An attempt to make an image describing where passkeys live:
It’s funny because I can’t see it and when I view the code of your post and copy/paste it into the location bar I get the broken jpeg picture.
Just for you I added some more tidbits.
The article warns that passkeys could be used, assuming they become the only form of logging into platforms, to prevent someone using the wrong operating system to log into those platforms.
Being prevented from using certain applications because you use the wrong OS is nothing new, but there is, from everything i have seen, always a reason to block it, they dont do it for someone elses benefit. A lot of banking apps cannot be used on many android roms; without microg or gapps many android apps wont work (some wont work even with microg); games sometimes use kernel-level anticheat that forces players to use windows; people solved this issue by just not using those apps
Why would a significant portion of used websites/applications that require accounts stop allowing passwords or authenticator apps, relying on this open standard, force certain options to be used for the standard and ensure that the user isnt on an operating system they have no reason to care about. There are already methods to prevent people from using a certain OS, they could just not rely on an open standard
TIL what passkeys are. Thx for sharing.
This is actually a terrible take. Passkeys provide a very large security benefit over passwords and have an open standard.
It’s particularly ridiculous that they seem to think TOTP good passkey bad. They solve the same problem: symmetric persistent encryption like passwords is very weak. TOTP solves this my making it not persisting and passkeys solve this by making it asymmetric. Passkeys are mildly more convenient because you don’t have the copy a code over.
Both also have the same potential for abuse, any service could require you use their specific app. The fact that this article makes it sound like TOTP is a perfect open standard while passkeys are a Trojan horse for abuse is ridiculous. If most services are using the open standard for TOTP why wouldn’t they for passkeys? Also not all services do obey the open standard for TOTP. I’m sure I’m not the only one who was forced to install the duo Authenticator because their institution was somehow sold on their protocol being stronger than the open standard.
TOTP and passkeys are comparable and both with doing.
Both also have the same potential for abuse, any service could require you use their specific app.
That’s not true. TOTP is just a mathematical formula for how you mix a “shared secret/seed” with the current time.
In the authors article, they mention that you could write your own python program to generate the correct rotating numbers.
There is no way Big Tech could force you to use a specific app, because at the end of the day, TOTP is just math. 1+1=2, that could be calculated by you, your cellphone, or me - it doesn’t matter.
According to the article, Passkeys, on the other hand include a bunch of metadata. For example, can this passkey be copied or moved to another device.
The article is also very clear that all those fields can be faked except attestation.
And for those at home, attestation is a cryptographically secure way for an application to be certain that the application, operating system, and hardware are not modified to work in a way that the OS provider, application, and hardware vendor expect it to.
This has been abused by google/android to prevent/limit people from installing applications outside of the google play store, its been uses to force people to only use google-approved os’ (no cfw, no grapheneos). The same technology is a requirement for windows 11 (TPM).
Now, if FIDO agreed to not include attestation as part of the metadata - this would not be a discussion: everyone would love and use passkey, as you (the user) get to decide how to store/backup and (optionally) share this key.
But that’s not what FIDO did, the attestation flag is included in the metadata. And the author speculates that once people accept passkey, Big Tech will turn the screws and then start to force how you store your passkeys.
So, in an apocalyptic future “coming soon”, when you try to log onto your bank, you’ll be greeted with an error:
“We detected that your passkey is stored in the cloud. Your security is important to us. Please, install your new passkey onto your local device using your manufacturers approved Google Android Operating System and Google Approved passkey application.”
Really there is no way big tech can force me to use their app? Ok so you know how the open standard for TOTP is a six digit code computed from the time and shared secret? Well every student at the university of California and every employee at many companies across the US has to use an Authenticator app called duo which uses a 3 digit code generated by the app at the moment you attempt to log in. How does it do that? No idea it’s closed source. Is it even a formula like the TOTP open standard? Probably not I’d guess duos servers just send a code to both sides when you attempt a login. And would you look at that suddenly we have TOTP that I can’t write myself and I’m forced to use some shitty app.
Now I do recognize the point you’re making but I want to emphasize it’s not about attestation being in the metadata or not. It’s about open standard compliance. As the open standard is written even if you have to have hardware attestation you can build the passkeys yourself (because this is functionality all password managers are quickly starting to have) and frankly having each passkey being device locked is good security practice to protect you from credential stealers and related malware. You’d still be in control and you could still sign in to as many devices as you want. You’d just need to make a new passkey for each one if you don’t wanna sign in the old fashioned way with a password and dual factor and such.
The abuse scenario you describe would require a departure from the open standard. Is this possible? Of course. As I said some companies already do this with TOTP. But I don’t see that as a structural fault of passkeys that TOTP somehow doesn’t have like the article tries to imply. Both only work well for the consumer if the open standard is adhered to.
And would you look at that suddenly we have TOTP that I can’t write myself and I’m forced to use some shitty app.
I think our definition of what TOTP is, differs. When I say TOTP, I mean TOTP as defined as a standard in RFC 6238.
The behaviour you’re describing with duo is something else, something proprietary. In my mind, duo would be an One Time Password (OTP).
sidenote: TOTP is a specific/narrow implementation of the larger umbrella OTP.
It’s about open standard compliance.
Maybe I’m getting hung-up on semantics, but attestation is an open standard, like gpg is. With gpg you can implement your own encryption/decryption according to the gpg specification and your encrypted data will still be safe because you’re trusting the math behind the Asymmetrical Encryption.
Attestation is identical, but at the hardware level. The public/private keys are created by the hardware manufacturer. The private key is (often) isolated and stored in the CPU (or in a dedicated chip). The public key is freely published, so OS/application vendors know how to validate that an attestation response wasn’t faked. The private key is not exposed and even if it were, the public key could be revoked by the OS/application.
Attestation is great for device level security, but makes it nearly impossible to create backups/clones. :(
deleted by creator
I suspected as much, being shoved on us like AI.
Website supports passkeys. Browser supports passkeys. Extension supports passkeys.
Then why does it keep asking me to “insert my security key”? Why doesn’t it work?
Passkeys are bullshit.
finally people are waking up to this garbage.
I didn’t even know what they were until now. And still don’t. Every explanation sounds like a long convoluted MLM pitch. They smell fishy as hell. They may need more grameters to prevent side fumbling.
It’s wild seeing people spaz out over passkeys, clearly venting at something that isn’t passkeys.
Please just stop using a service when it gets unbearable. There is no online service you -need- except maybe bank and tax stuff.
And for the bank, you can always switch to a better bank.
The problem isn’t you or me, the more technically aware… it’s when the majority of users switched to passkeys and then subtly get switched to attested passkeys and sites don’t offer other choices. Once the majority are under-thumb, sites won’t have a reason to offer open solutions to the same number of objectors.
Passkeys give me anxiety because it’s like “Hope you can go the rest of your life without a phone or USB drive getting lost or stolen LMAO”
Use a password manager like bitwarden et al.
dude speaks about not being able to write down his passkey, then he acts like it can only be saved in bigtech clouds, then some random ai rumbling starts about ads being show to us? can you guys stop posting these god damn fearmongering password articles written by ai?
That seems to miss the main point of the article, which is that Passkey standard has attestation procedure built in. A site that uses Passkey can verify the flags you set and deny your access if you use unapproved device, operating system, old kind of secure chip or, say, allow your passkey to be shared between devices.
Corporations want what they’re terming phishing-resistant passkeys, which have two approaches: hardware-based or synchronized passkeys. If they are forced upon us for certain services or jobs, the least harmful to a worker is a synchronized passkey. Password managers like Bitwarden support this, so that you don’t have vendors and employers tracking your cell phone. If an employer uses something like Microsoft, the administrator settings may not allow synchronized passkeys…but at least we can advocate for them when these auth methods are forced upon us.
Despite the attention-grabbing headline, the only negative thing I can find in the article about passkeys are this section:
Attested passkeys7 are the last but most important type of passkeys you need to know about. These types of keys use what’s known as remote attestation to cryptographically verify – using the aforementioned tamper-proof cryptoprocessor that lives in all your modern devices – that you are using one of the several approved passkey managers, and not using a custom one that you vibecoded yourself and which can lie.
This is the feature that means you no longer get to make the calls about your passkeys. Fortunately, attested passkeys are not yet required on most websites.
I don’t see why we should assume this hypothetical is going to happen. There is a lot of different software that supports passkeys (I use keepass for example), and going against the open standard and forcing all their users to use a specific software would basically make them unusable.
Overall every password / login style has its dangers and bad ways to use it, including passkeys. That doesn’t make them “traps”.
Ooohh, don’t think corpos and banks won’t go for that hypothetical. A lot of apps already turn haywire if you have developer options enabled, accessibility options enabled, have a specific installed or using a custom ROM. If the optional attestation is enforced by your bank that they only accept passkeys from google’s password manager or apple passwords, then using something like Keepass or Bitwarden isn’t an option.
Look… I love passkeys. They are convenient and more secure. But if a service cares about on what device and software it was created then it is pointless and just an ecosystem lockdown mechanism.
The only area I could really see this taking off is with internal company stuff. Like forcing employees to use a very specific and weird way to do 2FA is already a thing in a lot of companies. They won’t let you just use any old authenticator app. You need the “special” one that sucks ass. So maybe they’ll do the same to passkeys, but for normal users I don’t think they’d do that. Users are way too bad at doing things. It would cause too much of a tech support burden or just user bleed.
A lot of platforms will happily not allow people to login with a KeePass passkey. Just like some platforms already no longer let me login with a password and force me to login with a code they send me per email instead.
Which are those? I haven’t had one that rejected keepass so far.
Also, like, if it doesn’t allow me to set up a passkey because my manager or OS is not supported…I guess I’m not setting up a passkey then, which is OK by me, so there is no problem.
No problem until they make every other method more and more difficult. Which is already happening.
I only use passkeys when the alternative is an onerous song and dance.
SQRL, been around before passkeys, it’s portable, and it’s FOSS.
I wish SQRL was more commonly used.
Yeah the technology is cool but I stay away from passkeys and tell people not to use them because there’s too much room to permanently screw up.
Maybe they’ll remove the non portable type from the spec or roll it into an enterprise equivalent like with ad.
