Comment

Comment on Passkeys Explained: The End of Passwords

Why do you have the 4-digit PIN? Well, it’s just to unlock the part of your device where the private key is stored.

And there is the problem I have with passkeys. With a password it is me authenticating to the service I’m using. Pretty straight forward (if you ignore the operating system, web browser, network protocols, etc., but that’s part of using the tech).

With passkeys you’ve got this third party storing your keys that increases your attack surface. It could be your web browser, your OS, or some cloud provider that you’re now relying on to keep your data safe. I get that for people whose password is “password123” or who aren’t savvy enough to avoid phishing maybe this helps. But with decent opsec this overly complicates authentication, IMO.

To my point, later in the article:

Securing your cloud account with strong 2FA and activating biometrics is crucial.

What’s that now? The weak point is the user’s ability to implement MFA and biometrics? The same users who couldn’t be bothered to create different passwords for different sites? You see how we’ve just inserted another layer into the authentication process without solving for the major weakness?

With my tinfoil hat on I suspect this push toward passkeys is just another corporate data and/or money grab – snake oil for companies to get their tentacles tighter around your digital existence.

Happy to be proven wrong.

source

Sort:hotnew top

needanke@feddit.org ⁨4⁩ ⁨months⁩ ago
How do you currently store your passwords? I would also consider that a third party with an adittional atack surface if you are considering the passkey location one.

Also your argument

(if you ignore the operating system, web browser, network protocols, etc., but that’s part of using the tech). is faulty. That is because passkeys exist in part to mitigate those atack vectors. Mitm, a compromised browser or client, etc. is less of an issue with passkeys. The information transmitted during an authentication can not be reused on another authentication attempt.

I don’t agree on passkeys complicating things either. For me the authentication-flow is not more complicated then KeePasses autofill.

Assuming one can be ‘tech savy’ enough to not fall for fishing is bad. There are quite advanced attacks or you might even just be tired one day and do something stupid by accident.

What’s that now? The weak point is the user’s ability to implement MFA and biometrics? The same users who couldn’t be bothered to create different passwords for different sites?

You don’t expext the user to ‘implement’ mfa or biometrics. You expect them to use it. And most places where a novice would store passkeys don’t just expect but enforce it. It is also way simpler to set up biometrics on one device compared to keeping with a good password strategy.

source
sentientRant@lemmy.world ⁨4⁩ ⁨months⁩ ago
Today we use lots of accounts with unique passwords. Obviously these passwords have to be stored somewhere. So I disagree with you when you say it’s a unique passkey thing.

Passkey has an advantage when it comes to phishing because it doesn’t totally rely on human intelligence or state of mind.

From a personal experience my data was leaked online, not because of phishing or I was careless. but it was leaked from a well known third party site which I used. They were affected by a very serious breach. Many unlike me use the same passwords for their emails and stuffs. But in case of passkeys there isn’t a shared secret. A breach will be useless.

source
- laranis@lemmy.zip ⁨4⁩ ⁨months⁩ ago
  I think you’re making my point. First, you’re right that passkeys can’t be phished. But access to the passkey manager can be. And now you’ve doubled your exposure to leaky third parties, once with the service you’re accessing and another with the passkey manager.
  
  source
  - sentientRant@lemmy.world ⁨4⁩ ⁨months⁩ ago
    But the third parties actually have no access to your passkeys. The passkey stored are end to end encrypted blobs. So even if anyone gets hold of it, its useless. But a password for instance when leaked from 3rd party can be used easily as the server will have to decrypt the password at one point. So the means to decrypt the password will be at the server but passkeys aren’t like that. The private passkey can be decrypted only on your device for signing the challenge. Basically your exposure was basically halved.
    
    source
Evotech@lemmy.world ⁨4⁩ ⁨months⁩ ago
Passkeys can’t be phished…

That’s the main point.

source