Submitted 5 weeks ago by AnActOfCreation@programming.dev to technology@lemmy.world
https://proton.me/blog/big-tech-passkey
Not surprised,
Google too nowadays.
There’s a reason why they removed their company motto “Don’t be Evil”
Google has obviously been crap for a long time, but that was just a dumb motto to begin with. It’s not aspirational, it’s not useful for anything and it barely requires anything of anyone.
They changed it to: Do the right thing.
It’s not much better, they’re still an awful company, as most companies are, but this is just the worst reason to rag on them.
I thought they just removed the first word.
Better yet: use a hardware 2FA token
I am not using passkeys until it’s possible to easily migrate them between providers (not just devices / browsers). If I used Proton Pass, and then later decided to use another password manager, could I export my passkey data?
We’ve also given passkeys and passwords equal priority so that you can use them interchangeably in our apps. This means you can store, share, and export passkeys just like you can with passwords.
That’s excellent. Thanks for pointing that out!
Proton Pass allow you to export your passwords in various formats (both plain and encrypted). That you are able to import somewhere else is not something Proton Pass can guarantee but you have your data.
The way Apple or companies like Paypal implement two-factor authentication, let alone passkeys, drive me up the wall. This all could have been so much better.
I’m not even going to mention all the platforms that rolled out passkey creation support, but not passkey login support, for whichever damn reason
Yeah, Apple 2FA is infuriating, especially since you can do all factors from the same device. Kind of defeats the purpose of traditional 2FA/MFA. Also, companies that decide you 2FA experience has to use their app, instead of a standards-compliant TOTP app of your choosing…ugh.
Traditional 2FA (assuming you mean apps with codes) can be done from the same device (if you have the app with the codes installed on that device).
It doesn’t defeat the purpose of 2FA. The 2 factors are 1. The password and 2. You are in possession of a device with the 2FA codes. The website doesn’t know about the device until you enter the code.
If you think forcing everyone to carry an object other than their phone around so they can use 2factor with it when they already have their phone so they can use it for 2factor with other things you are delusional. Or if you said I need to go to my laptop when I’m logging in on my phone and vise versa… that’s nonsense too.
Authy on my phone is just as “dumb” as Keychain on my phone.
How else are you imagining this should work that you could get normal people to do?
The factors are:
Here the password is something you know and the device is something you have (typically also protected by something you are, like your fingerprint or face)
PayPal for sure, because at one point they actually removed the ability to use a hardware mfa token.
A little known fact about iCloud is that you can use hardware MFA tokens. I think this feature was just recently released though. They force you to enroll at leas two tokens too, which is a nice safety. I set this up about a month ago and it’s been great.
It seems no matter what new advancements we make in technology the big tech companies seek nothing more to implement it in a way that benefits themselves. Regardless if it means fucking over the consumer.
I really hate what the internet has become over the last couple of years.
That’s capitalism for you. They’re not interested in making things better, they’re interested in making more profit.
Correct. But often that only happens if they make things better for you.
When vaultwarden supports this I’ll play ball. If I don’t have control over my authentication methods, then they aren’t my authentication methods.
Do you really think it’s a good idea to store your password, TOTP and security key in one place?
Yes, as long as that place is only accessible by a physical passkey (such as a Yubikey). The risk is miniscule and the convenience is 100% worth it.
To my bank? No. To a Lemmy account? Yep.
Vaultwarden has supported pass keys for a while. The client app does all the hard work in this pattern.
Bitwarden does, not sure about the self-hosted version.
Proton Pass offers passkeys that are universal, easy to use, and available to everyone for improved online security and privacy.
I wonder if there could be any bias in Proton claiming their product is the best
Well of course. It’s still right - the ecosystem lock-in is insane. There needs to be a standard for cloud to cloud transfer between providers.
Or you know, use Proton Pass or 1Password.
I’d trust them miles before Google or Apple. Hell, they dropped the prices on some of their products when they found ways to provide them cheaper. Proton is a good company.
That doesn’t mean they will be around forever. Economic realities care little about whether a company is good or not.
Lock downs are pretty much a hard pass for me. Anything I buy, I research, and if there’s even the slightest hint of BS incompatibility, it’s simply a no go.
I noticed that recently every post on Proton’s blog has been an advertisement of their services.
They are hypocrites.
A few days ago they posted that corporations are bad because it collect fingerprints, profile users, etc., yet they are no better, as their mobile apps rely on Firebase Cloud Messaging (FCM) owned by Google to deliver notifications to their users.
In 2020 they wrote that they were working on an alternative method of delivering notifications, but apparently shitting on corporations is easier than making actual changes.
That’s a google services issue. That’s Google’s fault.
It was their choice to not exclude this knowingly-evil service from their applications though.
Yeah I’ve avoided passkeys. Anything that Google is pushing to me is always in their interests.
Google pushed email accounts to you, do you not have an email address either?
A lot of my hesitation is that not only are passkeys being pushed by the big vendors AND they seem to have a less than portable implementation BUT ALSO they don’t seem to give enough details. Everything is dumbed down for the less technical until it means nothing
I like that this thread already has more actual information than all the outreach of the big vendors over months
People not getting phished is in their interests. That doesn’t mean it’s not in yours.
I’m well versed in IT security, and even with (or because of) my knowledge, I still haven’t looked deep into setting up passkeys on my services. Just because it’s such a clusterfuck of weird implementations.
And I’m managing at least one service at work that could totally benefit from passkey integration. The headache of looking into how to properly implement them is just way too much
I can’t imagine being a normal consumer and wanting to set them up.
It’s quite simple on iOS. IIRC, when logging into the paypal website you get a prompt asking if you’d like to use passkeys. Accept that, then you get a keychain prompt asking if you’d like to make/use a passkey. Click continue and pass FaceID authentication, then you’re in with a passkey. For future logins you click the login with passkey and it faceIDs you in. It’s easy.
Then you are totally locked in with Apple devices and cannot switch to Android and take your passkeys with you
told ya so, i got downvoted for being skeptical of this shit.
if google or similar is pushing it, is should NOT be trusted!
You still deserve those downvotes. There’s nothing to not trust about passkeys.
nah, give me an alternative not controlled by us oligarchs and i will consider it.
The billionaire owner class are defacto untrustworthy.
Could someone ELI5 (if possible) what passkeys actually are?
Not ELI5 level but…
If you understand SSH keys, it’s basically that there’s a private key and a public key.
Whatever website has a copy of the public key, they encrypt something with the public key, you decrypt it, reencrypt it and send it back (where they can then decrypt it). By performing that round trip, you’ve verified you have the correct key, and the “door opens.”
I guess it’s a bit like a bank card with a PIN. You go to pay for something and your card stores your credentials on it. To allow those credentials to be read you need to unlock them using the PIN.
I’m very excited for the concept of passkeys, but indeed it is a bit of a mess right now. Android password managers can’t use passkey inside other apps, basically limited to just the browser. I hope it all gets sorted soon and everyone sticks to an open standard compatibility.
I want to be able to export my passkeys and take them with me to any other chosen implementation.
I have hopes for a normal implementation because KeepassXC does have passkeys now.
The idea of a passkey is that it is a security certificate that permanently bound to the software/hardware and can’t be exfiltrated, in the same fashion you’d make one SSH private key per device connecting to a server, never leaving the computer it was generated from.
You don’t backup your Passkeys, you associate multiple passkeys per account (ie: ProtonPass, Bitwarden, Yubikeys) as a contingency.
If you can back it up, it can be stolen.
Same; I hope the EU does something before it’s a total mess
Jokes on them: If they allowed passkeys on iOS 16 or have let the iPhone X update to iOS 17, I most likely fell for it, now I have only some 2FA keys that I need to pull from keychain (have no macOS)
phoneymouse@lemmy.world 5 weeks ago
Not commenting on the merits of the blogpost, but Proton is selling their own product here too
StereoTrespasser@lemmy.world 5 weeks ago
Translation: don’t give those other guys money, give us your money!
yamanii@lemmy.world 5 weeks ago
The horrors of giving money to a company that actually cares instead.
EncryptKeeper@lemmy.world 5 weeks ago
Well no, their call to action isn’t to not give anyone else money. They didn’t have anything negative to say about their competition like 1Password. They’re just warning you about the shady things Google and Apple are doing specifically. And as an alternative they’re offering their own solution instead, which also doesn’t cost any money.
EncryptKeeper@lemmy.world 5 weeks ago
Proton enabled passkeys in their free tier. So ultimately, yes by using their free tier and being safe in the thought that you can always leave if you want, that might drive you to pay for a paid plan.
But companies trying to earn your business by offering you a good honest product is not at all the same as a company using anti-consumer practices to keep you from leaving lol.
asdfasdfasdf@lemmy.world 5 weeks ago
sit_up_straight@lemmy.blahaj.zone 5 weeks ago