A lot of services support passkeys. Microsoft even has an option to make my account “passwordless”. Since they are more secure than passwords, will you be switching some / most of your accounts to passkeys any time soon? Interested to hear everyone’s thoughts on passkeys. 🔑
Passkeys as password replacements reduce the total factors required to login to a service. If you use 2fa for all your services anyway then passkeys are a downgrade. That’s why so many people are angry they are having security options removed.
For people who use the same username and password everywhere, then passkeys are a upgrade.
So normal people get a benefit from passkeys in exchange for getting locked into a ecosystem.
For security minded people I hate passkeys.
- Less factors to login
- Discoverable
-
- Unlike fido2 webauthn the service the credentials attach to have to be known, so if anyone steals your hardware key, or gets access to your phone they can see all the passkeys and accounts you have
I WANT my logins to be something I know, something I have, and something I am. Password, hardware key, biometric unlock of key.
I don’t mind passkeys existing, but I HATE that services are replacing hardware key flows with passkey flows. I want to use my hardware key as fido2 not as a passkey. I don’t want to downgrade my security! Microsoft makes it impossible to use a 2fa hardware key as a second factor now, only as a passkey, that’s strictly worse then before.
100% agree. I have 2FA on everything, passkeys are definitely a downgrade
I use a password manager. I don’t care about it. Passwords are reasonably secure.
Passwords can be leaked, mostly by bad security on server side.
Passkeys use secure keys, it checks public keys on both sides and send private key to authenticate, without both keys can’t login or if the server is compromised.
It’s like GPG or SSH works.
Close but private keys don’t get sent.
It sends information encrypted via your public key to your client, then your client proves that it’s the real owner of the key by decrypting the message, and then sending a new message back encrypted by the private key that the server can then verify.
This is what’s better than a password, the information for providing authentication (the private key) never leaves your computer (where as you almost in all implementations of password based auth, send the password itself to the server).
A question, since you sound like you know what you’re talking about. Is this analagous to password-free SSH? I.e., private key used to log in on the basis of a pre-agreed public key?
Yeah basically. See “What is a passkey” on https://fidoalliance.org/faqs/#PasskeysFAQs
From a technical standpoint, passkeys are FIDO credentials that are discoverable by browsers or housed within native applications or security keys for passwordless authentication. Passkeys replace passwords with cryptographic key pairs for phishing-resistant sign-in security and an improved user experience. The cryptographic keys are used from end-user devices (computers, phones, or security keys) for user authentication.
Which begs the question, “What is FIDO?”. To which the About FIDO page replies, literally, “FIDO authentication uses standard public key cryptography techniques to provide phishing-resistant authentication”.
Arrghghgh! Orwell was right about people’s incredibly capacity to write with zero clarity.
More generally, IMO what we have here is a classic case of ELI5 vs “ELI know something already”. I use SSH and manage the keys myself but I still can’t find an answer to this question: is a “passkey” just another word for “the private key in a public-private keypair?”
Whenever I look into this, the explainer always either jumps straight into super-dense technical details, or describes it all in term of metaphors as if talking to a small child. Oh well.
Reading through all the jargon and simplifying it, the answer: yes they’re the same in the way you mean.
“SSH” and “passkey” are both technologies built on asymmetric cryptography. They thus at a fundamental level do work in the same way, it’s all the protocol and practices stuff that gets bolted on that is where things become different and where things took time to get into place so we could use these things on the web (and not just “we” who know what SSH is but “we” who make up society).
Arrghghgh! Orwell was right about people’s incredibly capacity to write with zero clarity.
The problem is arguably that for the people who understand it enough to say “yeah, they’re the same idea”, the key point is “asymmetric cryotherapy” in an authentication context, the key point is not SSH. SSH is just how most technically inclined users have most directly experienced asymmetric cryptography deployed as an authentication mechanism. It’s that same mistake textbooks often make of burying the lead in an otherwise obscure reference the reader may or may not pickup on.
But yes, it would be helpful if some major site would provide this comparison “so that I don’t have to! 😉”
See also “Enrollment and Sign-in with FIDO” in https://fidoalliance.org/how-fido-works/
They’re FIDO keys but bad.
Here’s a great blog post from someone who knows what they’re talking about: https://fy.blackhats.net.au/blog/2024-04-26-passkeys-a-shattered-dream/
Very enlightening read. That service lock-in is so real. I had some passkeys in Google Password manager (Android) just to try them out, and then wanted to move them to Bitwarden. I had already disabled Google Password manager on my phone to use Bitwarden. Imagine the headache I had to deal with to move a single passkey over to Bitwarden (really, I deleted one and added one, while dealing with UI hurdles). Until this improves (if ever), I’ll probably stick to my passwords and normal 2FA.
