- cross-posted to:
- [email protected]
- cross-posted to:
- [email protected]
A rebuttal to an anti-passkey, pro-TOTP post that has made the rounds on Lemmy as well.
You must log in or register to comment.
Let’s get back to after 10 years because this was the same debate about drm in browsers and now we have this https://www.w3.org/TR/encrypted-media-2/
FWIW I don’t have DRM enabled and I can don’t even remember what part of the Web I can’t browse.
Before you ask, no I don’t use Netflix, or Disney+ or audio streaming service nor do I plan nor want to.
When you use librewolf it pops up when websites try to access drm, ex. finance.yahoo.com wants to access it. It’s not streaming services but lots of news webistes that also serve video.
I have a basic question, I learned that MFA should draw from multiples of “things you have” (totp) and “things you know” (passwords). There’s all this talk of passkeys replacing passwords, but aren’t passkeys in the “thing you have” category, not the “thing you know” category? My worry is that an unlocked computer or unlocked phone will let someone access ALL of a person’s accounts because now they have the thing and don’t need you at all. Putting access to my entire digital life behind my 4-9 point lock symbol? Or worse, a fingerprint?
The idea is that they Cross the Mark on thing you have and certainty on who you are saying you are. The secondary comes in the Form of biometric authentication for normies Like Face/touch id
There are actually 3 categories (though the idea of 2FA is picking 2 out of 3):
- Something you know (passwords, PINs, security questions…)
- Something you have (hardware keys, TOTP, smartcards, SMS/push-notification…)
- Something you are (fingerprints, facial recognition, iris scans…)
But passkeys collapse 2 of those into one by having the passkey algorithm include (as a step of the key derivation) a passcode or some biometric data… that’s why most passkey systems require some form of verification. Though it’s up to your authenticator which method is used.
Those two categories aren’t really meaningful, but even if you consider them to be, passwords (apart from a master password for your password manager) also should never be in the “things you know” category, because then it means you’ve memorized them, and are not using a password manager to generate completely random ones.
And unless you’ve got an incredible memory that can memorize unique passwords like “+28x@!8eaEak!” for 10+ sites, then you’re likely using a pattern or single password than can be compromised.
I do consider the master password to my password manager as my “thing I know”, and not the randomly generated passwords it stores. But you’re saying that have-vs-know is not really important in the security space, that was mostly just a handy shorthand?
so are passkeys just a simplified workflow version of the complicated dance I have to do on windows to get git commits to push easily with the public key from putty-gen? But also the private key is sometimes locked to the device it was generated on? I guess I should read some actual technical docs on em.
I have been hesitant in the same way. I have not until recently understood where the passkeys are stored, and then understood that they then become a “thing tou have”. The passkey is stored on my computer, I prove I have access to my computer, and that is the authentication.
I am still hestitant since it often is just one factor, and I feel I have to manage them much more carefully.
“TOTP is phishable.”
i can safely say both articles were made by insane people. all i can say is, to keep using generated passwords and offline 2fa codes. dont click on the naked lady in the spam folder.
have a good night, kids.
Passkeys are 100% not a trap, but they’ve been fucked over by being allowed to be portable. Now your passkey is only as good as the portable password solution you’re using to store it. They’re meant to be 1:1 computer->service. Then there’s the issue that most of the sites that accept passkeys let you bypass them with passwords or TOTP anyway.
TOTP, however, is REALLY fucked. Even a rudimentary phishing email can get your time-based key, get in and fuck your account over in real time.
Passkeys are extremely phishing-resistant. They are the best thing we have short of a YubiKey at the moment.
Yubikeys are amazing, But they’re not meant to be permanently carried, just used to stitch your securred devices together.
Let’s just go ahead and add a third, fourth, AND fifth authentication factor so maybe I’ll kill myself first thing every morning
Nah, lock-in is not a safety feature. 16+ random chars are plenty, and if cracking gets better I’ll go to 20 or 30 chars. My pw manager doesn’t care what strings go in it or which device opens it up.
Passkeys also aren’t lock-in. You control them, and your FOSS password manager likely already supports them.
you are required to use a 3rd party. that third party has control. you can’t switch. that is lock-in.
I’m using a FOSS password manager for like 6+ passkeys right now, on some of the biggest sites. So this is just demonstratably false.
You can have passkeys on multiple devices. I use them on different platforms for the same sites.
How do you transfer your passkey to a new device?
If you use a self-hosted password manager like bitwarden, then its there. If you use a file-based password manager like keepass, then you can use any syncing method you choose, and its no different from passwords.
not sure about every OS but the ios password app has a menu button to export them to other apps. I have exported mine to my own self hosted vaultwarden. took 2 minutes
You don’t, you can have multiple passkeys, one for each device.
ok.
How do you add a new device to your account without a password or the old device?
Password, then get a prompt about registering a new passkey.
After that I can use the passkey registered on either device.
Edit: to clarify, most sites still let you log in with a password after you’ve registered a passkey
The the account is still as vulnerable as a password.
That’s my workflow as well 26 random characters, a yubikey (and Aegis TOTP for sites that don’t have fido or similar) and I’m good.
I like the idea of a Yubikey but there is no way it would survive more than a month on me due to the conditions where I work. And getting a physical key then not having it on my body at all times is a non-starter.
I keep my keepass .kdbx in on a webdav server and that covers any device I can think of.
Do you work in a blender? It’s a pretty solid bit of plastic, should be fine in a pocket or wherever the device you’re using it with is.
Maintenance at a blast furnace. I am exposed to acidic vapours, caustic vapours, ambient heat in the 60c range, radiant heat in the 1000c range, rock from the nanometer up to 30cm size, phenolic resins, oil mists, and metal powders. And then there’s the crawling around over, under, and between equipment.
Not every tech-savvy person works in an office.
Cool. Hope it’s ok on your health. I suppose you have some way to keep your phone safe, and don’t need to do 2FA while exposed to all of those things. You could probably wrap one up pretty well and still have the NFC work too.
Totp with a backup of the secrets/seed qr stored in a kdbx. If my phone melts it’s a 24hr problem at most.
Not much of a rebuttal imho. We still have the problem that passkeys are ok in theory, but in practice they’re being pushed as a way to increase lock-in and don’t offer compelling advantages over well-managed passwords.
But most people don’t have well managed passwords. And me having good password hygiene doesn’t stop my data being hacked when someone working at a subcontracting firm to a company I use leaks all my data.
It also is annoying to have to log in over many steps with 2fa, often forced to email or SMS.
Collectively improving security benefits us all.
I think the point about lusers not being able to manage passwords has been argued to death elsewhere, so I won’t take issue with that.
me having good password hygiene doesn’t stop my data being hacked when someone working at a subcontracting firm to a company I use leaks all my data
What has this to do with passkeys? Are you sending your password in plaintext to the contractor who stores it that way, unencrypted? That’s a separate problem entirely. The only benefit I see with just sending them your public key is that they can’t leak your private key, whereas if you used one password for everything, and sent it to them, they could leak it.
Am I missing something? Would passkeys offer an advantage over a password manager? What if the website assigns you a password via DH so that users can’t pick bad ones or reuse them, would it have the same advantages?
2FA can be super annoying, but again I think it’s a separate issue. If I get control of your phone or laptop then 2FA might save you, but passkeys won’t.
I think you’re mixing up compromise of an account with compromise of the data associated with that account.
If a particular piece of data is accessible to people of a dozen accounts, compromise of any of those accounts potentially compromises the data. That’s a legitimate concern for people who want certain data secured, whether other accounts with access are also secure. In some cases, it may be best to have an authentication policy that provides a baseline level of protection even for the most clueless users, rather than a system where you’re able to secure your own account.
I follow you, but if we can impose passkeys on the security-inept people we are forced to give our sensitive data to, couldn’t we instead force them to use good security?
It’s been like 25 years since the security world basically moved on from assuming that users could be trusted to act securely. We gotta design processes and protocols that keep things secure even with people who have bad habits.
I can secure my email, but every email I send or receive touches at least one other mailbox I don’t control, of some other user. Same with text messages, social media posts, etc. The digital world we use has a billion overlapping people, some with escalated privileges as employees or admins or mods or whatever. We can’t make them perfect, so we should design systems that work well even with imperfect people.
I couldn’t possibly argue with that
I’m saying that bad user passwords allow data to be hacked. When it’s the credentials of someone with access, like an employee of companies with your data, then that data is more easily compromised if they have crappy passwords. It’s harder to compromise with passkeys. It is not just your password hygiene that protects your data.
Here is a recent example in Australia. https://www.abc.net.au/news/2026-10-06/asos-app-users-sent-hacked-message/107236520
That doesn’t say anything about passwords. Looks like someone’s device was accessed. Maybe you just understand this better than I do.
It sounds like they’re saying that if you can manage your passwords then do so yourself and avoid passkeys, but if you can’t/don’t want to use passkeys.
And they are pointing out that the company is far more likely to lose your password than you are.
Convenience vs security, but the weakest link is probably not the user.
but in practice they’re being pushed as a way to increase lock-in
Which ones are doing this? Give specific examples of sites that are forcing you to use a specific TOTP or passkey validator.
The kind of lock in I’m thinking of is with e.g. Google, Apple, or Microsoft when they take charge of the passkeys for you.
That’s entirely optional and not forced. You can use FOSS password managers that store your passkeys, that can log into all those services.
If you’re referring to proprietary password managers (IE like google or apples), then that concern applies equally to all the passwords you’re storing with them. So that concern is not specific to passkeys.
I don’t disagree with any of that. You and I will be fine, as long as whatever sites we use don’t insist on evil-only providers. The trouble I’m thinking of is for average uncritical phone enjoyers who are guided into a flow where they’re migrated to using passkeys with whatever propriety junk they’re using and end up locked into Matacorp Secure Cloud who now control their access to all their accounts, where once they had a list of passwords written in the back page of their diary.
But that’s exactly the problem. Those that were the target audience for the article do not have well managed passwords. For them the passkeys arguably do increase security, while having a bit more “lock-in”.
For those that have well managed passwords (like probably most in this community), they are perfectly fine to use because they don’t have lock-in either. I have full control over my used passkeys.
Basically you’re not getting the “normies” to use proper password management, and for them they do provide additional security and convenience. They can always add more passkeys on different vendors, you’re not limited to just 1 per service. Yes, adding them is a hassle, but so it’s managing passwords and following higher security standards in general.
The “normies” don’t have a clue what passkeys are either.
They don’t need to. It just works to log them in when they’re using one of their own trusted devices. Being able to unlock their phone gives them full access to the services (apps, websites) that are authenticated to that device.
I know that, and you know that, but passkeys are supposed to solve security-related problems by reducing friction.
What passkeys can’t overcome is people dismissing the popups asking if they want to switch to passkeys or create them.
The problem with passkeys is they are 20 years too late, and no one cares.
What passkeys can’t overcome is people dismissing the popups asking if they want to switch to passkeys or create them.
I think it’d actually be pretty easy. Just ask:
Trust this device, with biometrics?
Most people will say yes on their Apple/Samsung/Google devices.
a way to increase lock-in
Lock-in was already being achieved by mandatory use of apps which require iOS or Google Play services.
Plenty of banks etc which I can simply not use because of this requirement, and others which downgrade you to password+SMS security (used to be a physical TOTP token) if you refuse their app.
How do they increase lock in?
Why would I want a convenient passkey stored securely inside my password manager if I can just, much more conventiently, lock myself out of my account by losing my phone?
Don’t put it in your phone?
would be nice, but apparently i do not exist according to my bank without a phone on my person 24/7
The point is that attestation allows for services to restrict where do you put it on.
The attestation certificate includes metadata securely identifying the exact maker, model, and capabilities of the local authenticator you used, with the purpose of allowing services to verify if they trust the authenticator.
The issue is not with passkeys themselves, but the attestation feature specifically, which is part of the standard.
The author of this post works in Apple, Passwords team. They do not deny that there’s attestation; they argue that it’s only used to prevent bad actors.
Cool, we’ll trust corporations then!
Corporations never, ever, act badly!
It is not like they are treated as people with rights but fewer consequences for their actions, right? Right, guys?
and they would never violate your trust and later force this onto you because the love their users.
the more apologetics for this shit i see, the less i trust it.
Agreed. Even if you trust her words, she’s only one person and Apple could override any decisions she makes.
It makes me wonder about the people in Google who worked for, maintained, and advocated the openness of Android. Only now for Google to continually lock it down.
What is the difference from two factor with aegis + random generated password with keepassxc, and passkey saved on keepassxc.
The passkey won’t work on a lookalike phishing site, but the password and totp can be inputted into it
There isn’t one. That’s exactly the point. The original article had issues with vendor-specific passkeys (Google, Apple) that essentially are only accessible through their ecosystem.
- Describing TOTP as a “great solution” for adding security to a password-based account. When the most common threat model on the web is phishing (a word the post never mentions!), TOTP hardly buys you anything. TOTP is phishable.
If (after decades of awareness) you manage to get phished while using TOTP, you shouldn’t be trusted with a phone or any digital information at all
TOTP tokens are often distributed as QR codes, where you can store in more than one place, store/copy/transfer in plaintext between people or places. Compromise of that token gives permanent access to all TOTP codes generated.
I’m not a fan of how most TOTP apps and implementations actually work right now.
Granted. But there are plenty of users who probably shouldn’t be trusted with any digital accounts, but they still have to use them for daily life. If we can make it harder for them to mess up we should.
The problem is that if they’re getting phished with TOTPs then they’ll walk through a scammer over the phone to let them access their accounts other ways.
You can put all the security in place all you want but 99% of breaches aren’t coming from red team actors “hacking” into a system. It’s way easier (and even moreso now with LLMs able to do robo calls with human sounding voices) and get Brian from accounting to give up his shit…or even the CEO to give up his.
I’ve seen it all, they willfully will give over their access because they’re dumb as fuck.
Can we Not Act like only idiots can get phished? Nobody is Safe, especially when the phishing attempt is incredibly convincing
Most of the people who get phished, are not educated enough to avoid it. They don’t want to be, because computers are just supposed to work and not be something they need to learn.
If you’re educated and ask questions vs just assuming everything is legit and giving away everything they ask for then you realize quickly that phishing is not as convincing as you’re making it out to be.
Phished doesn’t mean just a plain old phone call or email these days. It can still happen, and does. But there are now reverse proxy systems that clone legit web pages to steal TOTP by appearing legit, and they’re highly successful.
I didn’t know of this, I still prefer the control TOTP gives you but yeah, that makes an argument for the passkeys I guess.
I know someone who works at a fairly large public university where TOTP is required. People (mostly students) are still constantly getting phished, despite TOTP. I guess young people don’t have the decades of awareness that some of us have.
no, fuck passkeys. they will lock everyone in with their proprietary bullshit.
use a good generated password in a manager if you will. don’t trust anything but corps are pushing.
What propietary bs? It’s an open standard.
the www is also an open standard, and google controls it through chrome.
that’s quite a leap.
Yes google does have a lot of control over the HTML and HTTP specs because they control the most popular web browser. Whether people are or will in the future be “locked in” to google for that reason is debatable.
Regardless, the potential for a company to dominate the implementation of a specification is not a reason not to create said specification.
Regardless, the potential for a company to dominate the implementation of a specification is not a reason not to create said specification
yes it is
So we shouldn’t have created HTTP because Google might appear?
Is this the new “killing baby Hitler”?
Honestly not sure what’s going on in this thread.
Don’t invent the internet because then you will have internet companies.
we should have learned our lesson after they did and done our damndest to create protocols immune to capture. there were excuses in 1989, there aren’t now
How do you create protocols immune to capture?
Imagine if HTTP explicitly documented as part of the standard that the “User-Agent” header, when provided, must include a tamper-proof cryptographic signature that allows to securely identify which browser version the user has (with a consortium maintaining a list of registered browsers) so that websites can reject access if you are not using a browser they trust or they don’t like that your browser is too old…
Considering how much abuse there has been with the User-Agent header… I can’t imagine it being a good idea to include such a thing in the standard.
If on creation HTTP had included things like that, then I think Gopher and other competitors at the time might not have been a bad option, honestly.
I don’t see your point I’m sorry. This would make it easier for Google to exclude small competitors.
google will also control the moat popular passkey manager. is that not obvious by how they already control the most popular password manager, browser, search engine and more?
I’m really struggling to follow your logic here. You’re saying they already have the most popular password manager so we shouldn’t support a next gen, more secure, open standard because Google will have the most popular client for that also?
The obvious problem with this reasoning is that… there will be alternatives of you don’t wish to use googles implementation.
unless google finds a way to lock you in (or out), like they’ve done pretty much everywhere else. me and you using foss won’t change what’s coming for society at large.
i mean how can you not see how they have been hoovering up everything on the internet for the last couple of decades and think they won’t find a way to to capture this too and run it their way, like all before it?
I do see Google’s behavior and I’m certain that they will do their best to capture this as they have everything else.
However, it’s an absurdity to suggest that we should not develop new protocols because google will act to ensure they have the largest market share.
What are you talking about? I’m locked in with all my passkeys that are stored in my open source self hosted password manager that syncs across all my devices?
Like, I’m confused on what you mean
people self-hosting their open-source password managers are in the vast minority. most people will use whatever is pushed to them, which is gonna be vendor lock-in.
Sure but that’s not an inherent issue with passkeys.
You can use whatever proprietary password manager you’d like. Sure that often means people are using the device built in ones…
But why should that stop me personally from using passkeys?
True story … take it as you like,
my 8 months old reddit account was filter flagged as a bot after commenting the following
“death to the Epstein class and fuck Israel the genocide state”
The only way to get it back according to reddit was if i used IOS authentication passkey.
Not the normal password manager i use on Firefox but no it must be passkey on ios.
Now i am convinced that 8200 unit of the Zionist regime have my facial biometrics.
You can use a foss alternative like keepassxc to set up a passkey so you control the file instead of trusting it to Apple.
This ^
the idea is that there will be a ‘central repository of trust’ and it ain’t you. the step of moving that to ‘verifying you’ is short. the next step of monitoring you comes for free. the next step of managing you is the plan.
A passkey is just traditional PKI in a trench coat, your biometrics are A) not even required as you can just use a PIN and B) are not sent from iOS when unlocking the passkey.
I love how you provided no rebuttal to my two points. The EFF even goes into detail on how it works. The beauty of an open standard is that you can verify these assumptions of yours.
I don’t need to, if you read my comment again you would understand my point.
But let me try to breakdown what i mean; you need to wake up from your lala land, if you truly think and believe corporations that are actively participating in genocide and killing children will really care about “policies and terms of usage”.
Your statement reads like someone who used to believe the “don’t be evil“ google policy citing it as evidence in his head.
If that is how you stand, then good for you, but i don’t, actually i view such corporations as a dangerous entities to humanity.
Hope its clear for you now.
I misread your second sentence as “my 8 month old’s reddit account” and was confused when there was no payoff to the premise of the shitpost.
You don’t need passkeys if you don’t have anything important to steal, or any accounts on anything you would feel sad to lose. Just cancel all your subscriptions and sail the high seas! Nobody likes you anyway!
