Passkey is some sort of specific unique key to a device allowing to use a pin on a device instead of the password. But which won’t work on another device.

Now I don’t know if that key can be stolen or not, or if it’s really more secure or not, as people have really unsecure pins.

  • Engywuck@lemm.ee
    link
    fedilink
    English
    arrow-up
    32
    arrow-down
    3
    ·
    1 year ago

    I don’t think that access to your personal data/email/files being dependent on a battery-powered electronic device is a great idea, to be honest.

    • alvvayson@lemmy.world
      link
      fedilink
      English
      arrow-up
      7
      arrow-down
      5
      ·
      1 year ago

      That’s why they invented chargers, eh.

      But more seriously, there are recovery procedures if you lose a phone with or without a backup and if you are willing to share the keys with a cloud provider, you can also store them there and use them on any of your devices.

      Or you can get something like a yubikey if the battery aspect is really that problematic for you.

      • Engywuck@lemm.ee
        link
        fedilink
        English
        arrow-up
        15
        arrow-down
        4
        ·
        1 year ago

        The fact is that I fail to see something obviously wrong with outrageously long/complicated passwords managed by e.g. Bitwarden or the likes.

        • alvvayson@lemmy.world
          link
          fedilink
          English
          arrow-up
          4
          arrow-down
          13
          ·
          1 year ago

          Bitwarden is also supporting passkeys, so it won’t make a difference for their users whether they use passwords or passkeys.

          And the fact that you don’t see anything wrong is more a you problem. Boomer mentality, dude. Don’t became one.

          • Kusimulkku@lemm.ee
            link
            fedilink
            English
            arrow-up
            11
            arrow-down
            1
            ·
            1 year ago

            It would probably be better for you to explain what’s wrong and not just call them a boomer as if that explains it.

            • alvvayson@lemmy.world
              link
              fedilink
              English
              arrow-up
              2
              arrow-down
              10
              ·
              1 year ago

              If they want to be a Boomer and stick to 20th century solutions, why should I care?

              If it works for them, fine. Nothing wrong with that.

              It’s obviously not working for most people. Most people reuse weak passwords and get their passwords hacked. Passkeys solve that for those users.

              That’s why the whole industry is shifting to passkeys.

              • Kusimulkku@lemm.ee
                link
                fedilink
                English
                arrow-up
                10
                arrow-down
                1
                ·
                1 year ago

                “It’s old so it’s bad” is not a very convincing argument.

                I think he was wondering how technically the new solution is better, especially compared to password database solutions where complex password and password reuse isn’t an issue.

                • Natanael@slrpnk.net
                  link
                  fedilink
                  English
                  arrow-up
                  1
                  ·
                  1 year ago

                  Webauthn has domain bindings and single use challenges which prevents MITM credential stealing, etc

                • alvvayson@lemmy.world
                  link
                  fedilink
                  English
                  arrow-up
                  2
                  arrow-down
                  8
                  ·
                  1 year ago

                  I said the exact opposite. If the old thing works for you, go ahead and stay on it, but don’t complain about the rest of the world improving and moving forward.

                  Why put quotes when you are misquoting…

                  And I answered him, he just doesn’t want to know. I can’t solve that.

                  • Kusimulkku@lemm.ee
                    link
                    fedilink
                    English
                    arrow-up
                    5
                    arrow-down
                    2
                    ·
                    1 year ago

                    You’re mentioning how it’s an old solution as if that was some sort of argument. If you’re not using it as an argument then it seems kinda pointless to bring it up.

                    I said the exact opposite. If the old thing works for you, go ahead and stay on it, but don’t complain about the rest of the world improving and moving forward.

                    I’m not sure if you even realize you’re doing it but you’re doing it again, implying that it’s better because it’s newer. That’s not a very solid argument.

                    And I answered him, he just doesn’t want to know. I can’t solve that.

                    I know you’ve mentioned some aspects but I’m still wondering, in your opinion, what would be the technical reason that the password database model with long and complicated passwords would be worse than the passkey setup. Or is it that they’re as good but passkey might be a lot simpler to some folk?

              • wildginger@lemmy.myserv.one
                link
                fedilink
                English
                arrow-up
                3
                ·
                1 year ago

                It kinda sounds like you dont actually know whats wrong, and are just blindly following the trends.

                Doesnt that make you the boomer?

          • V0lD@lemmy.world
            link
            fedilink
            English
            arrow-up
            4
            arrow-down
            1
            ·
            1 year ago

            What do you see that’s wrong with it that we don’t if I may ask?

            • DeadlineX@lemm.ee
              link
              fedilink
              English
              arrow-up
              7
              ·
              1 year ago

              Mostly phishing. Passkeys can’t be phished. And really, passwords are awful in general for security purposes. You don’t have to use your phone or google or apple or whatever.

              I actually have a physical usb key that I use as a passkey. Its just a more secure login implementation and will likely be the only option in the future.

              • hedgehog@ttrpg.network
                link
                fedilink
                English
                arrow-up
                2
                ·
                1 year ago

                Passkeys can be phished, it’s just much more difficult than with passwords, TOTP MFA, SMS MFA, other OTPs, or push notification-based MFA (e.g., Duo or the way Microsoft, Apple, and Google push a notification to their app and you confirm and/or enter the key).

                Passkey is extremely phishing resistant in the same as Webauthn MFA and U2F MFA are, in that origin checks by the browser prevent attackers from initiating the auth process. But it can still be attacked in these ways:

                1. XSS bug in the target website
                2. Browser vulnerability
                3. Malicious browser (not a concern on iOS but a concern everywhere else)
                4. Compromise of any cert in the chain between you and the target website
                5. Convincing the user to install (or using malware to install) a root certificate, or compromising one you already installed (e.g., for work)
                6. Bookmarklet/clipboard/devtools attacks

                From memory, passkeys, webauthn, and u2f should prevent over 99% of phishing attacks that are successful without them in place.

                There’s also the risk of the passkey itself being compromised, though that level of risk is dependent on your device / how you’re storing your passkeys and isn’t a “phishing” risk.

                • Natanael@slrpnk.net
                  link
                  fedilink
                  English
                  arrow-up
                  2
                  ·
                  1 year ago

                  The main point is all those attacks need to attack the local software or hardware implementation on one of the two ends (or a cert issuer), and even then it’s replay protected so for example an XSS attack lasts only for one session, so it’s more robust.

                  • hedgehog@ttrpg.network
                    link
                    fedilink
                    English
                    arrow-up
                    1
                    ·
                    1 year ago

                    Correct, but that doesn’t change the fact that “Passkeys can’t be phished” is not true.

    • AA5B@lemmy.world
      link
      fedilink
      English
      arrow-up
      1
      ·
      1 year ago

      My understanding of Apple Keychain is that every credential is useable from every device, and can be backed up and restored to a new device. Most importantly Apple doesn’t have access, although we have to trust them on that