I evaluate it based on that they replace passwords.
Password is shared secret, which is bad. Passkeys are public-private cryptography, which is good. Passwords has to be stored in a password database and your username is gonna be stored alongside it, so you might as well store your passkeys there istead. Passkeys have the added benefit of being possible to store in an authenticators secure storage, like a security key. I see no real downsides, relatively speaking. Passwords that are created by humans, those not using pw managers, are gonna be bad.
With my security key, using FIDO2, i have to have the key, touch the key and enter a PIN. My key is never exposed, signatures happen on device. It’s neat!
See I bought a couple of yubikeys, but have zero passkeys becuase I’ve yet to encounter any service that lets me choose to store their passkey on said yubikeys. How do you do it?
Seems to me that if I could tie them to yubikeys (ideally on two keys), remote attestation wouldn’t risk me allowing any third party to assert influence or control over my choices of technology - is that right?
Amazon is probably the most visible example of trying to create passkeys all the damn time, but it never offers any user choice about where this passkey would be (my best guess is that its on the computer and tied somehow to my login).
I’d happily use passkeys with yubikey, but I’m not willing to set up a different passkey on each computing device I use. Thatś a housekeeping/maintenance headache I dont want or need and it would be made all but impossible if I give up visibility and control over what devices are ‘authorised’ and how.
I hate to think how many people have inadvertently set up passkeys on devices that they rarely use.
If the site supports passkeys, the site asks the browsers WebAuthn API to create a passkey. From there it’s up to the browser where the passkey ends up. In firefox, for example, it tries my security keys first, and I can choose which one by touching it. If you use a password manager, like KeepassXC, you install an extension to hijack this process, so all passkeys end up in the password database.
Attestation on a security key just means the firmware on the key has to be signed. So in theory, you can’t use something like the ‘Solokey hacker’. When sites ask for information on my keys I ususally choose to block it in the browser. That has not been a problem so far. I allways register two separate keys for each service and they are fully mobile. A security key you could not bring with you would be pointless.
I have amazon passkeys on my security keys. I didn’t notice anything unusual with the registration process.
All the sites I’ve encountered have allowed me to use my security keys. Google had some dark pattern that made it confusing to set up and Discord does not allow passkeys for login, so the ones they let me create ended up undiscoverable passkeys, only for 2fa. The only site my solokey didn’t work so far is l1t forum. I don’t know why. but I doubt they require an attested device.
I use a NFC key for my phone.
I would not accept a device bound passkey. Nor would I let a third party, like Google, manage them for me.
Problem is passkey generation, expiration logic, etc., is often not well protected, so if a hacker is able to get it, they may not be able to target a specific account, but they can target random accounts with semi-bruteforce since there’s no username to limit tries against or lock the account if there’s too many tries. Just use a botnet and start throwing probable keys at it and you’re likely to get a few.
Also, with a password repository, I protect that as exceptionally as I can, but I can always change my passwords and would do so of that was compromised. But I’m not talking about the passkeys of an individual being stolen, I’m talking about a compromised site having very little way of determining of a hacker has gotten enough information to narrow brute forcing down to a relatively manageable level with a botnet and using that to access random accounts for personal information scraping. And the user may have no idea it’s happened to them since the bad tries never were associated with any login.
You’d be surprised how poorly most modern web developers (especially LLMs) understand cryptography and the importance of protecting secrets, often storing them in plain text in poorly protected code repos, etc. On a site with a large enough user base and access to that information, it’s absolutely possible to reduce the number of tries to hits to a manageable level for a distributed botnet that can’t easily be blocked.
I evaluate it based on that they replace passwords. Password is shared secret, which is bad. Passkeys are public-private cryptography, which is good. Passwords has to be stored in a password database and your username is gonna be stored alongside it, so you might as well store your passkeys there istead. Passkeys have the added benefit of being possible to store in an authenticators secure storage, like a security key. I see no real downsides, relatively speaking. Passwords that are created by humans, those not using pw managers, are gonna be bad.
With my security key, using FIDO2, i have to have the key, touch the key and enter a PIN. My key is never exposed, signatures happen on device. It’s neat!
See I bought a couple of yubikeys, but have zero passkeys becuase I’ve yet to encounter any service that lets me choose to store their passkey on said yubikeys. How do you do it?
Seems to me that if I could tie them to yubikeys (ideally on two keys), remote attestation wouldn’t risk me allowing any third party to assert influence or control over my choices of technology - is that right?
Amazon is probably the most visible example of trying to create passkeys all the damn time, but it never offers any user choice about where this passkey would be (my best guess is that its on the computer and tied somehow to my login). I’d happily use passkeys with yubikey, but I’m not willing to set up a different passkey on each computing device I use. Thatś a housekeeping/maintenance headache I dont want or need and it would be made all but impossible if I give up visibility and control over what devices are ‘authorised’ and how.
I hate to think how many people have inadvertently set up passkeys on devices that they rarely use.
If the site supports passkeys, the site asks the browsers WebAuthn API to create a passkey. From there it’s up to the browser where the passkey ends up. In firefox, for example, it tries my security keys first, and I can choose which one by touching it. If you use a password manager, like KeepassXC, you install an extension to hijack this process, so all passkeys end up in the password database.
Attestation on a security key just means the firmware on the key has to be signed. So in theory, you can’t use something like the ‘Solokey hacker’. When sites ask for information on my keys I ususally choose to block it in the browser. That has not been a problem so far. I allways register two separate keys for each service and they are fully mobile. A security key you could not bring with you would be pointless.
I have amazon passkeys on my security keys. I didn’t notice anything unusual with the registration process.
All the sites I’ve encountered have allowed me to use my security keys. Google had some dark pattern that made it confusing to set up and Discord does not allow passkeys for login, so the ones they let me create ended up undiscoverable passkeys, only for 2fa. The only site my solokey didn’t work so far is l1t forum. I don’t know why. but I doubt they require an attested device.
I use a NFC key for my phone.
I would not accept a device bound passkey. Nor would I let a third party, like Google, manage them for me.
If you wanna try it out; use https://webauthn.io/
Problem is passkey generation, expiration logic, etc., is often not well protected, so if a hacker is able to get it, they may not be able to target a specific account, but they can target random accounts with semi-bruteforce since there’s no username to limit tries against or lock the account if there’s too many tries. Just use a botnet and start throwing probable keys at it and you’re likely to get a few.
Also, with a password repository, I protect that as exceptionally as I can, but I can always change my passwords and would do so of that was compromised. But I’m not talking about the passkeys of an individual being stolen, I’m talking about a compromised site having very little way of determining of a hacker has gotten enough information to narrow brute forcing down to a relatively manageable level with a botnet and using that to access random accounts for personal information scraping. And the user may have no idea it’s happened to them since the bad tries never were associated with any login.
This is not plausible, would take billions+ years to stumble upon just one with a botnet that has all online PCs on Earth utilized.
Remote attestation is the real problem with where passkeys are going.
You’d be surprised how poorly most modern web developers (especially LLMs) understand cryptography and the importance of protecting secrets, often storing them in plain text in poorly protected code repos, etc. On a site with a large enough user base and access to that information, it’s absolutely possible to reduce the number of tries to hits to a manageable level for a distributed botnet that can’t easily be blocked.