Re:Bitwarden Moves into Passwordless Security
by toomuchtodo on Friday May 26, 2023 @04:36PM
(#36089226)
Disclaimer: Bidwarden paying user, big fan, no complaints. A component of my Infosec work is managing customer IAM for a fintech including passkey deployment and identity assurances. Thoughts and opinions always my own.
The password manager industry is having an existential crisis with passkeys and more advanced consumer/customer IAM auth coming down the pipeline. We're going from a situation where you would have to protect an email or username and a secret string (passwords) to cryptographic primitives/PKI (passkeys) baked into the most often used systems. I don't think Auth0 or Okta is going away, but password storage is going to slowly become less of a need for IdPs go forward.
Many on HN argue you need a lot of flexibility with passkeys (ability to export, backup, move across ecosystems, etc). I won't flat out say they're wrong, as you do want to have some insurance against Big Tech fuckery or other efforts to use this tech to create walled ecosystems. But! Passkeys are a bit of a paradigm shift. Credential stuffing goes away. Phishing mostly goes away (I have some concern about exporting passkeys and what that's going to look like from a threat model, but TBD I suppose). You might have multiple passkeys for a service account (icloud, Android, Chrome, etc), but that's okay. The point is that you're no longer relying on a relatively short string to provide access for users, and that's a good thing considering what the current threat model is around password auth. We will always require some sort of account recovery mechanism, whether auth is current state passwords or future state passkeys PKI. Depending on your trust model, a magic link to the email address might be enough. If not, maybe you have to identity proof the user with a government credential to restore access when you have a low assurance they are who they say they are.
TLDR Passkeys are awesome, and hopefully folks don't require a password manager in the long run. They were a shim until better auth mechanisms could be developed and deployed.
Re:Bitwarden Moves into Passwordless Security
by badrabbit on Friday May 26, 2023 @05:34PM
(#36089772)
They moved into a fad. Be very careful and weary of any solution that is passwordless and will have you not use 2FA. Even a yubikey with a pin is significantly inferior to a yubikey and a different auth mechanism (password,device cert+pin,etc...)
Whatever better auth method they are selling, don't let it be reason to stop using passwords.
I'll give you a classic example: sysadmins set up ssh publickey login, they are now immune to brute force attacks so they use it all over the place. One admin exposes the private key in a public git repo and gets the whole company compromised. They could have used both passwords and public keys and stopped that compromise.
My point: 2 is always better than 1, even if it is a fancy new impenetrable and hyped up method of auth.
The password manager industry is having an existential crisis with passkeys and more advanced consumer/customer IAM auth coming down the pipeline. We're going from a situation where you would have to protect an email or username and a secret string (passwords) to cryptographic primitives/PKI (passkeys) baked into the most often used systems. I don't think Auth0 or Okta is going away, but password storage is going to slowly become less of a need for IdPs go forward.
Many on HN argue you need a lot of flexibility with passkeys (ability to export, backup, move across ecosystems, etc). I won't flat out say they're wrong, as you do want to have some insurance against Big Tech fuckery or other efforts to use this tech to create walled ecosystems. But! Passkeys are a bit of a paradigm shift. Credential stuffing goes away. Phishing mostly goes away (I have some concern about exporting passkeys and what that's going to look like from a threat model, but TBD I suppose). You might have multiple passkeys for a service account (icloud, Android, Chrome, etc), but that's okay. The point is that you're no longer relying on a relatively short string to provide access for users, and that's a good thing considering what the current threat model is around password auth. We will always require some sort of account recovery mechanism, whether auth is current state passwords or future state passkeys PKI. Depending on your trust model, a magic link to the email address might be enough. If not, maybe you have to identity proof the user with a government credential to restore access when you have a low assurance they are who they say they are.
TLDR Passkeys are awesome, and hopefully folks don't require a password manager in the long run. They were a shim until better auth mechanisms could be developed and deployed.
Whatever better auth method they are selling, don't let it be reason to stop using passwords.
I'll give you a classic example: sysadmins set up ssh publickey login, they are now immune to brute force attacks so they use it all over the place. One admin exposes the private key in a public git repo and gets the whole company compromised. They could have used both passwords and public keys and stopped that compromise.
My point: 2 is always better than 1, even if it is a fancy new impenetrable and hyped up method of auth.