It reminds me of when Netflix was big and I told everyone they'd have commercials eventually. Sure you can still buy a plan without commercials, but I suspect that eventually, when money gets really tight for them, will go away.

Same thing here. Right now passkeys are "open", but who is to say my bank won't require a Apple/Google managed passkey in the future. Hell, I can't run the bank app without running a Apple/Google approved apk.

Question: Why did these corps implement TOTP? You should be able to answer this from an economic perspective of them trying to save money.

Another question: why aren't these corporations locking down TOTP to restrict them to their own validator apps, in the same way you're proposing that they might do for passkeys?

Edit: You may be right about that. I spoke too soon.

That’s not really a bash on passkeys so much as it is a bash on storage methods. Anything with a password that is not no knowledge encrypted is at the exact same risk because the password doesn’t matter to the company the warrant is issued to.

The way i understand it, passkeys test for a combination of what you have and what you are (for those that check user presence, which is all of them I suppose); whereas passwords test what you know.

From my reading, passkeys give more control to the platform/service provider, whereas passwords do the reverse.

The former clearly benefits corps in their unique ways - motivated by profit, security, data/spying and so on.

The current iteration of passkeys is not the form that is being challenged by the earlier anti-passkey post. But rather a floodgates problem. Pretending that it will never happen is asking for trouble.

The better option (be it passwords or passkeys) needs to demonstrate that it gives control to the user.

I'm in the passwords camp, I do not see what convenience or added security passkeys might provide in any of my use cases that is worth sacrificing my level of control and choice.

Passkey is stored on propietary, trust me bro, “we will never share this with the NSA or FBI” Apple or something account where you can’t export them

No. Most FOSS password managers support them, even keepass and bitwarden. You control them, you can export them as you wish, and even use them across multiple devices. I know because I do this.

passkeys can perfectly be used with third party password managers. everything you say here can apply to passwords if you use the Os provided manager.

you can absolutely have 2fa with passkeys. most platforms don’t do it since it adds little value

Passkeys also aren't lock-in. You control them, and your FOSS password manager likely already supports them.

That's my workflow as well 26 random characters, a yubikey (and Aegis TOTP for sites that don't have fido or similar) and I'm good.

You can have passkeys on multiple devices. I use them on different platforms for the same sites.

There are actually 3 categories (though the idea of 2FA is picking 2 out of 3):

• Something you know (passwords, PINs, security questions...)
• Something you have (hardware keys, TOTP, smartcards, SMS/push-notification...)
• Something you are (fingerprints, facial recognition, iris scans...)

But passkeys collapse 2 of those into one by having the passkey algorithm include (as a step of the key derivation) a passcode or some biometric data.. that's why most passkey systems require some form of verification. Though it's up to your authenticator which method is used.

Those two categories aren't really meaningful, but even if you consider them to be, passwords (apart from a master password for your password manager) also should never be in the "things you know" category, because then it means you've memorized them, and are not using a password manager to generate completely random ones.

And unless you've got an incredible memory that can memorize unique passwords like "+28x@!8eaEak!" for 10+ sites, then you're likely using a pattern or single password than can be compromised.

The idea is that they Cross the Mark on thing you have and certainty on who you are saying you are. The latter comes in the Form of biometric authentication for normies Like Face/touch id

I have been hesitant in the same way. I have not until recently understood where the passkeys are stored, and then understood that they then become a “thing tou have”. The passkey is stored on my computer, I prove I have access to my computer, and that is the authentication.

I am still hestitant since it often is just one factor, and I feel I have to manage them much more carefully.

You can, maybe, have you actually imported or exported all of your passkeys before?

The concern is that in order to solve a technical problem, trusting the user, a system of actions and technologies called remote attestation was added to the passkey design. It allows for the service being authenticated into to figure out if it even wants to accept the supposed users attempt. One way remote attestation can be done is by client. Not using a client the service accepts? No way in even if you have the right credentials!

This is really powerful technology that lets me ensure my own services won’t even allow connection to insecure clients or just clients I don’t wanna talk to.

But of course we’re not talking about me using passkeys to gate access to my own services I control, we’re talking about Google, Microsoft and Apple doing it. So built into the passkey standard is the capacity for the service to simply stop allowing you to access it with a passkey if you don’t have the right thingy (or any other suite of remote attestation technologies, client is just one example).

Do you know if your passkeys do this? Do you know how to get in to your accounts if passkeys are suddenly not working?

People are mostly afraid of lock in, control, etc here but the real problem is that most users don’t understand how passkeys work. How can you comply with a regime of passkey use if you don’t know how they work?

There is no reason for you to be using a passkey if it's in your manager already

"Even the passwords are encrypted" I would certainly hope so! Seems like the bare minimum for a password manager 😄

Without browser extensions, Firefox only supports hardware passkeys, so it's waiting for you to plug one in and touch the "attentive" button.

I have a secure password manager, offline, nowhere shared, even the passwords are encrypted.

How can the service provider tell, though?

The point of passkeys is to create an authentication flow that is easier for users to keep secure. The question, then, becomes whether a service provider should make user authentication decisions based on the worst case scenario, best case scenario, or average case scenario. Passkeys are a reasonable way to make sure almost all of your users have secure login credentials, even if the best of the best users would have just as secure login credentials with traditional passphrases.

and they would never violate your trust and later force this onto you because the love their users.

the more apologetics for this shit i see, the less i trust it.

Agreed. Even if you trust her words, she's only one person and Apple could override any decisions she makes.

It makes me wonder about the people in Google who worked for, maintained, and advocated the openness of Android. Only now for Google to continually lock it down.

Corporations never, ever, act badly!

It is not like they are treated as people with rights but fewer consequences for their actions, right? Right, guys?

but in practice they’re being pushed as a way to increase lock-in

Which ones are doing this? Give specific examples of sites that are forcing you to use a specific TOTP or passkey validator.

But most people don't have well managed passwords. And me having good password hygiene doesn't stop my data being hacked when someone working at a subcontracting firm to a company I use leaks all my data.

It also is annoying to have to log in over many steps with 2fa, often forced to email or SMS.

Collectively improving security benefits us all.

But that's exactly the problem. Those that were the target audience for the article do not have well managed passwords. For them the passkeys arguably do increase security, while having a bit more "lock-in".

For those that have well managed passwords (like probably most in this community), they are perfectly fine to use because they don't have lock-in either. I have full control over my used passkeys.

Basically you're not getting the "normies" to use proper password management, and for them they do provide additional security and convenience. They can always add more passkeys on different vendors, you're not limited to just 1 per service. Yes, adding them is a hassle, but so it's managing passwords and following higher security standards in general.

How do they increase lock in?

a way to increase lock-in

Lock-in was already being achieved by mandatory use of apps which require iOS or Google Play services.

Plenty of banks etc which I can simply not use because of this requirement, and others which downgrade you to password+SMS security (used to be a physical TOTP token) if you refuse their app.

I know someone who works at a fairly large public university where TOTP is required. People (mostly students) are still constantly getting phished, despite TOTP. I guess young people don't have the decades of awareness that some of us have.

TOTP tokens are often distributed as QR codes, where you can store in more than one place, store/copy/transfer in plaintext between people or places. Compromise of that token gives permanent access to all TOTP codes generated.

I'm not a fan of how most TOTP apps and implementations actually work right now.

Phished doesn’t mean just a plain old phone call or email these days. It can still happen, and does. But there are now reverse proxy systems that clone legit web pages to steal TOTP by appearing legit, and they’re highly successful.

Granted. But there are plenty of users who probably shouldn't be trusted with any digital accounts, but they still have to use them for daily life. If we can make it harder for them to mess up we should.

This ^

the idea is that there will be a 'central repository of trust' and it ain't you. the step of moving that to 'verifying you' is short. the next step of monitoring you comes for free. the next step of managing you is the plan.

I misread your second sentence as "my 8 month old's reddit account" and was confused when there was no payoff to the premise of the shitpost.

A passkey is just traditional PKI in a trench coat, your biometrics are A) not even required as you can just use a PIN and B) are not sent from iOS when unlocking the passkey.

they can’t force the passkey in to protected storage, as long as there is a browser like firefox in between you and them.

You also need to not use Windows Hello, or Apple Touch ID / Face ID (which actually is the default in Windows & Apple, even if you are using Firefox). Otherwise the browser will relay the request through them and provide the attestation.

The problem is when the mainstream people do use those methods because it's the default, they don't know, or it's simply more convenient since it's bundled in their proprietary OS that they (stupidly) trust.

If having your own non-attested custom method of providing your passkeys becomes something niche amongst the users of passkeys, then I would not be surprised if many places flip the switch and start requiring attested methods.

Of course one can always switch to more consumer-friendly alternatives even if they are more niche, but as long as they remain niche it won't stop the big services from pushing for anti-consumer practices.

I get the anti-phishing notion, but they are buggy pieces of shit so you can't use them even if you wanted to

What propietary bs? It's an open standard.

Don't put it in your phone?

There isn't one. That's exactly the point. The original article had issues with vendor-specific passkeys (Google, Apple) that essentially are only accessible through their ecosystem.

The passkey won't work on a lookalike phishing site, but the password and totp can be inputted into it