Take your passkey and shove it where the sun don't shine

Passkeys are a great idea, but everyone involved seems like they want the process to be as much of a pain in the dick as possible. So until the industry pulls it's collective head out of its collective ass (not going to hold my breath on that one), it'll be passwords+2FA for me.

I hate 2fa so much, I never thought they would come up with anything more irritating. Little did I know.
- I really like 2FA as long as it's TOTP and I can use an offline app or program for it. It just works and is very easy and secure.
Jesus Christ, dude, that is exactly it.
We're trying to implement passkeys at work and the testing has been an absolute nightmare. Literally have no control over the onboarding experience because each tech giant is clamoring over each other, interjecting into the process to be the "home" for your passkeys. It's bananas.
When it's all set up, it's kinda great! But getting set up in the first place is an exercise in frustration.
- It's a chance for them to lock you (normies) into their platform forever. They're not going to give that up.
- Silly.
  Are they learning?
  Edit: my bet is the experience was so ridiculously frustrating, Chrome/Google actually saw some attrition - maybe enough people made Yahoo! Mail accounts that Google noticed

The amount of people in this thread that don't understand passkeys surprises me. This is Lemmy. Aren't we the technical Linux nerds of the Internet?

2FA is just dead simple. I contact you, you contact me, handshake achieved. If you call me out of the blue I raise the alarm. If you get a login attempt with a failed handshake you raise the alarm.
Putting it all behind a pop up screen just isn't trustworthy to the human brain.
- SMS 2FA is notoriously compromised by various means.
- TOTP 2FA is less secure than passkeys. 2FA TOTP keys can be phished. Passkey authentication cannot be phished. This is a security improvement which can make people completely immune to phishing attacks. That's huge. And it doesn't have any privacy risks, no loss of anonymity. It's an open standard.
  This is, objectively, a rare example of new technology which will make the world better and safer for us.
You understand that technical people often are the least likely to trust new technology and are often stuck in the mud when it comes to technology? Doubly so if you are anti-corporation. It seems anything that isn't the Unix way of doing things can be questioned.
There is a good meme about people who love technology vs people who actually work with the stuff. The former using IoT devices to turn their lights on while the latter uses a light switch and has a gun in case the printer starts making weird noises.
- Good point, and I love that meme.
- It seems anything that isn’t the Unix way of doing things can be questioned.
  I think Unix is the thing that indirectly gets questioned most often, because everyone wants to be on the "right" side of how to unix things (see latest rust in kernel for a very recent example). When I think about it, unix alone feels like a recurring xkcd standards comic
The synchronization part is the annoying part. And when you have multiple accounts on one site you can end up with multiple passkeys for it.
brb opening and feature request for passkeys in Lemmy
edit: nevermind

There's been a lot of pain in the attempt to portray it as "Just click the passkey button, and that's it! Your login is secured for life!"

No - Buddy. It is secured for this one specific device that I have biometric authentication for. What about my computer? What about my other computer that isn't on the same operating system? I have a password manager that stores these things, why didn't you save to that when I registered? Why is it trying to take this shit from my Apple Keychain when it's in Bitwarden?

And, the next ultra-big step: How would a non-techie figure this shit out?

No - Buddy. It is secured for this one specific device that I have biometric authentication for. What about my computer? What about my other computer that isn't on the same operating system?
Then use a Yubikey.
- I tried a yubikey but most websites want you to use the pin for that which requires windows hello, and if you reset windows you lose that.
I use both Bitwarden and Apple's native Passwords.app and just save a passkey for each app. Usually you can name the passkey on the website/in the app as well.
This is also the system I use when saving 2FA TOTP codes as well so I guess I'm used to it, but it makes good sense to me to have reduncancy in my password apps. Also I lock up the apps themselves with passkeys in the respective app for ease of use.
:mastozany:
And, the next ultra-big step: How would a non-techie figure this shit out?
They wouldn't, because the people calling the shots in the tech world create UX with a focus on it sucking for everyone
And, the next ultra-big step: How would a non-techie figure this shit out?
They don't have a computer, another computer with a different OS, or bitwarden.
This was roughly the state of affairs before but the state of things have relented where software password managers are now allowed to serve the purpose.
So if a hardened security guy wants to only use his dedicated hardware token with registering backups, that's possible.
If a layman wants to use Google password manager to just take care of it, that's fine too.
Also much in between, using a phone instead of a yubikey like, using an offline password manager, etc.

Passkeys are light years ahead of 2fA in user experience. Why do you dislike them?

Security based on devices is one of the positive innovations of smartphones and perhaps the only area where they've improved over the desktop experience.

I very specifically don't want my security tied to my device. Trying to migrate to new phones, and keeping things synced between a phone, desktop, and laptop is why I long ago moved to a password manager. Now, especially in the phone space, getting passkeys to function fully with a password manager ranges from "pain in the ass" to "not actually possible".
- I had a botched phone battery replacement once resulting in the phone getting replaced very unexpectedly. It was a nightmare trying to get everything back together because I stupidly used google authenticator, which is tied to the specific phone it’s on. Not tying it to the device is the way to go.
- Bitwarden: “I’m literally right here”
- @IrateAnteater @yesman if they do the "show secret" or whatever the option is called when your 2FA setup shows a QR code then you can copy that plain-text and save it somewhere (safe!) to just plumb it in to whatever authenticator app you decide to use elsewhere.
  If you use something like BitWarden then it can generate those 2FA codes for you and sync between whichever devices you use.
Why would I want security based on a device? What security this offers greater than a 64 chars password + 2FA?
- TOTP codes can be phished, hardware security keys and passkey can't
Passkeys make plausible deniability more difficult. “This user name isn’t necessarily associated with my real world identity” permits some important good things.
- Passkeys use unique keys per site for that reason
- The kicker is this used to be solved with passwordless webauthn, the same standard, until some morons decided that resident keys were the way to go (they aren't)

Passkeys are one exception to the familiar pattern of "we give you more SeCuRiTY so we can spy on you more and control your behaviour better". They actually are more secure. Problem is, a lot of technical issues with it still, a ton of stuff not working correctly yet

I'm still appalled that my Yubikey / FIDO2 still doesnt work on Firefox. I have it as a passkey for GitHub, realized it doesnt work on Firefox, so they just prompt me for my password. That seems backwards to have password as a fallback, too.
- I think that's a you specific problem. Mine works fine with Firefox, and has for a good long while. Could anything be blocking it?
- I'm also having problems using passkeys (stored in Bitwarden) with Github in Firefox. It keeps prompting me to touch the security key, which I don't have, so I plain can't use a passkey for Github. Works perfectly for Google though

You can store passkeys in your password manager lol

On the contrary i want more services using passkeys instead of 2fa methods that are less secure (sms).

ITT: people who think only SMS, email and TOTP exist as 2FA.

And people who think only your phone can be used as passkey.

I use passkeys through 1Password and it’s vastly less irritating to me than anything involving passwords, especially 2fa. I really don’t like having to wait for email to arrive or copying down digits from a text message, which seems to be how 2fa typically works 90% of the time.

Unless I've missed something big, passkeys are pretty easy for me if the website supports them imo.

Using KeePassXC, I click register on the website, register the passkey with KeePass, then it just works when I need to authenticate or login. My database is then synced across all my devices.

Passkey support is yet to come to KeePassDX on Android though, so I'll be awaiting that feature

For me it's just inconvenient to have to type my computer's login, but the fingerprint on the phone is nice
- If you live in the USA, don't use fingerprints or any other biometrics. https://arstechnica.com/tech-policy/2024/04/cops-can-force-suspect-to-unlock-phone-with-thumbprint-us-court-rules/

It's not for your security, it's for the company's. People suuuuuuuuck when it comes to credentials.

My company insists on expiring passwords every 28 days, and prevents reuse of the last 24 passwords. Passwords must be 14+ characters long, with forced minimum complexity requirements. All systems automatically lock or logout after 10 minutes of inactivity, so users are forced to type in their credentials frequently throughout the day.
Yes people suck with creating decent credentials, but it's the company's security policies breeding that behavior.
- I don't get why people get upset at frequently expiring passwords. It's not hard: just write it on a postit note and stick it on your monitor.
- Tell them the NIST recommendations for password frequency changes have been really reduced in recent times because it pushes people into other bad password practices. Among all factors, changing the password frequently is the least important.
- Same. They also don't allow password managers and I have multiple systems that don't use my main password, so I have at least 5-6 work passwords for different systems.
  Nobody can remember all that.
  So everyone makes the simplest password they can (since it has to be regularly typed in) and writes it down somewhere so they don't forget it.
- And yet admin, 1234, test, etc. remain the most commonly 'hacked' passwords. Your company's policies may be annoying, but they certainly don't make you use unsafe passwords.

Remember when tap-to-pay was new and didn't work at a lot of places and some people were freaked out over it?

And now most of us use it without a 2nd thought.

I speculate passkeys will be like that.

I'd use it if it didn't cost extra in my country. Swiping my card really isn't much harder
- Wow that's madness
- Interesting, I didn't know it costs extra in some places. TIL.

I thought passkeys were supposed to be more secure?

They're using the same standard as FIDO2 / WebAuthn hardware security keys. The protocol is phishing resistant, unlike TOTP and similar one time code solutions.
I prefer the physical ones, because they're easy to organize. Passkey synchronization can be annoying.

Passkey is "something you own" right?

I have something I own, it's a Yubikey

I thought passkeys had to be behind biometrics, so “own” + “are”?
- How i interpretted it is that the biometrics provide access to the tpm which is like a built in yubikey you "own".
- I don't think that's true.
  You can store them in keepassxc which can be accessed with a password.
  I think it's "have" + "know" or "are".
  So you have the device with the passkey, and know the unlock pin or are the person with the biometrics.
And how many sites support Yubikeys/Security Keys? Not many. I doubt we'll see more either now with Passkeys becoming more prominent.
I have two Yubikeys and other than securing my password manager vault they are rarely used elsewhere.

sure, you can use a passkey as a primary authentication, but only "a device" or "system"(keypass/1pass etc) knows the passkey detail. with only passkey, if my passkey provider/ device is compromised then everything is lost. having single factor auth seems like a bad idea.

a password is something that I can know, so is still useful as a protection mechanism. having two factor auth should include password and passkey, which seems entirely reasonable whilst also providing an easier path forward for people used to TOTP.

My primary and backup yubikeys: "Am I a joke to you?"

Of course, yubikeys implement passkey... Passkey is the new buzzword after lackluster success with the words used, webauthn...
- and thank god for that, i'd been saying for years, webauthn is great tech which will never be adopted by normal people, because it had an awful name. luckily we were able to just call OATH TOTP "two factor authentication" or that would have been totally DOA too. I got big hopes for passkeys!
- 25 passkey limit on my Yubikey. I have to buy a new one, with the exact same hardware, just to get the latest firmware that allows 100 passkeys. No thanks.

Uhhh... Can someone ELI18 to me the problem with passkeys? I use them wherever available and find them very convenient.

Yeah i can sum it up for you

I'll use banks as an example

If they cared about your security there would not be a mobile app or website.

Hell, credit cards would still require a signature.

It's about cost first and foremost and then convenience.

Has nothing about you as a consumer. They don't give 2 shits about you as a consumer.

Do you think signatures were at all secure? If they cared about security they'd do chip+pin like most civilized countries.
- With proper infrastructure yes signatures are extremely secure. But that proper infrastructure doesn't exist.
I mean you're right about banks but your examples make no sense.
Banks generally don't support 2fa, which is bad. Some banks (fidelity) still have character limits on passwords because they stores it in plaintext until recently so you could use it through the telephone system. They could implement a secure tap to pay system on your phones with enhanced security, rather than relying on Google to handle their job. And for credit cards themselves, switch to chip and pin.
"Banks don't have mobile apps"?? "Signatures are secure"?????🤡
- How easy is it to fake a signature for a normal person who has not practiced a person's signature for the intent purpose of faking it? Have you ever tried faking your parents signature to get out of school? I have.
  Now the infrastructure required to adequately check signatures is not practical hence it doesn't exist. It's why we moved to pins. Pins are small and 2fa doesn't exist for banks because again it's about the bare minimum and they are out to make money and don't care about customers plus there's government safeguards in place specific to banking.
  I will continue to argue that going back in time signatures are infinitely more secure than a 4 digit pin let alone tap but we have traded security for convenience.
  Anyways full admit that I'm batshit crazy.

Has this energy...

I have no idea what a passkey is and I will probably only learn what it is when they become mandatory

I will just use passwords + 2FA for the moment

Passkey is essentially a branding of webauthn. Instead of typing some code that changes, you just do something with some sort of device or key manager.
Plug in a yubikey and touch the button to authenticate. Easier.
- Interesting thanks. I will probably just stick with passwords + 2FA for the moment because I'm lazy. It would be cool to have something like a hardware key though.
Here is a demo you can try if you're so inclined
- I see, thanks. It mentions biometrics on that page. Maybe if my next laptop has a fingerprint reader then I should look into passkeys more.

Y’all are my people.

I just wish Google would stop overriding my passkey on Android for specific apps including their own.

You can change the provider to bitwarden.
- I do have it overridden but Google Play Services isn't respecting my passkey default.
- how to do that?

Passkeys are phishing resistant, or so they say... but the web app still needs to let you in with password + 2FA... So I'm not sure how much that's really worth.

I guess if the users are typically never seeing a 2FA prompt then it should be more suspicious when they see one?

Passkeys are a replacement for passwords. Passwords don’t solve the problem of a lost password, and passkeys don’t solve the problem of a lost passkey. How a site deals with lost credentials is up to them. It doesn’t need to be password + 2FA.

Coincidence or did you get that email from eBay today, too?

They probably got hacked and we'll find out about it next year.