Missed opportunity for "What the eff is a Passkey?"
Technology
This is the official technology community of Lemmy.ml for all news related to creation and use of technology, and to facilitate civil, meaningful discussion around it.
Ask in DM before posting product reviews or ads. All such posts otherwise are subject to removal.
Rules:
1: All Lemmy rules apply
2: Do not post low effort posts
3: NEVER post naziped*gore stuff
4: Always post article URLs or their archived version URLs as sources, NOT screenshots. Help the blind users.
5: personal rants of Big Tech CEOs like Elon Musk are unwelcome (does not include posts about their companies affecting wide range of people)
6: no advertisement posts unless verified as legitimate and non-exploitative/non-consumerist
7: crypto related posts, unless essential, are disallowed
That is truly amazing. (Golf clap)
Thank you. That was the very first thing I thought.
You’re still entering the password or pin for your password manager. I genuinely do not see how this is better. It’s simply an alternative, not an improvement.
-
Password managers are, generally speaking, far more security conscious than the average website. I'd rather send a password to my password manager a couple times a day than send passwords to every website I interact with.
-
One click to confirm vs. 2-3 to autofill. Tiny gains in speed 🤷♀️ If you make a password manager even slightly more convenient than just using
gregspassword123
for everything, you can onboard more normies.
Most people that have password managers are already using different passwords for each website. Usually randomly generated. What's the difference between that and a passkey?
The secret key pair of a passkey is never transmitted over the internet. Even if somebody snoops the authentication, they will not be able to reproduce the secret key to login in the future.
Think of it just like SSH public and private keys.
Normal passwords, are typically provided at login time, and get transmitted, relying on HTTPS to keep them secure, if somebody could observe the authentication, they could reproduce the password later.
(Yes someone could hash the password client side and send over the output... But that's extra work and not guaranteed)
Client side hashing of a password just makes the hashed result the password, as far as security is concerned.
Unless there is some back-and-forth with the server providing a one-time-use salt or something to make each submission of the password unique and only valid once, at which point that might get snooped as well.
Better off relying on client certificates if you are that concerned
Ah, thanks for that explanation. That makes sense. Eliminates a possible attack vector with https
A pass key is the private key in a private/public key pair. The private key is stored in the TPM on your device. The website contains the public key. When you use your "one password" you're in effect giving your device permission to access the key storage in your TPM to fetch the private key to present it to the site.
What this means in practice is that if a website has a data breach they won't have your hashed password, only your public key which... is public. It doesn't and can't do anything on its own. It needs the private key, which again only you have and the website doesn't store, to do anything at all.
If you want to read more about it look into cryptographic key pairs. Pretty neat how they work.
Right. Most people that have password managers. Making a password manager easier and more convenient to use means some portion of people who aren't using one may start.
You're entering your password into your password manager, which is stored by a company or entity whose entire job is to keep it secure. You're not giving your password, in any form, to the website or service you're accessing. When the website gets compromised, your hashed password is not in a database waiting to be cracked. All the attacker gets is a public key they can't use for anything.
The biggest difference: nothing sensitive is stored on the server. No passwords, no password hashes, just a public key. No amount of brute forcing, dictionary attacks or rainbow tables can help an attacker log in with a public key.
"But what about phising? If the attacker has the public key, they can pretend to be the actual site and trick the user into logging in." Only if they also manage to use the same domain name. Like a password manager, passkeys are stored for a specific domain name. If the domain doesn't match, the passkey won't be found.
https://www.youtube.com/watch?v=qNy_Q9fth-4 gives a pretty good introduction on them.
Here is an alternative Piped link(s):
https://www.piped.video/watch?v=qNy_Q9fth-4
Piped is a privacy-respecting open-source alternative frontend to YouTube.
I'm open-source; check me out at GitHub.
If you're using a hardware token like a YubiKey then you do need to enter your PIN before being able to use it.
The main benefit is that you cannot extract the Passkey from the secure element (the token cannot be transformed from what you have to what you know) and it cannot be phished through a fake domain as the challenge-response will not match.
And all of my tech challenged family screamed out in unison, “What’s the fucking 1Password password again?!”
Wife: I don't remember my {service} password.
Me: Did you put it in {password manager}? We have a family plan.
Wife: groans I never remember it. What's the password?
Me: How would I know? It's your password.
Wife: ruffles through desk, picks up tattered handwritten note. Aha! Here's the {service} password. Same as {30 other sites}.
Me: slowly bangs head on table
[ Repeat once a month]
Sounds like you need to get the latest patch for your wife. While you're doing that, you can add the password manager extension which should fix the issue.
Put your wife's password in your password manager genius
Also write that password down somewhere in case you pass away in an accident or whatever. If you can afford it, a safety deposit box is great just because it can't get lost but is also wayyyyyy overkill.
https://github.com/cyphar/paperback
Here's a cool project that makes writing down your secrets a little less risky. You can split the secret up into multiple parts that require collusion to decrypt. This is an excellent project that makes it pretty easy and straightforward.
So keep one copy at home, one copy of the neighbors, one copy at a relatives, well maybe at the bank if you have one. Then when you're significant other forgets their password, you can figure it out
Because you don't send a secret value, you only send a cryptographic asymmetric single use value which is safe to disclose
Someone on slashdot correctly pointed out that these are only single factor on the server end. You enter a pin to unlock the device, the server can check if the device says you unlocked it, but there is no sending a second factor to the server. If a device was hacked to get the keys, or just says to the server that you presented a pin but didn’t really, the server has no clue. Passkey + TOTP would be multi factor on the server side.
TOTP generated on the same device as the passkey is not a secondary factor. It will have been compromised together with the passkey.
For passkeys, the secondary factors are used to access the passkey vault, not auth to the server. And these secondary factors should be a master password, biometrics, or physical keys. TOTP and SMS are out.
I can see the "phone falls into the toilet" as a big problem that people will have.
Use a password manager that implements passkey like Bitwarden that syncs up to a server. Or you can host your own Bitwarden sync server with Vaultwarden if you don't like the thought of a cloud sync.
It's already a huge problem now. Lots of people only have one auth device they depend on for everything. At least passkeys come with standards which should help spread the use of vault sync and backups and hopefully those practices become the norm.
They mention it in here. I don’t know about Android, Apple synchronizes them between devices. The way they do it seems pretty secure but it is still less secure than the keys being untouchable. Using multiple will be a necessity.
Yubikey ftw