I don't like passkeys
57 points by eduard
57 points by eduard
I love passkeys as an additional login method. My stuff is typically locked behind email and/or password+TOTP, but I like to add passkey on top of that because logging in by just touching the fingerprint scanner is less clicks and faster than going through password manager or "login with X".
It's worth emphasizing that disliking passkeys as the exclusive login method is fully compatible with using them for 90% of logins.
Part of the problem with passkeys is that websites do not have a consistent philosophy as to whether they are an additional login method or a required second factor.
A combination of randomly generated passwords stored inside a third-party password manager, paired with an independent TOTP app, gives control to the user without giving up the flexibility of plain text. For users who previously reused passwords across all their sites, passkeys are a huge step-up.
I wish anyone dishing out security system design advice like this have a mandatory consultation with 10 people over 65, and probably 5 people who have managed IT security in any organization above 50 people.
Credential stuffing/reuse is a problem, sure, but these people are targeted on a daily basis by decently sophisticated phishers who will hop on a phone call with you.
Passkeys not being forwardable/MITM'able is a feature, not a bug. "Sir, just give me the OTP to confirm your identity". No amount of "We will never ask you for this code" disclaimers will save people.
Banks/financial institutions should be required to give you a non-forwardable hardware token that authenticates you, and governments should follow suit. In a sense, they already do (with ATM cards and chip passports), we just don't have any good interfaces for these tokens.
I wish anyone dishing out security system design advice like this have a mandatory consultation with 10 people over 65, and probably 5 people who have managed IT security in any organization above 50 people.
I though the author was pretty clear that they weren't recommending that as a solution for everyone, but pointing out why passkeys are a step backwards for individuals who already do something like that.
a poor fit for personal security. To an individual, the greatest risks are instead permanent account lockout, automated account bans, and device loss. By using passkeys, you gain better security against man-in-the-middle attacks but face the higher probability scenario of losing access to your accounts.
He's talking about individuals; maybe implicitly technically-savvy individuals, though, honestly, I think he meant the general public.
permanent account lockout, automated account bans, and device loss.
These are the greatest risks to technically savvy people. People "immune" to phishing.
The biggest "technical bias" dog whistle is device loss. A lot of people are on unencrypted drives that never leave their house. Sure, when their house burns down, they lose pictures and access to some of their accounts, and they have to call support. Or, they have modern devices they renew periodically and their files have just been magically following them through the cloud and a 10$ a month subscription.
A lot of people's lives are also just not that digitized. They use accounts for bills and banking when they have to, and that's where they're being targeted for phishing.
Passkeys solve several attack vectors for real people at the cost of potential marginal friction for the most technical users. Yes, if you have your own key management setup and would never fall for phishing, sure, your rofi autopass bash banging setup works great and you get to backup your keys yourself. For everyone else, the bank can just ship you another key or ask you to come into the branch with 2 pieces of ID.
I like passkeys because I just think of them as yubikeys that live inside your devices, and I’ve long used yubikeys for everything. I don’t mess with all the various sync thingamabobs. I can’t remember the last time I signed into an account on someone else’s computer, or them mine. Not saying it doesn’t happen or it is an invalid use case. But computers have become very very personal things! Almost feels like someone asking to write in your journal.
I have a work computer. My wife has a desktop computer at home. I have a laptop. A tablet. A phone. The whole family have accounts on the desktop. The whole thing is very many-to-many. The ergonomics of passkeys are not appealing to me.
I use my password manager for managing passkeys across devices. The article covers this as Third-party synced passkeys.
For me this works very well in every common case I have. I ALSO want to have a username/password for the edge cases, and I use crazy length random passwords. If my passkeys were tied to my devices I’d hate them, but I don’t have the “fighting the platform” problems of the author - the ergonomics seem to “just work” for me.
The auth mechanism I hate the most is text message or email OTP. Not only do I think it’s insecure in comparison, but it’s inconvenient as hell to have to wait up to 30s many times to pass through the gate.
My wife and I don't need to sign in on each others' machines often, but it does happen. Doing taxes is probably the biggest offender. I'd be unhappy if "downloading the tax form" meant resetting my entire Vanguard account.
Actual yubikeys would be better than passkeys in this case. The device-specific lockout issue isn't a factor.
but yubikeys are passkeys, and you can plug them into anything that has a usb port, no need to worry about syncing, or whether the particular passkey implementation is secure or not (is it TPM? is it a encrypted file on the disk?). i dislike on device passkeys, but i like passkey as a way to login because i can use yubikeys.
I hate on device passkeys, but I love yubikey
I don’t really agree, I maintaining a service with a fancy password-less authentication system using passkeys and one-time passwords sent by email, and I think passkeys are nice in this scenario:
It took me some time to polish it, but so far people don’t complain much. It’s not the most secure authentication system of the world, it is just passwordless and convenient.
IMO, one thing that could be improved in the spec is how passkeys are identified and named. In my case, I can’t easily get the name of the device to give meaningful names to passkeys (anti-fingerprinting measures on the web…) so it’s difficult to know which passkey is installed on which device. Sure, users could rename their passkeys themselves, but in practice almost nobody will do so.
In fact what’s really… interesting with passkeys is that they are very widely used, while I bet that most users have virtually no idea of what’s going on under the hood when they sign in on a website with a fingerprint! And it’s difficult to explain, many people believe the website can actually see their fingerprint, and won’t understand that a passkey is usually linked to one device.
So what you're saying is you suspect users don't understand that their passkey is tied to their hardware and they're going to find out exactly how screwed they are the moment they switch hardware? Because they have no idea what's goin under the hood?
"I got a brand new laptop! ...oh no what happened I can't log into anything whyyyyy", or even just "I got a second laptop/tablet/phone but I can't log in???". Tying passwords to hardware, in a society that constantly cycles hardware, is a really, really weird idea.
and they're going to find out exactly how screwed they are the moment they switch hardware?
It definitely happens sometimes, but with my application, they just have to login with an OTP sent by email.
Tying passwords to hardware, in a society that constantly cycles hardware, is a really, really weird idea.
Yes but quite often, it’s not actually tied to hardware but to your password manager. At least that’s how it works with iCloud. So it’s not that bad.
Tying passwords to hardware, in a society that constantly cycles hardware, is a really, really weird idea.
Given that the comment you're responding to explicitly mentions having a magic-link backup/recovery method available, and given that all the big passkey implementations now implement cloud-based syncing across devices, this seems like a non sequitur.
Passkeys really seem like a tool best suited for power users. I don't feel that average people - who largely don't use password managers - are going to understand how to use them.
Average people use passkeys with the password managers their system provides, without even noticing, or knowing that this is what login by TouchID etc means.
All the more reason to adopt passkeys.
The only credible argument for passwords being better relies upon someone using a random generated password in a secure password store.
People who don't use a password manager at all have the most to gain with passkeys.
I used to be really against passkeys because initially they failed for me too often. I nonetheless returned to trying them (or sometimes a platform like Google manipulated me into setting one up). Where I've started to use them, I have found that they now mostly work fine for me, synced with Bitwarden across GrapheneOS, desktop Linux, and macos.
I agree that being locked out of my accounts is probably the most real failure mode for me as an individual, more so than my credentials being stolen. I'm still suspicious of passkeys for that reason, and am glad that in situations where I lost a passkey (or for some reason it didn't work), I have been able to return to password auth. I hope I will always be able to.
But I did update my priors on them because the ones I saved to Bitwarden seem to work okay.
I only use fido/passkeys/whatever at work and the fact that things like
https://github.com/Aldaviva/AuthenticatorChooser
Exist are why I hate them. I understand the limits of passwords, from a security standpoint, but they're still 1000x convenient than all this pointless menuing. Even stuff like getting my Windows password or the VPN login token requires painfully precise menuing.
IMO Windows support for passkeys is much worse than other OSes... For instance you are required to enable Windows Hello to use passkeys. It does not make any sense, Windows Hello is not even necessarily biometric...
It's because Windows Hello is both the system authenticator and the integration point for third-party authenticators. The "biometric Windows login" feature is one very small part of the system.
This would be like saying you hate pizza because franchise pizza shops and frozen pizzas exist.
I tried to add a passkey to 1Password and the entire process is very much non-obvious. Almost as if nobody really wants this to work well.
i don't like passkeys either. it's about control (access control). for passkeys, control is with the smartphone, the yubikey, with whomever except for the user in need of authentication. i trust my offline backups and restore on independent technology.
we have a decades old public+private key based authentication solution which works just fine: SSH. industry, please just copy that.
i understand that managing keys is beyond consumers. yet taking the keys out of the hands of advanced/professional users only leads to a situation where nerds (those who were previously your early adopters) refuse your new shiny.
this is another direction in which the industry appears to have gone too far.