Passwords are okay, impulsive Internet isn't
Passwords are okay, impulsive Internet isn't
Article discussing the push for passkeys as an alternative to passwords, including numerous problems associated with passkeys like big companies agenda, complicated proprietary implementations, vendor lock-in requirements and dependency on smartphones, dubious value for ordinary users, and misplaced...
A lot of incorrect assumptions in this article. If you don't like the idea of a key exchange over passwords, I hope you use password auth when you SSH into things 😁
The word passwordless is nonsense. In most cases, most passkey implementations, you need a PIN to unlock your private key to authenticate. PIN = password, except it's numbers only. Nonsense. Passkeys simply obfuscate the problem and move it somewhere else, most often into a PROPRIETARY key management tool. For example, Microsoft wants you to use THEIR authenticator app. Not just any app that adheres to the standard. Nope. This effectively means super-vendor-lock-in. Absolute nonsense.
You can argue that the term "password less" is nonsense, but there is literally nothing about the spec that prevents you from using passkeys as they were designed: with hardware keys that support the open FIDO2 authentication protocol. Yes, you still need a second factor to verify the authentication attempt (via a PIN), but unless you're mailing that key to hackers, the private key generated by your SoloKey, NitroKey, or another open source hardware key, is more secure than any password ever will be.
Passkeys usually require a phone - this is a single point of failure, and one that gives the big companies extra control over you. Phone, number, SIM, and so forth. A beautiful bevy of data. The whole idea of actually having to use your phone as an identity vector is horrible.
Phones support storing passkeys. Phones also support storing passwords. In no way does this mean you must use them for this. You can either use hardware keys, or you can use your favorite open source password manager to store passkeys where you should already be storing your passwords anyway.
You need "biometrics" to supposedly prove you're you to unlock your private key. Biometrics are a form of password, except you can't replace it, and it also gives yet more of your personal data to the big companies. More nonsense.
This is literally a direct contradiction of what the author said in their first bullet point. Use a PIN if you don't like using biometric auth.
The implementation of passkeys is fragmented, vendor-specific, and complicated. Only diehards who love technology can use this. The same kind of people who were "all in" when IoT/cloud crap came out, and now they see their smart homes slowly go offline as big vendors almost arbitrarily cut support for old gadgets and effectively kill products. Because cloud.
Most of this is actually a fair critique. The FIDO Alliance is still working on the spec, and I think they should require any implementation of passkeys to follow the spec to a tee without adding any kind of nonstandard bullshit to their authentication.
However, most advancements in tech begin with only appealing to enthusiasts and later become adopted by wider audiences. It doesn't make them bad that they aren't immediately popular with everyone.
Passkeys only solve one use case - phishing where the user inputs their password and MFA into a fake site.
I'm glad the author can at least recognize that there's at least one thing that passkeys solve that passwords can't. But it's not the only thing. When you enter a password on a site, you're hoping like hell that the service you're using hashes it and hashes it properly. When you authenticate with passkeys, you're sending the site a public key. This key will have way more entropy than any password will, so anyone trying to crack a hashed public key is in for a long, miserable time (obviously not impossible though). But even if they wasted their time doing that, it's a public key. Who cares?
Any service you use passkeys with instead of passwords won't put you in another leaked password database.
The public key just needs to be invalidated andyou can move on with your life.Any service you use passkeys with instead of passwords won’t put you in another leaked password database. The public key just needs to be invalidated and you can move on with your life.
Does it though? Is there anything wrong with your public key being, um public? All they can do with it is verify who you are, (or technically encrypt things that only you can read - not that pass keys are used in this way?).
Actually yeah. You're right. Even better 😌
https://keepassxc.org/blog/2024-03-10-2.7.7-released/ says it has passkey support. I guess the author can now do exactly what they want.
You seem to be falling for what the author was writing about. Only because you could technically try to use keepassxc to store passkeys, that does not mean that it will work. You see passkeys were build in a way the service you're trying to login to can decide if they accept your keepassxc for passkey storage or not. It looks like you are in control when you are actually not.
The author of this website is soooo full of himself he doesn't even notice how he bends reality to fit his point of view.
Yeah, they make some good points but it's all a bit dramatic
Can someone explain to me how using biometrics rather than a password/pin to protect from unauthorized access to your passkeys doesn't violate the "something you have" and "something you know" principle of multi-factor authorization? Most of these implementations seem squarely geared at user convenience at the cost of actual security.
Passwords can be secure when the end user picks a strong one. But that is the biggest problem with them, the end user. They don't pick good passwords and decades have shown us the general public are bad at passwords.
Passkeys are not biometrics. They are much simpler. In a very simple way you can think of them as a secure long random password that is stored on you device, generated per device, and not sent over the wire to the other side (so more like public/private key cryptography I believe).
The passkey on your device can be stored in an encrypted vault or even secure hardware that requires a pin/password or key to unlock.
They are not getting rid of multifactor codes and can be used with them. But by protecting them locally you can still have 2 factors to access them - the hardware/vault that contains them and the pin/password/biometric that unlocks the vault. And that is in addition to server side multifactor systems.
But even without all that you still gain massive benefits over passwords as it stops cross site comprises when one sites gets their password database leaked. Or brute forcing access to systems by guessing weak passwords that most people use.
https://en.wikipedia.org/wiki/Multi-factor_authentication :
- Something the user has - device/token
- Something the user knows - password/pin
- Something the user is - biometrics
This assumes a pin is used, which according to the WebAuthn wikipedia page is not generally the case:
The illustrated flow relies on PIN-based user verification, which, in terms of usability, is only a modest improvement over ordinary password authentication. In practice, the use of biometrics for user verification can improve the usability of WebAuthn.
The way I read this, a pin is even too much for the end-user and biometrics replace it for usability.
I'm not sold on passkeys, either. Too "opaques" to me.
The more every fucking site shoves that down my throat at every login, the more I am not willing to even look at it.
This
That was a huge rant, i also don't like the microsoft authenticator so guess what i don't use it, and the issue of your private keys to getting stolen if your pc is hacked has long been solved with password protected keys.
All of these issues pretty much amount to nothing, the standard works and is more secure then passwords, same reason as to why enabling password login on SSH is not recommended.