etc. And the main selling point is the much stronger phishing resistance (can’t trick you into logging in via a fake site, etc)
This would be great if it worked consistently.
In reality, extensions work in some browsers but not others, on some websites but not others, and with passwords at least you can fall back to copying and pasting, or even typing, if auto-fill isn’t working in the context for whatever reason. With a passkey not only are you SOL, but it will delay your ability to move onto the password option if there is one.
The devils in the (implementation) details.
Agreed in general, but that’s how improvements roll out for anything basically.
You enable it where it works, and you keep using the nonce based MFA whose name I can’t recall right now for where it doesn’t work well.
It might sound annoying but that’s society, it takes a long time to adopt new tools and build a standard.
The trap: Putting any 3rd party between you and your access.
It’s a 3 card monte game, but with security.Roleplay: Mr. Jonsith did you know your house is vulnerable? Your simple little key can be used by anyone to get in to your house. Security!? Our Keypass system will super secure your house. You give us your key, and when you want access, you come to one of our 5 in town locations, request access from us by showing us this new key here, and we will let you into your house.
next year: “In order to lower our costs and keep your monthly rate low, the five locations near you are being consolidated into a single location in Farawayville.”
another year later: “In order to lower our costs and keep your monthly rate low, our physical locations are being migrated to an online presence accessible through the HahaTrickedYou app, now available in your app store.”
seven months after that: the app doesn’t work. web site disappears. company goes under.
The problem he is describing here is mostly with enrollment and account recovery and not so much passkeys. The risk of getting locked out of accounts exists whether or not you use passkeys. Code based authenticators are not any better in this regard. Enrollment and recovery are the hardest part of identity. Passkeys are meant to address phishing risks specifically. I would love to see us do better on account recovery whether or not passkeys get adopted. The thing is, passkeys adoption is pretty slow and it has little to do with the issues described in this article. People just find it complicated and confusing. Until it is dead simple and the default, it will not find broad adoption.
The core issue is identity. If people would protect a digital identity a little better than they protect a credit card, that could/should be the basis of everything. Any account “worth more” than the CC $50 liability limit should have additional layers ON TOP OF the secure identity, including front line security that must be passed before the secure identity comes into play, but that single identity could/should be an element of access control to all non-anonymous accounts.
Anonymous accounts should stick with passwords, and online material should be clearly attributed as anonymous, or sourced from a secure identity (signed by said identity and blockchained to provide provenance).
I am using my password manager, which is keepass.
I have tried adding pass keys to it, and have had mixed success. On some websites, it seems to work fine, and then on others, it seems to break miserably, and made me return back to a password.
I like the idea of passkeys, because then you don’t have a shared secret between you and the website, and you get a different key for every single website using public-private key cryptography. That’s fantastic, but the implementation still needs some work.
They’re going to have to pry my keepass out of my cold, dead hands.
I’m not the biggest fan of passkeys, either.
Me neither | aesthelete
Companies have had 13,000+ Data breaches in the last 5 years. Lets all put our access in one of those, so that when some thief get access to one, they get access to everything.
“But Lutra, they won’t have access-access the pieces arent all there … blah blah blah”
Oh, cool, Lets put all our access in one of those, so when they get access to one, they lock us all out of everything.
