Ricky Mondello (@rmondello@hachyderm.io)
hachyderm.io
If you actually read the “Passkeys are a trap. Do not use them.” post going around, you’ll find a transparent attempt to clumsily string together a conspiracy. The post is predicated on the idea that a feature of WebAuthn called “attestation”, which is only used in high-assurance and usually corporate scenarios, and usually with physical hardware security keys, will be leveraged to hurt people, somehow. The post posits that a website like X will bait and switch users: first, you get a passkey. Then, later, scary “attested” passkeys! This simply isn’t possible to do because attestation isn’t supported on the web for mass market, consumer authentication. Attestation for passkeys (software-based, syncable credentials) is antithetical to their mass market goals, and would freeze out independent, non-corporate-backed credential managers. It’s an explicit non-goal of the designers of passkeys, who work together in a forum anyone can join. And trust me, websites and apps like banks repeatedly asked for attestation at the beginning of the industry’s passkey journey. The platforms, browsers, and credential management apps have held firm that the goal of passkeys is reducing phishing and **not** some kind of trusted computing scheme. (And I will note: over my dead body!) Besides the theory of the case being fundamentally wrong, there are several things that make the post disqualifying in terms of arguing something useful or important in the realm of security, privacy, and user authentication: 1. Intentionally presenting things that are complicated as inherently suspicious. (Delivering security by design can be complicated, yes!) 2. Describing TOTP as a “great solution” for adding security to a password-based account. When the most common threat model on the web is phishing (a word the post never mentions!), TOTP hardly buys you _anything_. TOTP is phishable. 3. Seeming to be unbothered by how many logical leaps are being taken without actually understanding the topic being discussed. There are bad things happening in tech and untrustworthy people and companies do exist, but they’re largely in the AI space, not the “let’s stop people we love from getting compromised through phishing” space.
  • magguzu@lemmy.pt
    92·
    7 hours ago

    Honestly the original post arguing against them makes very valid points that I wasn’t expecting to read to the end, even if they probably lost 90%+ of readers with the length that could have been cut down.

    Speaking as a GrapheneOS and Linux user, the possibility of remote attestation to stop me from doing so is a legitimately shitty thought.

    Been quite a fan of the convenience though as I just hate having to keep my phone on me all the time. So I’m torn, but will continue using them at least until a whiff of big tech buffoonery comes around.

    Edit: Ricky’s arguments seem sound but I think you can also tack on “for now” to all of them. They also work for Apple so worth mentioning that potential conflict of interest/bias. I’d be curious of GrapheneOS’s take.

    • IanTwenty@piefed.socialEnglish
      4·
      1 hour ago

      I agree 100%, this post is not a full rebuttal and does not tackle the concerns directly:

      • The character of the organisations in FIDO does not inspire confidence against lock-in or monopolistic behaviour
      • The possibility of future attestation cutting out those on ‘unapproved’ software and hardware.

      I agree parts of the tech are good, particularly the anti-phishing, anti-replay measures.

      This post seems to say passkeys are in good hands so nothing can go wrong, but I don’t think that’s enough.

  • Zoutpeper@lemmy.worldEnglish
    72·
    7 hours ago

    Not a single explanation of passkeys has managed to to convince me they are more secure than a password and MFA. All you need is access to someones phone. Before you needed a complex password and access to my phone.

    The passkey also can’t be backed up or replaced like MFA tied to my phone if it should unexpectedly die.

    Congrats we’ve reduced account access to a single point of failure?

  • Kajika@lemmy.mlEnglish
    225·
    12 hours ago

    Passkey is barely implemented, seriously we have GPG keys or ssh keys and big tech refuses to implement at least that. Instead they are pushing for their Product™ to sell.

    Hardware solution could be nice but the market is stacked against any nice solution: I way a key I can backup, even emulate if I want too (having a purely digital copy). I don’t see the issue with ssh key in general.

  • pulsewidth@lemmy.world
    91·
    11 hours ago

    I swear most people have forgotten what TOTP was used for in the first place - two-factor auth to protect people re-using passwords getting hit by password breaches on other services, people using low complexity passwords, and to protect people’s breeched devices (e.g. computers getting viruses or malware or drive-by credential nabbers that give the attacker access to your credentials in some way). In short, to solve some poor security practices. 2FA via TOPT still solves all of those problems.

    Passkeys fix a different problem. On their own as a technology they essentially just increase the quality of a password, while tying that password to a single device. So they fix the problems of re-used passwords, and unsophisticated passwords. But with many implementations they fall back to being single-factor auth - if a user has access to your device, they can use the passkey (with exceptions such as passkeys stored on a physical second-factor like a Yubikey that requires physical approval to use).

    TOTP meanwhile requires two devices to be accessed by design.

    As myself and most tech-aware users already use unique, sophisticated passwords - they don’t solve a problem for us.

    However, if businesses allow passkeys as a simple password alternative, while still allowing TOTP as a second factor, I’d be happy to do so for critical access items (mostly banking). However, I’m not aware of this being the case for any common implementations in major businesses.

    Passkeys are just ‘Yubikey without the Yubikey or physical approval’ - pointless to me. False sense of security even.

    • IanTwenty@piefed.socialEnglish
      1·
      2 hours ago

      Maybe one extra thing you are missing is passkeys are resistant (not proof) to phishing. The user returns an ‘assertion’ that:

      uses the private key to digitally sign a challenge value from the server, together with contextual information such as the requesting origin

      https://developer.mozilla.org/en-US/docs/Web/Security/Authentication/Passkeys

      It useless to pretend to be the bank as you’ll get an assertion from the user you can’t replay and the user’s passkey implementation should spot the origin is wrong and refuse to sign it anyway (as I understand it).

    • Ooops@feddit.org
      41·
      8 hours ago

      Passkeys fix a different problem.

      In my eyes the problem is that passkeys do not fix a problem. They just shift it to another layer…

      I can backup a password however I like. I can backup a TOTP authenticator (or specifically the secret that works with every one of them) however I like.
      I can not however backup a hardware device with my passkey.

      And the websites supporting passkeys obviously know it and explicitly warn when you don’t have an alternative way of logging in configured as it’s possible that simple hardware damage or loss locks you out of your account. Thus the “fix for a problem” is now relegated to a shiny new way of conveniently pressing the button on a key instead of typing and remembering passwords, while the actual attack surface is still there but now sitting in alternative login/account recovery instead.

        • Ooops@feddit.org
          2·
          3 hours ago

          Yes I can backup a software one. But that’s not the point. Passkeys are advertised as the future for common people as they eliminate the biggest issues: phishing.

          But then they don’t advise people to use software passkeys, back them up and keep them save. Instead they tell them to configure an alternative/recovery login alongside the passkey should it be lost or damaged.

          They take a security feature, instantly remove the additional security and make it into a “you don’t need to remember and type your password”-convenience thing. Yeah, great. A password manager could’ve already provided that convenience.

          So in the end those more technically-minded that will look at this and decide to use a software passkey so they can back it up will get some additional security they need much less (they are not the primary target group for phishing), and some convenience they already had (because they are already using a password manager).

          Passkeys aren’t controversial because they are bad. They aren’t. They are controversial because the actual way they are used makes zero sense for the purpose of added security. Which raises the question what the actual goal is.

    • my_hat_stinks@programming.dev
      33·
      14 hours ago

      If you’re asking that question you’re probably already at lower risk. Just think of scammers calling up your grandparents or something like that; they pretend to be Microsoft, ask for the user’s credentials, attempt to sign in, then ask for the user’s one time passcode. You can get more elaborate setups but that’s the gist.

    • flamingo_pinyata@sopuli.xyz
      10·
      14 hours ago

      Fairly easily if you create a good replica of the original website the user is trying to log in to.
      In a lot of cases, even technically savvy people are not going to verify the URL.

      • artyom@piefed.socialEnglish
        2·
        14 hours ago

        I see. I use a password manager so it would probably not fill in the password or the TOTP and throw a red flag for me.

        • IanTwenty@piefed.socialEnglish
          1·
          2 hours ago

          The phishing attack could also try to convince you your bank had changed domains (hey we’ve been bought by Big Bank and will be moving your account to BigBank.com) and therefore not to expect your password manager to autofill (this is a stretch I know).

          Passkeys are resistant to phishing as they cannot be replayed and your authenticator should refuse challenges from the wrong domain. Even if it did solve a challenge from bigbank.com it’s worthless as the origin is included in the returned challenge so cannot be used by the attackers on the real bank site.

        • libewa@feddit.orgOP
          5·
          14 hours ago

          That wouldn’t work with the iOS passwords app, since Autofill breaks all the time…

    • tuhriel@discuss.tchncs.de
      7·
      14 hours ago

      Call them, say you are the bank and they have seen fraudulent transactions, and to restore the account they will send you a code which you have to tell them…

      For the sms codes: it’s also pretty easy to copy/clone a sim

      There is also the option of a MITM attack with a portal that forwards the login to the real login page and then cuts your connection and the MITM has the open session.

      The good thing with passkeys is, there is nothing a fraudster can get from a user. You can’t forward your passkey via the phone, and MITM are much, much harder to pull off

      • artyom@piefed.socialEnglish
        3·
        14 hours ago

        I was more referring to “authenticator” style codes. I dunno what else to call them. But you answered that as well.