Website supports passkeys. Browser supports passkeys. Extension supports passkeys.
Then why does it keep asking me to “insert my security key”? Why doesn’t it work?
Passkeys are bullshit.
Passkeys mean a spread of enshittification to ever more areas of life. Specifically, they
- force me to use an extra OS on an extra device and keep it around just to use a site with passkeys.
- add insecurity and inconvenience. I neither can backup the passkeys nor use them on another device. (That’s not implemented on Windows.) This user experience is laughable in 2026. The passkeys are forever locked on the device where I created them. I am forever chained to exactly one device. If it breaks down, my life ends because our lives depend on digital technology.
- take away control from me and force me to trust third parties. I have to trust the hardware, the OS, the proprietary software, which makes me feel very uncomfortable as someone used to use Free software. Security by obscurity was always a bad idea.
- deny me anonymity and control over my accounts. I can have only one account per domain.
- are a black box with no user interface. With passwords I know exactly what account name and password I enter at which site. With passkeys I get asked for a PIN. That is all. There is no indication what exactly I authorize. This is a lot like clicking links in emails and giving your banking details to everyone who asks.
The recommendation “do not use them” is cute. They are forced on people. I can’t choose.
some of this is disingenuous. For example you’re supposed to make multiple passkeys for your devices so that you can still Access your Accounts even if you lose your Main device (Ofc its still shitty because this forces you into the cloud if you only have 1). Also thats why the passkeys being bound to their „birthplace“ is Not really more of an issue than the others. Also im Not sure where they are forced? In fact i wish it would be more supported in certain apps
For example you’re supposed to make multiple passkeys for your devices How do I do this? Can you link to a guide?
Also im Not sure where they are forced? The big transition is underway. Switch to passkeys or you are out.
So… Uh… What’s a passkey? The article is saying they’re pure evil. Everyone here is saying they’re good. Everyone knows what they are except for me.
What’s the difference between a passkey and a password?
So in order to log into most websites, you need your username/email address and a password.
You can save your username/password in your web browser or in the cloud.
Sometimes people get lazy and reuse passwords, sometimes people forget their passwords.
Passkey is a replacement for usernames/passwords. It does require that the passkey is saved somewhere, often on your device (in the cloud is possible, but non-standard).
When you “create” a passkey, this passkey is used only at a single place. For example, you’d have a passkey for your bank, another one for your email, another one for Lemmy. You have no say in the matter, that’s just how it works.
When you log into a website that has passkey enabled, your passkey/password manager pops up, you click on the passkey and that’s it. There is no email address, there is no password, no MFA.
edit: oh, you also asked about the difference between passwords.
It’s all about improved security.
You go to certain websites, and they’ll only allow a-zA-Z0-9, others require a minimum length of 8 characters, needs 3 symbols (except ! for whatever reason ;)
Then you have no idea how the website is storing your password. Are they encrypting it? Did they do it correctly?
If you look at the number of “breached/leaked” passwords on the internet, it’s because it’s hard to securely store passwords.
Passkey solves all this. Websites are just given “a public key” and it can be “just stored”, no special treatment necessary.
This is still fuzzy. What would this look like in BASIC?
Sounds like a turbo encabulator.
Also, that website is full of sand traps. Every time I accidentally mouse over something, a huge menu covers up the definition.
As the article states, they’re an extremely malicious solution to a problem that has better, simpler, and easier to understand solutions.
It’s also a very good solution to the “problem” of users being able to do things our corporate overlords don’t want us to do.
In short, they’re even worse malware than the ones they’re sold as protecting us from.
Enshittification manifest.
Despite the attention-grabbing headline, the only negative thing I can find in the article about passkeys are this section:
Attested passkeys7 are the last but most important type of passkeys you need to know about. These types of keys use what’s known as remote attestation to cryptographically verify – using the aforementioned tamper-proof cryptoprocessor that lives in all your modern devices – that you are using one of the several approved passkey managers, and not using a custom one that you vibecoded yourself and which can lie.
This is the feature that means you no longer get to make the calls about your passkeys. Fortunately, attested passkeys are not yet required on most websites.
I don’t see why we should assume this hypothetical is going to happen. There is a lot of different software that supports passkeys (I use keepass for example), and going against the open standard and forcing all their users to use a specific software would basically make them unusable.
Overall every password / login style has its dangers and bad ways to use it, including passkeys. That doesn’t make them “traps”.
Also, like, if it doesn’t allow me to set up a passkey because my manager or OS is not supported…I guess I’m not setting up a passkey then, which is OK by me, so there is no problem.
No problem until they make every other method more and more difficult. Which is already happening.
I only use passkeys when the alternative is an onerous song and dance.
A lot of platforms will happily not allow people to login with a KeePass passkey. Just like some platforms already no longer let me login with a password and force me to login with a code they send me per email instead.
Which are those? I haven’t had one that rejected keepass so far.
The article warns that passkeys could be used, assuming they become the only form of logging into platforms, to prevent someone using the wrong operating system to log into those platforms.
Being prevented from using certain applications because you use the wrong OS is nothing new, but there is, from everything i have seen, always a reason to block it, they dont do it for someone elses benefit. A lot of banking apps cannot be used on many android roms; without microg or gapps many android apps wont work (some wont work even with microg); games sometimes use kernel-level anticheat that forces players to use windows; people solved this issue by just not using those apps
Why would a significant portion of used websites/applications that require accounts stop allowing passwords or authenticator apps, relying on this open standard, force certain options to be used for the standard and ensure that the user isnt on an operating system they have no reason to care about. There are already methods to prevent people from using a certain OS, they could just not rely on an open standard
SQRL, been around before passkeys, it’s portable, and it’s FOSS.
Pepperidge Farm Remembers when the FIDO Alliance threatened to recommend the blocking of FOSS implemententions because they gave the users control. Control over backing up. Control over not using biometrics.
When something wants too much power, you must avoid.
FIDO 2 level 2 also requires the supply chain documented and a bunch of expensive certificates, which locks small vendors and open hardware implememtations out.
This is some weird doom and gloom take on a real improvement in public security that we don’t see very often. Of course there are a lot of stake holders. Of course every protocol is complicated. I run security for a company, and my auth systems mandate attested (i.e., company-provided) hardware keys. You’re not using a passkey on my systems that I’m not providing you. Pretty simple concept, yes?
Do you have any examples of any public service requiring attested keys? No, because it really doesn’t make sense. But because the protocol supports it, people shouldnt use passkeys? Shitty hot take.
I agree it would be helpful to make the feature set clearer to the end user, but the UX are still a mess across OS and websites. IMO that’s not a reason to not use them.
Passkeys are much more phishing resistant. They apply unqiue-credential best practices. I’ve been managing unique passwords for decades, and passkeys are a great improvement. Very few companies are going to completely remove other forms of auth, and so suggesting passkeys are ruining people’s ability to share passwords is really premature. And even so, companies have been pursuing other strategies for identifying shared accounts much more effectively than shared credentials. Thinking that’s a reason to not use passkeys just tells me you aren’t valuing how passkeys elevate public opsec.
Passkeys are projected to overcome TOTP market share next year. That is honestly amazing. I like the writeup on the features, but this nefarious, conspiratorial narrative doesn’t fit what’s actually happening.
There are lots of reasons to like passkeys from a technical/enterprise standpoint, but I do think you’re missing the critical issue the article is speaking to: digital sovereignty.
Passkeys, while more secure in the average usecase, shift the balance of control over your access to services. Yes, you can no longer write your password down on a post-it and leak it in a photo—thats’s a good property. But trading that at the expense of your freedom to run software as you see fit on hardware you bought and paid for? For many people, myself included, that’s not an acceptable tradeoff. There are plenty of tools and systems around passwords that folks can use to make passwords+2FA match or even exceed the security properties of passkeys.
The thing that should chill everyone is the fact that built into the standard is a switch (given to service providers, not users) that locks out the people that do want to have control of their digital infrastructure. Not everyone can or should be expected to run like that, but they should not be blocked from doing so. Similar with the Right to Repair; not everyone can exercise that right on their own, but no one should be prevented from repairing what they bought.
Similary, I do believe it’s my neighbor’s right to practice a religion of their choosing. So if the government tries to prevent them from doing that, I’m going to go grab my pitchfork, not because I share their religion, but because they should be able to make that choice. Likewise, while I might not want to exert control over how my credentials are backed up, I still reserve the right to do it, and support anyone else’s ability to do it.
And to address the slippery slope objection, I have to point out that this is not particularly theoretical. When Big Tech has provided service providers with the opportunity to enforce restrictions on your device, service providers have used it. Widevine DRM, Google Play Protect, etc… It’s why my LineageOS phone can’t use banking apps, which is a shame since some features like Zelle payments are specifically a mobile-only feature, and so I cannot use it anymore. I either run my phone to the exact specs and settings that my bank and Google prefer, or I’m denied access to basic banking anywhere but my desktop (and who knows how long until the block my access there, I run Linux afterall).
I do not trust Big Tech with my devices, and passkeys increase their capability to deny anyone who doesn’t buy into their ecosystem, and further entrenches those who already are. I for one find that despicable, and an unacceptable tradeoff. There’s no reason it has to be this way though, passkeys could have been the best of both worlds. However, they’ve been compromised with features that serve platforms at the expense of user freedom. It’s the kind of disempowerment that happens when you give the reins to power-hungry, profit-seeking corporations.
There are plenty of tools and systems around passwords that folks can use to make passwords+2FA match or even exceed the security properties of passkeys.
Likewise, while I might not want to exert control over how my credentials are backed up, I still reserve the right to do it, and support anyone else’s ability to do it.
Widevine DRM, Google Play Protect, etc…
I do not trust Big Tech with my devices, and passkeys increase their capability to deny anyone who doesn’t buy into their ecosystem
I can only speak for myself, but I hold all of those values you claim. I see no evidence, technical or otherwise, that passkeys are subverting or acting counter to any of these principles. Frankly, it’s a baseless claim that passkeys lock people out of their own control/infrastructure. I think people conflate non-transferable, TPM passkeys with passkeys. Just don’t use that if you don’t want to.
FWIW, passwords were never “yours”, they are PSK (Pre-Shared Key) with a service. Maybe you invented the credential, but it’s not yours. You have historically enjoyed being able to bulk export credentials, and if that property is important to you, then you should be using transferable passkeys. Passkeys have a well-defined transferable format – if they are the type that can be exported.
I can only continue repeating that the passkey spec is public and transparent. If the service is not supporting passkeys in a way that you want to use them, then complain to that service. I don’t decide that service X doesn’t support transferable passkeys, but they should.
DRM and other gate keeping efforts, IMO, are tangential to passkey support. Passkeys are fine, vendor-locking and walled gardens are not.
I see no evidence, technical or otherwise, that passkeys are subverting or acting counter to any of these principles. Frankly, it’s a baseless claim that passkeys lock people out of their own control/infrastructure.
The evidence is in the fact that the passkey standard provides the means to deny service to anyone whose passkeys do not match the service provider’s preferences. This is a non-issue with passwords, since there’s no way for a provider to tell whether or not, for example, a password is simply remembered, stored in your password manager, backed up, shared, etc… The threat model of the user can inform what choices they make there. The platform may require certain things of the password, like length requirments or another factor, but it ends there.
You’re correct in that the standard supports passkeys with similar data sovereignty properties; however, the standard includes controls that allow service providers to dictate that those properties be configured to the provider’s preferences, not the user’s.
Just don’t use [locked down passkeys] if you don’t want to.
It would all be well and good if that were actually entirely my choice, but it’s not. The standard specifically includes a trump card for the service provider in the form of remote attestation. You seem to think that’s tangential, but I reject that. It’s kinda the whole point.
Authenticating based on a shared secret is an interface with a special property: there’s no way for a service provider to know how you remember a secret. That guarantee is extremely important. Service providers accepting password based authentication are guaranteed to not be able to enforce requirements on how you remember your password.
The Passkey standard removes that critical protection by explicitly supporting remote attestation in the standard. It does not matter that the standard is public if it does not preserve that guarantee.
Passkeys are fine, vendor-locking and walled gardens are not.
If you’re not a fan of walled gardens, I would recommend against giving corporations the mortar, bricks, gates, and locks with which they use to build them. Maybe they won’t use them in ways you don’t like, but you’ll never have a guarantee that they won’t.
IMO you’re reading way too much into the value proposition of passwords. Services can “deny service” for arbitrary reasons already with zero consequences, but your idea is that they will ban based on… passkeys? You’ve got people banned from youtube for arbitrary comments. You’ve got MS locking out non-profits for arbitrary reasons. But in your mind, those all pale in comparison to what will happen if we all start using passkeys? I’m not buying what you’re selling.
You seem to think that’s tangential, but I reject that. It’s kinda the whole point.
I didn’t say it was tangential. Attestation is for very specific purpose. Non-attested credentials are not sufficient for government and corporate security. I cannot allow BYO hardware to authenticate my users on my services. I highly doubt any public service would require attested passkeys. I doubt passwords will stop being allowed, almost ever, so you probably have nothing to fear. Maybe you can throw that comment back in my face in 20+ years, heh.
Here’s another counter-point: Google, Apple, et. al already implement proprietary authentication mechanisms. Sign-in prompts on recent devices, email codes, etc. are all proprietary. None of these companies killed passwords despite having implemented the tools to do exactly that with vendor lock-in. All the evidence is the opposite. This is one of the first times we’re even getting an open standard authentication, the exact opposite of “walled garden”.
Authenticating based on a shared secret is an interface with a special property: there’s no way for a service provider to know how you remember a secret.
The same special property that allows rampant attacks on the public. I deal with so many people with compromised email inboxes, malware installs, stolen credentials, etc. Passwords are not the end solution to end user security, and I welcome improvements that also simplify UX.
I think we’ve probably hashed out enough of the sides of the argument. Good luck to you.
FWIW, passwords were never “yours”, they are PSK (Pre-Shared Key) with a service. Maybe you invented the credential, but it’s not yours. You have historically enjoyed being able to bulk export credentials, and if that property is important to you, then you should be using transferable passkeys. Passkeys have a well-defined transferable format – if they are the type that can be exported.
This is the equivalent of Sony arguing that you never owned any games, you owned a license. Congrats. You’re the best kind of correct - technically correct.
There is no flag on a password that determines if it is transferable. There is no amount of “if you don’t like it, don’t use it” that will work out in your favor if you’re not in the majority. If you give corporations the power to limit consumption while increasing prices, they will eventually use it. Especially if they provide a product you can’t get anywhere else (and this is their goal for every product - even if they have to buy other companies to do it - even if they have to collude to offer the same service). It’s the foundation of our entire economic system.
This is the equivalent of Sony arguing that you never owned any games
It’s far from that and bad analogies pollute otherwise very simple conversations. If you want a more apt analogy, this “debate” is shaping up closer to LED vs incandescent bulbs.
It’s easy to say passwords are sufficient when you’re one person practicing good op-sec. It’s not when you’re supporting thousands of people of varying technical proficiency, thousands of machines, thousands of services, and thousands of bad-actors. It was an even simpler time when 4 digit PINs were “sufficient”, but the world you and I live in is more complicated. Certain passkeys are transferable, so you’re not even losing out on that capability. Curmudgeon arguments aren’t convincing. Passkeys aren’t “giving power away”. Using passkeys doesn’t mean your giving up freedom. Passkeys have no bearing on the “economic system” and inflation. As far as the IT ecosystem is concerned, we’ve never lived in a more open and capable time. There are so many alternatives to every service (that isn’t tightly coupled to copyright). Of course companies are trying to offer unique products people can’t get anywhere else. None of this has to do with passkeys.
Maybe you’ll prefer more practical criticism then:
To put it simply, every passkey is locked into a large combination of factors: device + platform (OS) + app + the service being used. It is not trivial and often downright impossible to change any of these factors or to render them agnostic. This makes it complicated or impossible to backup passkeys or make them portable.
It’s fine for them to not be portable when they’re used on a work phone, running the company mandated OS, authentication app and passkey store, to login into a suite of apps that are also company-approved.
I do need portability and backup as an individual who wants to be able to login into multiple services across multiple apps running on multiple OS on multiple devices. But I can’t, because the big tech players (Microsoft/Google/Apple etc.) are actively trying to capture passkeys into their platforms and make it hard to get out in any practical way.
With passwords and TOTP I can run something that will sync them across devices and fill them in into any app in a unified manner (or use copy & paste if all else fails). With passkeys I can’t.
FWIW, the article may be a bit outdated. I’m not a FIDO expert by any means, but there have been improvements in the spec to help define how to transfer passkeys (CXF and CXP). The situation should be better than 2024, but if you’re using TPM-locked passkeys, you’re just in that locked box already.
I think there’s somewhat of a conflation of concerns. It sounds like your concern is, I have a credential manager and want to migrate to a new credential manager. I just want it to be simple to migrate my massive number of passwords, right? I need to bulk export + bulk import. EASY. But… what if your first password manager has a bug in the seed generator? Oops, you have to rotate 500 passwords now… there is no easy, off the shelf solution for that. It’s basically the same for hardware-bound passkeys. If you generate hardware-bound passkeys, you’re not going to simply replicate them to another hardware-bound passkey. The whole purpose of that type of credential, is to make it hardware-bound. There are a lot of meaningful reasons to do that from a security POV.
Now, I think what probably needs to be made clearer, is that if you do want that kind of credential, you shouldn’t be using TPM-backed passkeys. You should be purchasing independent hardware (FIDO2 hardware keys) or only make software+transferable passkeys. Personally, I have several hardware keys and I register them with one being a backup. If the vendor posts a vulnerability notice that there’s some big gap in their hardware, I will have to go and rotate every passkey. I know that is what I am signing up for, but maybe not a lot of people do.
It sounds like your concern is, I have a credential manager and want to migrate to a new credential manager.
No. My concern is that I want to choose my own credential manager, and I want it to work with any passkey usage out there. And that’s impossible.
Which credential manager, and which service is not working with it? Just looking for an example to understand what you’re struggling with. I feel like I don’t have these problems heh.
What do you mean, which. All of them have this problem. You can’t force any platform owner to use your favorite credential storage when they decide they don’t want to. All of them will tell you “for my services you use my storage, period”.
Literally just name a service that forces this. If it’s all of them, it should be pretty easy.
OK, Apple. How do I use passkeys created on iOS for accessing Apple services, on a Linux laptop?
I haven’t found this to be the case in practice (IE passkeys are plenty portable). I’ve successfully used passkeys on multiple browsers, OS’s, and apps, all stored using a FOSS password manager (keepass). Any FOSS password manager that is either self-hosted, or syncs, should work just as well with passkeys as it does for regular passwords or TOTP.
My issue with passkeys is the fallback. For instance, when the biometric fails, you can use a fallback login. That’s fine (and good that it exists). But the fallback for me is a pin number. That pin is far less secure than my password or a randomized TOTP number.
How do you handle that for your setup?
Yeah good question, and more people should give consideration to account recovery. Are you referring to recovery PINs? There’s really a couple aspects to the design:
-
They are single use – this is really just to make sure users aren’t coming to rely on these PINs. It’s also a simple fact that passwords that are typed are more likely to be leaked than passwords that are never typed. Single-use do a great job taking advantage of that.
-
They lock after very few attempts and generally have more aggressive anti-hammering/brute force/backoff protection than password/TOTP attempts.
-
They help get new devices registered without already having a passkey.
Securing/backing them up has the same challenges as TOTP secrets management. Storing them in a password manager is what I generally do, but there are a few that warrant keeping offline completely and storing it in a fire-resistant/water-proof enclosure.
The other reliable recovery is just registering several passkeys and keeping one as the recovery credential. I always issue two hardware keys per employee, and we have a pretty lax policy if more are needed or replaced. We also don’t allow employees to recover their own accounts. If we’re at that situation, we need to know in order to help. And FWIW, I don’t use biometrics.
-
My background is very much not in this world so caveat my questions/response below with that mind set. I do however try to practice decent personal opsec such 2fa (TOTP), password manager with random generation, etc.
I feel like a lot of what you stated was covered in the article. For example the article states that problem isn’t the number of stakeholders, it’s that none of them are consumer advocacy groups.
I understand that the author maybe leaned on the password sharing example too much but I think that was in an effort to present the material in a friendlier manner to the average reader. The closing statement makes it clear it’s not really about Netflix, etc. The main concern is that attested passkey requirement will now be the easiest way to force specific software and hardware upon user. The GraphenOS example is a good one.
You might not use the attested flag in that manner but I have zero doubt that once passkey adoption rate passes a certain threshold Google will be more than glad to miss-use that flag to lock people out of their gmail account unless they have the most recent phone and software.
Do you have any examples of any public service requiring attested keys? No, because it really doesn’t make sense. But because the protocol supports it, people shouldnt use passkeys? Shitty hot take.
I think this is a bad take. “Because this potential is not being misused right now it won’t be a problem in the future” has not really served us well thus far.
My understanding is that the article is saying that passkeys are giving away too much control to the second party. That can and will be abused.
But again, layman’s understanding from my end.
Happy to discuss a few points you’ve brought up.
it’s that none of them are consumer advocacy groups.
I would put that more as a curiosity than a red flag. I doubt they were excluding groups, but happy to hear about if they were (e.g. donation minimums or something to that effect). The author actually says that whole paragraph is “notable” – great, noted. I hope that doesn’t mean they were using it as an argument for “Do not use [passkeys]” (the title of the article). FWIW, W3C recommends use of passkeys. EFF has had blog articles for 3+ years suggesting advantages of Passkeys. I also don’t know what a consumer advocacy group would suggest differently here – DONT implement an attestation spec? Attestation is a massive improvement for specific types of security.
The GraphenOS example is a good one.
I went and looked for what you were referring to and didn’t find anything. What do you mean by this? I use GrapheneOS. I use passkeys. Google being hostile to third party OS doesn’t seem related but maybe I am missing something.
I have zero doubt that once passkey adoption rate passes a certain threshold Google will be more than glad to miss-use that flag to lock people out of their gmail account unless they have the most recent phone and software.
Well this seems like a reasonable point I should expand on. Maybe I can plant a seed of doubt about this hypothesis. A few comments:
-
People being locked out of their email is actually one of the biggest logistical nightmares for email providers. Proving someone is who they say they are is actually fairly difficult as well as doing it at scale. People lock themselves out of their own email. People get locked out of their email because of phishing attacks. In practice, Passkeys reduce phishing rates significantly. That’s a massive win for email providers in reducing their burden. Intentionally locking out a massive number of their customers is an unthinkably bad move, comically bad. It wouldn’t happen.
-
Email is the most important mechanism of communication for people’s security. Bank and financial accounts, paid services, government notices… they are almost all through email. The idea that they will vendor-lock email to specific hardware… it’s not realistic. They would face such massive PR And public blowback. Email is also accessed from more than just your phone. “Requiring” an attested phone would kill a massive use case.
-
People already feel locked to their email provider – it’s extremely difficult to change all contacts you have to a new email address. Passkeys don’t change that. Phone hardware doesn’t change that. So I’d say it’s just a continued problem, and not a reason to not use passkeys.
-
The FIDO Alliance had like three phone manufacturers out of 250 members.
Overall, I don’t see how passkeys, or attestation, could lead to a world where any public service would want to require attestation, and even if they did, there’s no reason it would be “requires my X branded phone”. These companies supported the development of this protocol for the specific reason of NOT wanting to cater to specific vendors. This is a vendor-neutral specification. There are many hardware and software providers. They all have their own motivations, and they hope implementing the spec brings in more customers, improves consumer security, and reduces their operational costs. Do you still have zero doubts about a future world with vendor-locked attested passkeys for public services?
passkeys are giving away too much control to the second party.
There are already dozens of hardware and software passkey vendors. It’s honestly amazing how little lock-in there is. There’s a half dozen FOSS authn services providing passkey services. You can buy dedicated hardware for passkeys from multiple independent companies. What “control” are you referring to? Companies could always force rotate your password, make it invalid, etc. Any control you thought you had was an illusion.
Cheers
There are already dozens of hardware and software passkey vendors. It’s honestly amazing how little lock-in there is.
If my passkeys are spread across dozens of vendors I wouldn’t call that good, first of all, it’s just a headache.
Secondly, just because there’s many of them doesn’t mean there’s no lock-in. Can I get my passkeys out? Can I migrate them freely between any vendors? Can I take backups for myself from all the vendors? Can I restore the backups into each vendor? Can I replace those vendors with a self-hosted solution?
If my passkeys are spread across dozens of vendors
You’re picking what vendor you want, not picking unique vendors for every unique passkey.
Can I get my passkeys out? Can I migrate them freely between any vendors? Can I take backups for myself from all the vendors? Can I restore the backups into each vendor? Can I replace those vendors with a self-hosted solution?
It depends. It sounds like you just don’t like or want hardware-locked/TPM passkeys. If you generate that type of passkey, then no you can’t do much of that. Maybe your major complaint is that some major OS’s default to hardware-bound passkeys?
My reference to “vendor” meant to include self-hosted/FOSS solutions.
You’re picking what vendor you want, not picking unique vendors for every unique passkey.
I don’t get to pick anything, in fact. Most often you’re told “that’s how it is, that’s where the passkey goes” and there’s nothing you can do about it.
It sounds like you just don’t like or want hardware-locked/TPM passkeys. If you generate that type of passkey, then no you can’t do much of that.
Again, _I_ typically don’t get to make that choice, it’s being made for me. And that’s a problem.
I replied to someone else asking the same thing, but we can avoid this infinite-universe syndrome. Which service is forcing a specific passkey provider, and doesn’t offer alternatives? I just need an example to understand because I don’t know of any and I have been using passkeys for awhile, so I’d appreciate being informed.
-
Thanks.
Thanks.
This is why I only use passkeys that are stored in my self hosted vault warden. As long as you don’t create passkeys locked to a vendor’s manager, I don’t see any reason to avoid them.
The Bitwarden client is so bad though. I seem to only be able to use the passkey on the specific device I saved it in.
I’ve experimented with this and haven’t had a problem. However, I was using the open source fork Vaultwarden and only the browser extension(s).
I am using the same combination, but the passkeys do not persist between different browsers
In the bitwarden browser extension, settings -> autofill -> “make bitwarden your default password manager”
Is this checked?
I also set a “pin” in settings -> account security -> “unlock with pin”.
(After reading the article: maybe passkey requires bitwarden to be “more secure” - I dunno)
Haven’t had that issue using Vaultwarden backend and bitwarden android, Firefox and Chrome extensions.
Yep, using the exact same and still have the problem.
Hmm I haven’t had that issue, I have a lot of passkeys saved and they sync fine and are usable in Firefox on my laptop as well as with apps on my pixel 5 running lineage. I have noticed that occasionally an app will refuse to give me the option to create a passkey in bitwarden, but I just skip those and I haven’t noticed that issue in a while.
Have you checked whether the site entry shows the passkey on both devices? On mine it’ll say “passkey created …” on both devices in the vault.
The main problem is that there’s no place to view my passkeys like there is for passwords for TOTP (according to my searching and their website, anyway)
When you go to log in with a site that uses passkeys, bitwarden pops up with a list of passkeys for that site, the same way autofill shows your logins for that site.
In vaultwarden, they do appear in the web client. The behavior you’re describing hints that your passkeys are not being stored in bitwarden.
…and tbh, the UX sucks pretty bad: I was trying to store a passkey in bitwarden, but it was failing (unrelated networking error). I had two options: add it to bitwarden (which failed) or cancel. I hit cancel and was prompted for my fingerprint, which I provided – this ended up storing it on my device… no input, no description of what it was doing. The website came back with “passkey now enabled” :facepalm:
If your security relies on a password, you will always be anxious that somebody, somewhere, has somehow figured out what it is and already has access to your bank account.
No I won’t. All my passwords are something like
I0!2b6KJ!eA04WiJ&&MFToCQ7CN*4mvband each is used for only one thing because I’ve been using a password manager for over a decade.I switched to using a password manager last year that scrambles all of my passwords like how you describe, and hot damn is it nice, both in terms of security and convenience.
I0!2b6KJ!eA04WiJ&&MFToCQ7CN*4mvbMwahahaa, I’m in
I don’t think any service allows passwords that long
Most do. Source: I usually use passwords that long.
Maybe 1 in 10 don’t, and I find that annoying since 32 characters containing only lowercase real words and spaces has several times as much entropy as 8 characters of random mixed case letters, numbers, and symbols.
I default to using 128 characters because that’s the max for the password generator I use. A surprising amount of accounts are OK with that, like more often than not. I have pared accounts down massively since using a password manager though, and use privacy respecting services when possible, so I may be self selecting here.
the vast majority of mine are +50 characters - you are just wrong. the services which strictly limit the length are rare and their security is suspect since they should be hashing your input anyway
I mean it’s probably a good idea to have some kind of limit in place, because you really don’t want to deal with attackers trying to transfer megabytes worth of text in the password field and triggering an OOM on your end. But this limit should still be pretty high ofc.
for sure, but limiting it under 64 (the length of a sha256 hash) isn’t ideal at all
Didn’t know that. I stand corrected
Ah there’s that phrase again, remote attestation. That has very quickly become my least favourite phrase, and I’ve yet to see an example of it that benefits the end user. I didn’t know passkeys supported it but I’ll be avoiding them even harder now that I know they do.
I’ve already been avoiding them because I don’t see how there’s any security advantage over TOTP unless the passkey is the only way to access the account (which would be awful for account recovery). And the concept of tying my login to a specific device is stupid. I also don’t appreciate how many websites keep trying to stealthily create passkeys automatically on login without explaining what they are or letting the user make an informed decision.
I’ve already been avoiding them because I don’t see how there’s any security advantage over TOTP…
I’m not going to challenge your choice in using passkey or not. However, I do want to set the “technical record straight”: passkey is the successor to TOTP in every technical way*.
TOTP works by having a “shared secret” saved by both you and the place that your authenticating against. This shared secret is then mixed with current time to generate a rotating number that the client shares with the remote server. The remote server does the same calculation, if the rotating numbers match, the user is successfully authenticated.
With TOTP, this means that there are two attack vectors: your device and the remote server. If an attacker is successful in getting the “shared secret” from either, your TOTP is effectively broken.
Passkey works more like ssh-keys. The client generates a public and private keypair. The client only shares the public portion with the remote server and stores the private key locally (or in your password manager).
So the only attack vector (with passkey) is your device (this is often why it’s bundled with attestation). Also passkey is not dependant on both the client and server having their time kept in sync. With TOTP, if you have more than ~30 seconds drift between the client and server, they will be generating different rotating codes and never match (which is confusing when you need to explain this to your Grandma).
- there is one thing TOTP can do, that passkey cannot: TOTP is 2FA, your TOTP can reside on a separate device (ie your phone when logging in using your PC). With passkey, you’d need to enable 2FA on the passkey manager (which varies from manager to manager).
…unless the passkey is the only way to access the account (which would be awful for account recovery).
Recovery options are never going to go away. With TOTP, you often have one-time use backup codes. Email, SMS recovery etc.
Thank you so much for clearly and concisely explaining how TOTPs are kept in sync between server and user. I KNEW the answer couldn’t be “magic”.
Oh that’s good to know, I didn’t realise TOTP was vulnerable on the server side. I’m still going to steer clear of passkeys for now though.
Never used. Each time a website asks me if I want to create one I have this uneasy feeling of not actually owning the key.
You’re not wrong to have that feeling.
Where is the passkey saved? Can I take it out and back it up? Can I use it on another device, running a completely different OS? If I lose this device the passkey is on, what happens?
The answers to most of these is negative.
That is the issue of passkeys. They are hard to understand and without understanding there can be no trust.
This is actually a terrible take. Passkeys provide a very large security benefit over passwords and have an open standard.
It’s particularly ridiculous that they seem to think TOTP good passkey bad. They solve the same problem: symmetric persistent encryption like passwords is very weak. TOTP solves this my making it not persisting and passkeys solve this by making it asymmetric. Passkeys are mildly more convenient because you don’t have the copy a code over.
Both also have the same potential for abuse, any service could require you use their specific app. The fact that this article makes it sound like TOTP is a perfect open standard while passkeys are a Trojan horse for abuse is ridiculous. If most services are using the open standard for TOTP why wouldn’t they for passkeys? Also not all services do obey the open standard for TOTP. I’m sure I’m not the only one who was forced to install the duo Authenticator because their institution was somehow sold on their protocol being stronger than the open standard.
TOTP and passkeys are comparable and both with doing.
Both also have the same potential for abuse, any service could require you use their specific app.
That’s not true. TOTP is just a mathematical formula for how you mix a “shared secret/seed” with the current time.
In the authors article, they mention that you could write your own python program to generate the correct rotating numbers.
There is no way Big Tech could force you to use a specific app, because at the end of the day, TOTP is just math. 1+1=2, that could be calculated by you, your cellphone, or me - it doesn’t matter.
According to the article, Passkeys, on the other hand include a bunch of metadata. For example, can this passkey be copied or moved to another device.
The article is also very clear that all those fields can be faked except attestation.
And for those at home, attestation is a cryptographically secure way for an application to be certain that the application, operating system, and hardware are not modified to work in a way that the OS provider, application, and hardware vendor expect it to.
This has been abused by google/android to prevent/limit people from installing applications outside of the google play store, its been uses to force people to only use google-approved os’ (no cfw, no grapheneos). The same technology is a requirement for windows 11 (TPM).
Now, if FIDO agreed to not include attestation as part of the metadata - this would not be a discussion: everyone would love and use passkey, as you (the user) get to decide how to store/backup and (optionally) share this key.
But that’s not what FIDO did, the attestation flag is included in the metadata. And the author speculates that once people accept passkey, Big Tech will turn the screws and then start to force how you store your passkeys.
So, in an apocalyptic future “coming soon”, when you try to log onto your bank, you’ll be greeted with an error:
“We detected that your passkey is stored in the cloud. Your security is important to us. Please, install your new passkey onto your local device using your manufacturers approved Google Android Operating System and Google Approved passkey application.”
Really there is no way big tech can force me to use their app? Ok so you know how the open standard for TOTP is a six digit code computed from the time and shared secret? Well every student at the university of California and every employee at many companies across the US has to use an Authenticator app called duo which uses a 3 digit code generated by the app at the moment you attempt to log in. How does it do that? No idea it’s closed source. Is it even a formula like the TOTP open standard? Probably not I’d guess duos servers just send a code to both sides when you attempt a login. And would you look at that suddenly we have TOTP that I can’t write myself and I’m forced to use some shitty app.
Now I do recognize the point you’re making but I want to emphasize it’s not about attestation being in the metadata or not. It’s about open standard compliance. As the open standard is written even if you have to have hardware attestation you can build the passkeys yourself (because this is functionality all password managers are quickly starting to have) and frankly having each passkey being device locked is good security practice to protect you from credential stealers and related malware. You’d still be in control and you could still sign in to as many devices as you want. You’d just need to make a new passkey for each one if you don’t wanna sign in the old fashioned way with a password and dual factor and such.
The abuse scenario you describe would require a departure from the open standard. Is this possible? Of course. As I said some companies already do this with TOTP. But I don’t see that as a structural fault of passkeys that TOTP somehow doesn’t have like the article tries to imply. Both only work well for the consumer if the open standard is adhered to.
Did you even read it? It bends over backwards to espouse the positive aspects of passkeys before getting into the control issues.
TIL what passkeys are. Thx for sharing.
I’ve always thought they were a really bad idea. It puts everything into a “setting you have” factor and removes the "something you know as well as the need to match the factor to a username. And if the site is hacked, they can get a lot of information about how the passkeys are generated even if they don’t get access to secure info. It just simplifies the ability to hack a random account in many ways if not a specific one.
I evaluate it based on that they replace passwords. Password is shared secret, which is bad. Passkeys are public-private cryptography, which is good. Passwords has to be stored in a password database and your username is gonna be stored alongside it, so you might as well store your passkeys there istead. Passkeys have the added benefit of being possible to store in an authenticators secure storage, like a security key. I see no real downsides, relatively speaking. Passwords that are created by humans, those not using pw managers, are gonna be bad.
With my security key, using FIDO2, i have to have the key, touch the key and enter a PIN. My key is never exposed, signatures happen on device. It’s neat!
See I bought a couple of yubikeys, but have zero passkeys becuase I’ve yet to encounter any service that lets me choose to store their passkey on said yubikeys. How do you do it?
Seems to me that if I could tie them to yubikeys (ideally on two keys), remote attestation wouldn’t risk me allowing any third party to assert influence or control over my choices of technology - is that right?
Amazon is probably the most visible example of trying to create passkeys all the damn time, but it never offers any user choice about where this passkey would be (my best guess is that its on the computer and tied somehow to my login). I’d happily use passkeys with yubikey, but I’m not willing to set up a different passkey on each computing device I use. Thatś a housekeeping/maintenance headache I dont want or need and it would be made all but impossible if I give up visibility and control over what devices are ‘authorised’ and how.
I hate to think how many people have inadvertently set up passkeys on devices that they rarely use.If the site supports passkeys, the site asks the browsers WebAuthn API to create a passkey. From there it’s up to the browser where the passkey ends up. In firefox, for example, it tries my security keys first, and I can choose which one by touching it. If you use a password manager, like KeepassXC, you install an extension to hijack this process, so all passkeys end up in the password database.
Attestation on a security key just means the firmware on the key has to be signed. So in theory, you can’t use something like the ‘Solokey hacker’. When sites ask for information on my keys I ususally choose to block it in the browser. That has not been a problem so far. I allways register two separate keys for each service and they are fully mobile. A security key you could not bring with you would be pointless.
I have amazon passkeys on my security keys. I didn’t notice anything unusual with the registration process.
All the sites I’ve encountered have allowed me to use my security keys. Google had some dark pattern that made it confusing to set up and Discord does not allow passkeys for login, so the ones they let me create ended up undiscoverable passkeys, only for 2fa. The only site my solokey didn’t work so far is l1t forum. I don’t know why. but I doubt they require an attested device.
I use a NFC key for my phone.
I would not accept a device bound passkey. Nor would I let a third party, like Google, manage them for me.
If you wanna try it out; use https://webauthn.io/
Problem is passkey generation, expiration logic, etc., is often not well protected, so if a hacker is able to get it, they may not be able to target a specific account, but they can target random accounts with semi-bruteforce since there’s no username to limit tries against or lock the account if there’s too many tries. Just use a botnet and start throwing probable keys at it and you’re likely to get a few.
Also, with a password repository, I protect that as exceptionally as I can, but I can always change my passwords and would do so of that was compromised. But I’m not talking about the passkeys of an individual being stolen, I’m talking about a compromised site having very little way of determining of a hacker has gotten enough information to narrow brute forcing down to a relatively manageable level with a botnet and using that to access random accounts for personal information scraping. And the user may have no idea it’s happened to them since the bad tries never were associated with any login.
Just use a botnet and start throwing probable keys at it and you’re likely to get a few.
This is not plausible, would take billions+ years to stumble upon just one with a botnet that has all online PCs on Earth utilized.
Remote attestation is the real problem with where passkeys are going.
You’d be surprised how poorly most modern web developers (especially LLMs) understand cryptography and the importance of protecting secrets, often storing them in plain text in poorly protected code repos, etc. On a site with a large enough user base and access to that information, it’s absolutely possible to reduce the number of tries to hits to a manageable level for a distributed botnet that can’t easily be blocked.
And if the site is hacked, they can get a lot of information about how the passkeys
I don’t like passkeys, but this is not a real worry, unless the service you are using is ran by idiots. I mean to say that knowing how passkeys are generated is typically not helpful in guessing your passkey. There are more interesting questions where security fumbles, like is your data encrypted on the provider side & is that encryption tied to your passkey or not, often not, since they want to mine your data.
Have you ever used bank software, or some government services site? It is often really hard to not get the idea that it was designed and run by idiots. As someone who’s worked as a software developer most of my life, it is not difficult for me to believe it, either.
You’d be surprised how poorly most modern web developers (especially LLMs) understand cryptography and the importance of protecting secrets, often storing them in plain text in poorly protected code repos, etc. On a site with a large enough user base and access to that information, it’s absolutely possible to reduce the number of tries to hits to a manageable level for a distributed botnet that can’t easily be blocked.
But your private key should never leave your secure storage to be put anywhere. If you somehow export it and then also give someone or an LLM access to it, then this is ofc very stupid. But this attack vector is possible with every authentication.
