The problem with that is you have no way to be sure that the knowledge in your head won't somehow make its way into someone else's head. There's a reason that phishing is a thing.

Knowledge-based access is inherently problematic: if you don’t police passwords, most people will be compromised because they use weak and/or shared passwords. If you use strong passwords, you’re also screwed if you lose your phone so you’re in the same reset game with trivia questions which are increasingly weak because they can be answered from information on Facebook/LinkedIn or from breaches from other companies which used the same question. New logins from previously unused devices in a new part of the world shouldn’t work anyway because that’s indistinguishable from a successful attack.

Passkeys avoid all of that, but you need backups either in the form of a Yubikey or a recovery code in your wallet. Yes, that’s annoying but there is no world where nobody is annoyed, so it should be a question of whether more people are inconvenienced by their accounts being breached versus traveling and losing all of their devices but still being able to remember their strong passwords.

Not that I worry about that, but it is worth pointing out that you may lose some legal protections when you use physical things rather than your knowledge.

More to the point, this is also not what the average computer user is worried about. It assumes that they’re targeted by police, have something they need to keep secret, and that those police can compel physical access but scrupulously obey civil rights protections.

Additionally, it's a bit silly in the context of email since the authorities will obtain it from the service provider anyway.

That said, you can still add an encryption key to your phone and you're back to "knowledge based" with the additional caveat a thief would also need the hardware as well.

[1] https://news.ycombinator.com/item?id=33550824

[2] https://www.selectlawpartners.com/faqs/do-you-have-to-give-p...

There's nothing preventing you from password-protecting your YubiKeys.

Exceptions do exist; two I can think of are passkey-based cryptocurrency wallets and the so-called "PRF extension" that allows using a passkey as a source of entropy for e.g. locally encrypting a password manager's database.

I have the NFC enabled variant so it can be used with a mobile phone

Why should I be forced to pay for a YubiKey? €60 is a fair chunk of money.

Maybe buy me one I'll consider it otherwise I'm not convinced. I will once corporate gives me free open-source hardware.

The fact that this user thinks the average person would be happy to have to cary one around is wildly out of touch.

That's my point.

Yubikey doesn't pass the grandma test. Your everyday user isn't going to be carrying one around anytime soon.

With passkeys via yubikey it's insert key, enter pincode (just like at the atm), touch and go. You don't even have to enter your account name or email because that's derived automatically.

Anyone who can get cash out can use a yubikey. Very different for MFA apps.

I still stand by the idea that most users wouldn't be happy having to cary it around. We can't even get most users to use password managers which are built into their phones (1 in 3) and there was a collective meltdown when Apple removed the headphone jack which required people to cary a dongle for wired headphones. Telling people they need to cary around a yubikey for anything they want to log into just isn't going to fly.

https://www.security.org/digital-safety/password-manager-ann...

I think you’re right, any change has to fight against the “this is how I do it already” inertia.

The problems are the "corner" cases: enrolling new keys, removing old keys, handling unintentional destruction of the key. The last one, in particular, is really problematic.

Some of the security mechanisms that a YubiKey provides are an extreme inconvenience. For example, I want to be able to clone my key via some mechanism in case it gets destroyed. I don't want to have to enroll 3 separate keys in every service on the planet just in case I put one in the wash accidentally. That's not possible with a YubiKey--for good reason--but it's a significant annoyance.

We consider "duplicating a physical key" such a common need that we have automated machines to do it at 7 Eleven. The fact that we don't have the same consideration of digital ones is problematic.

It's a real shame, as I'd also love "Yubikey twins" of which I can put one in a safe deposit box and have the other one always with me, without needing to periodically synchronize them to all services I'm using them on.

Password managers have the added complexity of still needing a password themselves and all the quirks that come with auto filling and programmatically reading forms.

I'm not sure Apple head phones are quite a fair comparison. Outrage was also due to proprietary connectors that were patent encumbered.

1. Not everyone caries keys (I don't and haven't for years)

2. Because every other existing alternative doesn't require you to cary something extra. Asking people to cary something with them to be able to sign into accounts will feel like a step backwards to most people.

3. Because most people only need to pull out their keys a few times a day. Requiring a Yubikey for every sign in means you'd now need to constantly be pulling your Yubikey out to sign into things.

> Password managers have the added complexity of still needing a password themselves and all the quirks that come with auto filling and programmatically reading forms.

I don't buy this. I use Lastpass which is arguably the most widely used password manager. I sign in using the master password maybe once a month and it works seamlessly on my phone. Apple and Google both have their own native solutions as well and still only 1/3 of people use them.

> Outrage was also due to proprietary connectors that were patent encumbered.

I think you're living in a bubble. Just go look back at the headlines from when that was announced. Almost no one gave a shit about it being a proprietary connector. People were upset because they were being forced to buy and cary a bunch of dongles. Just look at the comments on these reddit posts:

https://www.reddit.com/r/funny/comments/5a6lbd/it_just_works...

https://www.reddit.com/r/funny/comments/5j66d4/the_world_isn...

https://www.reddit.com/r/dankmemes/comments/ox3s26/apple_do_...

I just leave it connected to my computer. It requires a physical touch for every interaction so it can't be 'milked' for tokens like old fashioned smart cards.

Physical keys work in one (or rarely in several, but basically unchanging set of) locks, and I carry around about 2-3 of them.

Hardware security keys, by contrast, work in many different places/accounts, potentially even for multiple accounts on the same service, but only after registering them there.

That's not how people experience physical keys: You don't, for example, move apartments or visit a friend, and the landlord/friend "registers/adds your key for their lock". If you lose your physical key, you can't "quickly revoke it from all doors" that it locks (without kicking everybody else out).

Now I only have the Yubikey as a backup authenticator for my most valuable accounts and use a software solution for most low-value things.

Yubico had some ideas around "paired Yubikeys" which shared the same root secret, but I believe that model won't work anymore with FIDO/CTAP2 due to some counter value that was added there over U2F. (It might be possible for them to just not have a security counter; I'm not sure.)

The bigger issue with yubikeys is that you need more than one in case you lose one. And most sites only allow one passkey per account because all the mobile implementations can sync the private key. Yubikeys can't and that's actually a good thing because it makes them unique and eliminates the whole sync mechanism as an attack plane.

Even when/if sites do allow multipe passkeys per account, the fundamental contradiction remains: Your backup key(s) are supposed to be kept somewhere secure where they won't get lost, stolen or destroyed, which ideally means some sort of off-site backup (at your bank or whereever), but at the same time every time you register for a new service you do need to register all your backup keys, too.

We're not talking about annoyance here, we're talking about data breaches on the one hand and permanent account lockouts on the other. There is no world where the majority of people remember distinct passwords for each service, and there's likewise no world where the majority of users carry a Yubikey or even download their recovery codes at all, much less carry them with them.

So we're left really with two choices at the extremes: do we go for the failure mode where people reuse passwords and lose money and data that way, or the failure mode where a company is physically incapable of restoring a customer's account? Given the choice between these extremes, companies will always choose the former.

Now, these extremes aren't the only choices, but then you get to the crux of OP's argument: passkeys stored in a password manager aren't any more secure in practical terms than random passwords stored in a password manager. Your auth system is only as secure as its recovery mechanism (which is the observation that led Slack to initially not bother with passwords at all).

There's one way in which I disagree with op, which is that passkeys prevent users from typing in a password and storing it in the password manager, which many users do—they effectively enforce random passwords rather than it being just a best practice that needs to be taught.

This isn’t true, and that’s where your confusion comes in. Passkeys cannot be phished because the protocol includes the server name and does not expose the key to the remote server. The past decade of U2F/FIDO/WebAuth deployment has used that as the marquee selling point because it’s a very common exploit which cannot easily be prevented with traditional passwords and MFA.

the only difference is maybe in-app browser where the passkey integration might work more easily but even so:

1) it is still a matter of integration and/or using an actual browser

2) in-app browsers are inherently insecure anyway (at least on android)

No, it doesn’t. Most password managers allow you to fill passwords for other domains and all of them allow copy-paste. The people who support those users know that phishers can convince people to do that which is why they’re encouraging adoption of WebAuthn.

And this is an important distinction to make—if passkeys have a terrible UX (which right now they absolutely do) and are only marginally better at phishing protection than a password manager, they could actually be a less secure solution overall by encouraging lazy workarounds.

It is my contention that this statement is:

1. Categorical,

2. False, and

3. Categorically false

From the questions and comments across the rest of this thread, the misunderstanding here seems clear: the person I'm responding to did not realize that FIDO2 cryptographically binds credentials to sites.

If my password manager running on my desktop can provision and access the passkey for use on another device like my phone, then so can malicious code running on my desktop, and exfiltrate it to hackers. The original design, where the private key only exists on a TPM and the private key never leaves the TPM doesn't have that flaw.

I think there’s a place for both of them in WebAuthN based on the security/availability/convenience tradeoff which will be different for every application.

If you care about your users only using the trusted hardware, non-synchronizing kind, you have to use attestation anyway (or malware running on their device could create credentials that only appear to be backed by secure hardware).

Unfortunately both Apple and Google seem to have unshipped their attestation support without replacement (they used to support hardware backed credentials in their devices too for a while) in the interest of not confusing users about what is and isn’t synchronized – now everything is.

PayPal does this already by only allowing safari or chrome. With bitwarden on Firefox I'm locked out.

> PayPal does this already by only allowing safari or chrome. With bitwarden on Firefox I'm locked out.

It works for me! However I do vaguely remember having to set them up on Chrome initially, but after that, they now work well even in Firefox. (Only on my computer; on my phone, I get an absurd non sequitur of "security keys only work on desktops").

Oh ok, I haven't tried that. I don't even have Chrome installed anymore.

And yeah I get that message too on my phone, even with standard FIDO2 MFA (not full passwordless Webauthn). Stupid because it does work just fine with other sites.

Attestation is already coming. Why do you think Microsoft is pushing TPM2.0 so hard?

Apple and Google very intentionally threw FIDO attestation out of the windows without replacement, and Microsoft frankly doesn't matter enough for non-corporate contexts at this point. (Imagine your bank only allowing passkeys on Windows, but not iOS, Android, or macOS.)

And yeah I moved away from Mac for this reason among others. My devices should answer to me and me alone.

But I think the upheaval in the 2000s helped to make the TPM not the horror scenario it could have been. I don't think the ruckus was overblown at all. Don't forget Microsoft still wanted to kill Linux back then.

And yes Apple has tpm. It's just built into the cpu and called differently.

Yeah, so does Google. But as mentioned before, even though they were both using it for WebAuthN in the past, they both stopped doing so.

What stronger proof for attestation being dead in the context of WebAuthN can you possibly get than the two largest implementers actively discontinuing it?

There are many good reasons to be cautious of how attestation is used and critically examine who it serves – a company you're doing business with, you, or both – but in this specific context, it's arguably no longer relevant.

This really embodies what's wrong with the world in 2024 — people believing in their world views so strongly that they ignore actual real world evidence that is directly contrary to their very strongly held but incorrect world view.

Every release macOS got more closed and removing features I cared about. At the same time introducing stuff that only works if you're all-in on Apple. I use every OS under the sun. So that didn't work for me. Because all Apple's cloud stuff works on Apple alone (with a handful of exceptions on windows).

The lock-in of passkeys was just one of the things that bothered me. Not really the attestation per se, I'm aware it doesn't currently have it though I wouldn't be surprised if they introduce it if passkeys actually take off.

But like I said, Apple does have hardware control over other features. They do have a secure element which is just like a TPM which blocks you from changing certain files on the system and if you disable system integrity protection they turn off some of the features of the OS, like the ability to use iOS apps on macOS. It's basically DRM.

Android calls it the Play Integrity API now. Hardware-backed enforcement isn't reported from the attestation servers to 3rd-parties yet because there are still a few old devices with broken implementations, but that switch can be flipped at any time.

The only remaining gap is Windows.

You can't read out a passkey, nor can you read out a challenge to somebody that they are to sign with their passkey, because it's not possible by design.

Are you sure that Microsoft’s solution means that they are “physically incapable of restoring a customer’s account?” Apple’s system keeps copies of recovery keys in their cloud [1], unless you explicitly tell them not to do this. It seems like a reasonable compromise for most people’s security needs.

[1] Or effectively something like that.

Another factor here is the number of logins that a user is required to perform. Anecdotally this seems much higher in a corporate setting than personal. I might login to Microsoft SSO 15+ times per day for different services. Signing in to apps on my phone is rare.

“Secure, comprehensive backups” sounds scary until you remember that it’s only ever meant not disabling a checkbox for iCloud, Google, or Microsoft users.

Any solution which does not allow me full autonomy to maintain a backup is not acceptable.

Right: it's on the small device I take everywhere and use for everything. The one most likely to get lost, stolen or completely destroyed, and absolutely has to be replaced in about 5 years.

That device. You want to permanently lock data to that thing?

(My phone is basically disposable in terms of my expectations for it's future survival, and man do I not like the Android recovery options still)

This is why no passkey implementations do this: the mainstream implementations all require synchronization and if you read e.g. Apple’s iCloud documentation note that the offline recovery mode is designed for the case where all of your devices are lost:

https://support.apple.com/en-us/102195

Passkey synchronization provides convenience and redundancy in case of loss of a single device. However, it's also important that passkeys be recoverable even in the event that all associated devices are lost. [...] To recover a keychain, a user must authenticate with their iCloud account and password and respond to an SMS sent to their registered phone number. After they authenticate and respond, the user must enter their device passcode.[...]"

And we get back to knowledge based auth in the end.

So don't put it on only your phone, put it on your phone, your laptop, your desktop, and maybe a physical hardware token. Lose all but one and you're still fine.

I lost my phone. I don't bother with the cloud sync'd passkeys. I didn't lose any of my identities, because I had access through other devices.

If the giant meteor comes crashing down to destroy everything around me, I don't think I'll be that concerned about getting locked out of a video streaming site.

Even if I have a house fire. Small chance it'll actually destroy all my devices and paper recovery codes. And the odds of having that house fire is also pretty low.

If a tornado destroys my house, chances are my hardware tokens will survive. More of a question of where they ended up. A tornado destroyed my brother's house, his iPad ended up just fine.

I don't really live in an area where landslides are possible. If I did I'd probably want to plan around that with the passkeys. But that's true for a number of things at that point though.

What if every device hosting a password safe breaks?

A password safe, I can trivially backup however I wish. The cloud, a USB I keep at mom’s house, print it out, whatever (in fact, I do maintain encrypted offsite backups in a couple of locations).

Boy do I have good news for you then. Passkeys can often be stored in many available password safes. Bitwarden, KeepassXC, LastPass, 1Password, Dashlane, and more all support passkeys. Make one on whatever device, one in your password safe, and you'll have redundancy.

And I'm not talking about people needing to carry two $1,000 phones or a $1,000 phone and a $1,000 laptop. You could have your second key be a small, cheap (<$40), durable authenticator. Another thing on a keychain, another card in a wallet. Really that big of a deal?

And if that's truly impossible for you, then sure I'll agree passkeys might not be for you. I agree, some people like those who are homeless have a hard time keeping any material goods safe. I'm not arguing every account for every person needs to be only passkeys. But people here are acting like it's something impossible for nearly anyone to use safely. And I don't think that's based in reality. I think a lot of people could use them safely if they wanted to, but there's a massive amount of FUD about them.

See the section titled "Recovery security" in this support article:

https://support.apple.com/en-us/102195

Not from the company's perspective, from the individual's.

We just consolidated everybody's login into one platform. One monolithic database that contains the PII of EVERYONE.... What could present a bigger, better target than that? It's literally too good to pass up. Previously an attacker would have to compromise half a dozen vendors in order to completely pwn someone. Now they just need access to one.

Additionally, password managers are dangerous. Not a single one or them has been able to go more than 12 months without reporting a significant hack. Just another consolidated attack vector.

Like VPN providers. Why would I scourge the internet to gather browsing history of a target when the user has already consolidated that information into once place for me?

So no, please don't blame people, blame bad authentication mechanisms (including passwords) and those that hang on to them despite better alternatives.

> There is no excuse for using weak passwords anymore.

Weak passwords are only a small part of the problem. You can get phished with even a 256-bit equivalent random string.

https://www.infosecurity-magazine.com/news/nist-scraps-passw...

Because taking a holistic look at an entire system and attempting to improve it is better than relying on each and every individual. Take aviation for example. If there is a plane crash and it is found that the pilots ignored a warning indicator, they look and see if the warning was prominent enough, if it is properly prioritized, and if it is something that can be corrected at the system level. Pilot training is only one of many factors they look at, and human error is taken as an inevitability.

In aviation, pilots are highly trained and highly regulated. With accessing services online, it is basically universal access by all people of all skill and intelligence levels. Making a system more inherently secure is the only reasonable solution.

I don't like it that the solution is to usurp control from the user and gate authentication through what will, in my opinion, ultimately be a small number of big tech companies. We'll eventually be dependent on having an Android phone, an iPhone, a Microsoft account, or similar. It'll be a world of "trust me bro" credential managers and you'll have to hope you never get banned by the big tech companies because it'll have a life altering impact if that means losing access to all of your accounts.

The reality is that big tech has proven we can trust them because we're nothing more than 1 of a billion customers as far as they're concerned.

> Passkeys avoid all of that, but you need backups either in the form of a Yubikey or a recovery code in your wallet.

Passkeys create a huge burden in the context of managing devices and recovery codes.

To start with, I'm not a fan of recovery codes. I have so many accounts that it's almost impossible to keep track of all the recovery codes. I have to organize them well enough that anyone who would happen to get access to my file cabinet would own my life.

To mitigate that, I need a system for tracking which recovery codes I have in my file cabinet and I need a plan for rotating / revoking them if anyone gains access to them. Even worse, printed recovery codes are observable without altering the owner (aka me). Someone could photocopy all my recovery codes and I wouldn't know I've lost control of them.

As for devices, I use Yubikeys for my high-value accounts and managing them is a huge pain in the ass. I have 5 sitting beside me. One is old, two are v4, two are v5. I didn't keep a list of all the accounts I used them for from day 1, so now I have to keep all of them. Forever. Just in case.

The only way Passkeys will solve those problems is by taking complete control of authentication and treating it like a managed service. You'll be giving up control of your ability to prove your identity and, eventually, you're going to be paying a subscription fee for it.

In my opinion it's almost a guarantee that Passkeys are going to be used as leverage against users, not to benefit them. The sad thing is that once 99% of oblivious users are fooled, the rest of us are going to get the choice of using them or being shut out of everything.

This is so incredibly wrong that it makes me think you've never actually experienced signing in with a passkey.

Passkeys would eliminate all the text message codes, email codes, and passwords. The flow is literally just: Face ID or Touch ID (or equivalent on Android/Windows), and you're done. It's both a faster/easier user experience than what you're describing and it's way more secure than any of the things you described, because the resulting credential is domain-bound and therefore can't be phished.

You have lost 99.99% of the population.

Personally I like the benefits passkeys offer but some work still needs to be done around management of enrolled devices

If a user's device is compromised, an attacker can also install a keylogger and steal all their passwords, or better yet steal all their cookies/sessions.

Once a device is compromised, it doesn't really matter what type of credential you're using to authenticate/login with.

But also, if device compromise is what it takes to steal a user's credential, then that would be amazing becuse it would mean that the goal posts have been moved dramatically in terms of attacker effort. Today, attackers only have to focus on either hacking/attacking 1 service or spin up a single phishing page, and they can mount attacks targeting hundreds of thousands of users with minimal effort.

If passkeys mean that all of a sudden the attackers need to try to compromise hundreds of thousands of unique endpoints/devices, then the amount of resources and effort they need to expend to compromise the same number of users will be raised astronomically. That's a win.

Maybe more succinctly put, how a credential is initially enrolled, managed and finally removed is an implementation detail which leaves room for funky implementations like the above.

I do agree that it is an improvement over passwords though. Furthermore I guess the same applies to password based logins where everybody just kind of wings it anyway.

That's incorrect. I use passkeys to login automagically with many services, but nothing precludes me from logging in with my (20 character) passwords.

> If you can't authenticate via a primary device that contains your private key, you're f-ed.

That's also incorrect, for multiple reasons — accounts support multiple passkeys, those passkeys are securely sync'd across multiple devices, recovery and backup mechanisms exist, etc.

That is not the world which passkey advocates envision. In the case of those services you mention, passkeys are nothing but convenience; they provide no extra security. In the world passkey advocates envision, passkeys improve security, meaning the removal of password authentication options.

I've already been temporarily locked out by one such service, because a Firefox update made the passkeys I store in Bitwarden inaccessible (Firefox would pop up a macOS Touch ID modal rather than the Bitwarden passkey). That is the world which passkey advocates want, because it "improves security".

They do provide extra security, in that they ensure that you're on the correct domain instead of a phishing site.

Additionally, “the kind of person who's prone to non-targeted phishing attacks” is actually everyone — including infosec professionals spending lots of time on phishing campaigns for red team engagements. You just need to be lucky enough to reach them at the right (emotional, stressful, …) moment. Getting grammar and spelling correct and even potentially even slightly customising each email is made much easier by AI. Knowledgeable users might, however, stop once their passkey doesn’t work and try to understand why.

Okay, you don't have to take the hyperbole so far it's obviously wrong.

They don't want your login to break, and a password vault could also break if you only had a password.

And a world where people only use passwords has the same problem if you can't log in with your password.

Moving from one single point of failure to another isn't great, but it's not a downgrade.

(And just like it's possible to back up a password, it's possible to back up a passkey. And I know passwords can be memorized, but in practice it's bad passwords that get memorized.)

If you specifically want a file you can control you need to use other passkey software, like bitwarden. Which you already mentioned? Huh.

It's a really ineffective gotcha. And extra transparent because you talked about bitwarden first.

I'm not super worried.

Just enroll a second device like a hardware token. Then plug your hardware token into your friend's computer and you can log in to sites on your friend's PC without having to copy over and unlock your entire password safe.

Can you point me to a citation or two where passkeys advocates claim that passwords must go away and/or account recovery mechanisms must be abolished?

• Passkeys stop phishing. Using your passkey instead of a password (when both are available) ensures you're actually signing in to the site/service you expect.

• Passkeys have zero value when leaked. Users' private keys remains secret and safe even when public keys are stolen and distributed.

That said, passwords aren't going extinct anytime soon. It will likely become more popular to require 2FA for password users in the meantime, as it should.

A lot of folks/services/engineers mistakenly think that layering 2FA on top of passwords will help defend against phishing attacks.

But attackers have been phishing 2FA codes since at least 2012 and it's gone from an advanced attack to bog-standard. The only way to defend against phishing attacks in 2024 is to use phishing-resistant credentials like passkeys.

[0] https://news.ycombinator.com/item?id=42443913

Do you use single, easy-to-remember plain-text passwords for all of your accounts and services? If not, you need to understand what the recovery process is when your passkey/2FA/pw-manager is unavailable or lost.

The problem with passkeys isn't the concept, it's the lack of flexibility in implementation.

https://developer.android.com/about/versions/14/features#cre...

https://www.dashlane.com/blog/dashlane-passkey-support-ios#:...

Perhaps passkeys are more viable now with these changes? I'll need to give it another go and see. Thanks for the tip!

I think I've heard that the passkeys providers have an option to force it to be hardware, but I've yet to encounter that, and it would also make me quite cross without a very good reason. I, personally, do not want my accounts tied to any particular bit of hardware, I want it tied to the single (very!) strong password I use for everything.

Edit: Browsing through the rest of this HN conversation it seems the password managers have some PR to do. Many HNers are not aware that password managers, even perhaps the one they are already using, have the ability to store passkeys in them. If HNers don't know, certainly outside of the HN bubble it must be even less well known.

If the functionality is built in, don't be surprised when they alter the deal and force it on you. What are you going to do if no one lets you use or migrate back to a username / password at that point?

We've seen the same thing thousands of times from big tech. They give us a system that's tolerable, but designed to leverage us into a bad position in the future. Once there's a critical mass, they'll flip the switch and we'll all get screwed.

(Also, be sure to understand that being forced to hardware is not "you must use a phone"... it is specifically "this passkey is locked to this Yubikey and can not by any means be moved to any other device". I don't think we're going to be stuck on that. Plus I haven't dug into the protocol but I'm not sure anything stops BitWarden from just claiming to be hardware.)

That said, my eyes are peeled, and at the moment the momentum is in the other direction, in that they actually headed away from that.

It’s a pretty powerful/complex spec allowing various use cases, from a modern way to store SSH keys on hardware credentials to a more usable and less phishable password replacement backed entirely by software.

I think this is because it's so new with these apps. 1password acts really strange with them sometimes and my chrome extension will lock up or not actually push the passkey through or whatever it does. Sometimes I just get annoyed and throw it wherever worked.

When they're flawless they're awesome. I don't mind the quirks right now.

It works ok!

You can use passkeys across devices. I've logged into sites for people using passkeys on other devices several times. I just tap or plug in my device to theirs when it asks for the passkey and it logs in.

If you need to do this, it works the same for a passkey: if it’s a very close friend, you can share the passkey with them. If not, you can use the same login you’re now with the same MFA. Passkeys don’t need 100% adoption to be effective: the big win is blocking phishing attacks and that works as long as you’re not using passwords by default.

The big benefit to a passkey for a service provider is that when you see a user using one, you can assert things about that session—that this is the users device, that the session isn’t likely to be spoofed, etc. These are useful things to know if you want to implement any kind of context-aware access!

Passkeys certainly aren’t a silver bullet, and I don’t think they’re really marketed or implemented well a lot of the time, but I’d caution against writing off the tech as a whole .

Laypersons probably don't see ATOs at scale. I worked at a fintech and it was a relentless uphill battle to protect our users. We saw massive distributed login attempts daily and constantly bought compromised passwords on the gray market to run against our users' accounts. We tried to encourage better password hygiene, 2FA, Fido, etc.

You have to protect users from their own misunderstanding. When it comes to their bank accounts, improper security can be life-changing.

The term "security theater" itself is often thrown around to criticize when it's completely undeserved. Lots of people use it to poke fun at the TSA, but the term totally dismisses the fact that hijackings have plummeted [1,2]. The TSA does its job.

[1] https://www.statista.com/statistics/1240246/aircraft-hijacki...

[2] https://imgur.com/a/xV9ebD9

Your graphic shows 'worldwide' data rather than US data. How would the TSA be involved in reducing hijackings on flights outside of the US? The connection seems spurious at best.

We could just as easily argue that hijackings correlate with other violent crime and the reduction in violent crime worldwide has led to their decline. Or that increased prosperity worldwide mitigates hijackings. There's very little basis to believe that TSA has anything to do with it.

Would you be interested in buying my rock that wards off tigers? Ever since the great Tiger apocalypse where the premier military power in the world went on decades long quest to kill all of the tigers and everyone learned of the dangers of tigers, my rock has been extremely effective at warding off tiger attacks. For just 12 billion dollars a year (adj for inflation annually) (https://www.tsa.gov/news/press/testimony/2024/04/16/fiscal-y...), you could have this extremely effective rock.

edit: I'm pretty sure I clicked reply on GP's comment. Weird.

People do need protected from themselves (that's generally the point of regulation, lobbying aside)

Next up, cloud based passkey proxy services. Store your passkeys there they auth for you after you give them some other damn auth method.

Garbage standard, terrible implementations everywhere, my favorite is when logging in with a passkey they still demand SMS 2FA.

A few years ago when SMS tokens and Authenticator apps where less common, I was able to do work without having my phone on the same room as my computer. Now I need to have it on my desk most of the time for logging in.

For TOTP yes, but AFAIK not for the push-based proprietary authentication systems used by Microsoft/Duo/etc.

This is a solved problem.

a) you can make a phone call b) you can print important travel documents ahead of time c) you can bring a backup device on your travels. I leave a Yubikey with my house keys in the hotel or sleeping accommodations and carry my phone

While I remain on the fence about passkeys, I often see this argument from advocates when things go wrong along the lines of: "why didn't you securely store your backups and keep them with you at all times"

Firstly, it's annoying when a user is already in that situation, it does not help them solve the problem right now.

Secondly, it clearly faces a scalability issue, a significant proportion of passkey users right now tend to be well informed on the authentication model and threats, but when it scales to billions of users many of them will not be well informed and will not think about how to be prepared for when things go wrong, potentially locking them out of everything they would need to fix the situation.

While I appreciate the advantage this model gives, I struggle to imagine it will work well on the unsuspecting public.

Right, that's because there's a 0% chance we end up in a world where everyone who uses the internet reliably carries a Yubikey or similar backup on their person. It's wild to me how many people here are seriously proposing this as a solution. That might work fine for a typical HN poster, but expecting it to scale to the general public is some insane tech bubble myopia.

In reality companies will either provide enough workarounds to negate any security benefits or a whole bunch of people are going to lose access to accounts they own. If passkeys ever get widespread I'm guessing we'll see more of the former option, leading to a lot of unnecessary confusion and very little practical benefit.

The Yubikey is greatly held back from wider adoption because of its stupid name.

You claimed that but didn‘t support it. They may be a bad idea (and I disgree), but how are they „security theater“, which means they are insecure?

Downthread, you claim that Passkeys (if stored in a password manager) are no more secure than a random password stored in that password manager. That seems obviously to be false; Passkeys are phishing-resistant, and stored passwords are not. So that might be where your misconception comes from.

By far the most common phish is "click this link or your account will be shut down" which brings you to a fake Microsoft/Google sign-in page, where they say "please enter your credentials" (or some variant of this). This flavor of phishing is eliminated by passkeys.

Phishing schemes will try to adapt, and some may still be successful. That is why it is not called "phishing-proof".

Ultimately the point of phishing is to attack the user instead of the technology. If the user has any control over access to their account, phishing is largely unaffected.

This would require compromising the website as a whole

I can give a better answer than the sibling:

The passkey is domain bound, so the UI won't show up on the phishing site before the passthrough can even happen.

Password managers are also domain-bound though.

are also --> can be

Often they allow picking an entry for arbitrary domain names, made necessary by firms (such as Microsoft) randomizing their login domains to look like phishing domains.*

* Not what they are doing, but to the casual user, logging into xbox.com, office.com, or even microsoft.com through something like microsoftonline.com may as well be phishing.

... and also eliminated by password managers that use autofill based on the domain name.

In any case, if you have a KBA recovery mechanism, then anyone who would go dig through their saved passwords to put into a phishing site will also just enter the recovery info into a phishing site and enroll an attacker's passkey.

In Sweden no bank has used passwords online.. ever I think? It has always been 2-factor of some kind.

For me it was always some kind of PIN - and then they built their own proprietary second factors which is also a bit insane imo

The important point here is that there is no way for you to have your browser sign an arbitrary (e.g. an attacker's) challenge, since you can't input the challenge at all.

This makes WebAuthN strictly better than static passwords, TOTPs (which are "unidirectional" in nature), and even "enter code 123456 into your authentication device and provide the code it displays"-like flows (which is a bidirectional challenge-response, but a MITMable one).

But also, in the end the attacker site isn't really getting anything that would let them then turn around and authorize as you.

Think of it like SSH keys. A public key and a private key. The site holds the public key, you have the private key. When you create a new passkey with the new site, they're holding your public key. They can't go turn around and start logging into to other places with your public key, they can't sign the challenges. So if you make a passkey for bank.com and an attacker at baank.com had you enroll a key there, they can't take the public key at baank.com and use it anywhere to act as you. They only have a public key, and one tied to baank.com at that.

In the end you never actually transmit your actual credential even in the original setup. You're just signing things, the private key stays on your device. And its a different key for every service.

That's why they are so much more secure than passwords and even TOTP or "click approve to authenticate" flows!

Statistics are hard. People have a bad habit of seeing 'not 100% fullproof' and thinking that said something is therefore worthless. Same senseless argument people made in the 80s against wearing seatbelts, and 4 years ago thinking it was a legitimate argument against wearing masks in the middle of a pandemic.

passkeys imho are being pushed because:

1) a lot of people will not use a (good) password manager

2) it allows more lock-in for the providers (ios/android/1password/etc.)

They don't

> have less lock-in

I have physical security tokens from multiple vendors which support passkeys. I have Windows machines with passkeys. I have Android devices with passkeys. Tell me again how it is a vendor lock-in? I'm not seeing it.

(You should use a Google account as your primary online identity, unless you have religious reasons not to. Back up your authenticators, set up back up accounts, all that stuff; Google doesn't want you locked out any more than you do, because that requires them to attempt customer service, so they have a bunch of tools here.)

People that by into systems they don't control are shooting themselves in the foot because, when push comes to shove, a for-profit company will always chose profit over individually choice. It's short sighted to think otherwise.

Either way: Passkeys themselves don't require you to use Google, or any particular big tech firm. It's an open protocol.

https://news.ycombinator.com/item?id=32538805

This was more than two years ago. Despite the title, many parents are victims to this. To this very day, Google continues to defame them and deny access to their accounts. Long after the police cleared these victims' names. Long after the NYT confronted Google about this.

So is this what "normies" should be subject to? A digital totalitarian hellscape in which a trillion dollar advertising giant rummages through people's digital lives, randomly takes away their entire digital identity every time their flawed cyber-oracle tells them to, and uses their vast corporate resources to harass and defame?

That's not a world I want to live in. I don't want anyone to be subject to that kind of tyranny. It's not about any "religious belief," but rather basic human decency.

Your whole argument is a misunderstanding of how they work.

> Yeah that's great, I don't subscribe to that particular religion but respect your beliefs. I think most people are best served having their primary online identity be a Google account, for multiple reasons. I'm aware that a vocal contingent of technologists on HN find that take appalling, but I assure you, my take is a normie take, and also the modal take among security people.

Also, Richard Stallman? Where did that come from? This has nothing to do with free software at all. I'm also capable of drawing my own conclusions without someone else whispering in my ear, if that's what you're suggesting.

It's not honest discussion.

I don't have any control how any site I didn't build actually handles my password.

And the real independent implementations like bitwarden are often blocked by sites like PayPal does.

Often repeated. Doesn't make it true. As mentioned, I've got passkeys for services registered on multiple brands of physical authenticators and several platforms.

Other implementations are often blocked, eg on paypal I've never been able to do it and they also only allow one.

The big tech ones don't have these issues but I won't use them because I want to keep control.

About the only site I've come across that still only limits a single authenticator is the only one you've already mentioned. If I pointed out a site that only allowed five character upper case passwords with no lockout policy and really fast responses is that also proof passwords are completely untenable? Or just one actor with poor policy decisions And in the end one can just choose to not use passkeys with sites like PayPal. But the extreme majority I've used allowed multiple, as that's what the specifications recommended.

In the end you can use passkeys without involving Google or Microsoft or Apple at all. Any argument that passkeys lock you into their platforms isn't based in reality and are repeating untruths. You don't need to use them to use passkeys.

https://aws.amazon.com/blogs/security/you-can-now-assign-mul...

It's entirely possible that many sites shared this flaw.

Adoption is really slow. But yeah ok, if multiple are allowed then yes it's no longer a problem. I'm sure I read of more sites that had this problem but it is indeed possible they're fixed now.

You'd really have to be a state actor to be able to generate a phishing site on the original url with a valid certificate as well.

What’s the best resource in your opinion for learning enough about passkeys for a lay person to make informed decisions on them?

https://securitycryptographywhatever.com/2022/08/11/passkeys...

(I'm not being totally serious).

Fingerprints can be lifted from photos where your hand is in frame. And no, you can't change fingerprints after they are compromised.

Or used with your own fingers while you have been drugged or you passed out being drunk.

Reducing your attack surface to the people who can/are willing to gain physical access to your device to use a passkey is orders of magnitude smaller than a password that can be taken and used from anywhere in the world, without having to get up from their computer.

If someone really wanted to gain access to something of yours, they could take you and your family hostage and force you, but that is an incredibly small attack surface. "What we have accomplished" is shrinking the attack surface, not perfect security.

Angela Merkel and Ursula von der Leyen are examples of this, fingerprints and iris scans lifted from mere photos.

In some countries even it is mandatory to store the fingerprints and photo from citizens, or at airports, what makes biometrics almost public.

Besides having all the logins under a single pin on a device that can be lost or stolen sounds just as bad, soon the people will be aimed to store them online to avoid it (trick-or-treat).

In any case, nobody is stopping you from using a password-secured implementation! I do that myself on some of my devices.

If you can explain how, in a phishing resistant way, passkeys can grant access to a user’s account in the absence of any devices they own, I’d like to hear it.

You can never make this mistake with a passkey or FIDO authenticator.

If you mean the password manager password, then it is entered in a different place and really hard to confuse it with a website. Also, 1Password requires extra info to login account and that is only used, usually copying from another device, when setting up device.

Oh no, you have its PIN! Can you now log in to $service as me?

Not without that hardware module.

My password for $service is hunter42.

Now you can log in as me.

See the difference?

Is it fine if a waive my hands around and say "complexity"?

Normal users aren't going to keep a backup device, let alone keep track of which accounts are associated with which devices they own. Normal users need something in a portable format that can be backed up. Anything that can be backed up can be stolen and anything that can be stolen shouldn't be used for single factor auth like Passkeys are promising.

Thankfully I was logged in on a PC and was able to get past it.

The main downside to passkeys currently is that I cannot be my own service provider. Having that I don't see a big downside.

Or, maybe they won't. Are Google and other free-as-in-facebook services going to suddenly open customer service departments?

I got permanently locked out of Facebook because during a phone OS update, the 2FA app somehow lost my Facebook information. I can't log in to Facebook because the 2FA app can't authorize it. I can't add my Facebook account to the 2FA app without first logging in to Facebook. I've sent my photo ID to Facebook a number of times, but it just goes into a black hole and I never get a response.

On the plus side, I have a lot more time to do meaningful things, and not scrolling my life away like a drug addict.

Specifically, recovery keys are designed to be so long and complex that no human could possibly memorize them, ensuring that they’re written down / printed instead of memorized — thus making them a “something you have” credential rather than a “something you know” credential.

Passkeys are highly secure compared to passwords. All problems I know of (and there are quite a few!) revolve around availability, not security.

All problems you do write about after this are indeed related to availability, but then you shouldn't call them "security theater".

Basically almost every single auth method is flawed by that because it gives way to social engineering attacks. Also once your email is taken over everything else is.