Author’s bullshit that passwords are inherently insecure is, well, bullshit. WEAK passwords are weak, yes.
Meanwhile, anything that can fail if I lose my device (or it gets stolen or broken) means it’s just a matter of time before I’m permanently locked out.
I know how to secure my passwords. We need to train people how to generare secure passwords and manage them effectively.
KeePassDX can store passkeys in a local encrypted DB you can backup like your other files. I plan to migrate to it. (Using another KeePass implementation right now that doesn’t do passkeys.)
The article has some good points, but is also reductivist.
Passkeys can indeed be abused, but they solve a security issue that was being abused in the wild that TOTP doesn’t solve. They essentially close a security gap connected to shared secrets that ensures they can’t be abused by caching attacks in the same way as TOTP. They do this by exchanging some of your personal privacy for third party trust — and this in turn means that the third party is no longer storing your password in active memory, making it less prone to data leaks.
But the big secret here is that passkeys aren’t exactly the thing companies like Google, Microsoft and Apple are telling you they are: that’s a single (or two, really, as MS uses a different implementation) of passkeys that slave your side of the shared secret to a mobile device or browser.
Passkeys work fine in software (1Password works as a passkey vault, for example) or in hardware (Yubikeys are fully FIDO compliant and so implement everything but the transport mechanism). So it’s perfectly possible to use a safe and secure passkey that isn’t leaking data to the second party.
The problem with passkeys is that it’s also possible to tie them to a TPM, which is controlled by the second party, not you. And this is the default method that Google, Apple and MS default to presenting when a passkey creation prompt comes up on “their” devices.
So passkeys aren’t the trap; the pushed implementation is.
Get a Yubikey or a password manager that properly implements them and they’re significantly more secure than TOTP. It’s essentially the same technology that Apple uses for Apple Pay.
Oh, and of course, passkeys don’t get rid of passwords; they get rid of indiscriminate password use. You still need a shared secret to back the passkey; it just tends to be a longer “token,” “key,” or passphrase. At the end of the day, that’s no different from a traditional password except for the accepted length and how often it is used.
KeePassDX can store passkeys in a local encrypted DB you can backup like your other files. I plan to migrate to it. (Using another KeePass implementation right now that doesn’t do passkeys.)
We have been rolling passkeys out at work and have been having to explain to our users the difference between “Device-Bound” and “Synced” passkeys.
Synced passkeys are by nature more vulnerable because they touch the internet. They can be stored in regular password vaults and so on, tosses onto google drive, etc. and then get those compromised, and because passkeys come with an extremely high level of trust, that is a fully busted account at that point. As such, we can’t justify allowing synced passkeys on corporate, especially for admin level accounts.
With that being said, for non-work accounts in your day to day life, synced passkeys are going to be the way to go for privacy and data sovereignty, but it moves the onus of protecting that data onto you the user. I am able to handle that, as are many reading this, but a lot of folks do not have the technical prowess to defend themselves. When I am off the clock, I will champion privacy-focused solutions day in and day out. Work can do work things on work’s dime and work’s time, but they will not touch my personal space - I will not abide it.
Yubikeys are the best of both worlds if you can get them — work paid for mine, but they’re my keys, not theirs, so I can use them for personal accounts as well as work accounts, and not have to worry about them being bound to a work device or insecure from being synced keys in a password vault.
What I don’t like about passkey implementations I have used on my phone is that is completely opaque who is generating the key and where it is stored. I have the Android and chrome password managers disabled, but I think Google is trying to store my passkeys, which I do not want. Bitwarden can create and store them, but I have the feeling Android is hijacking the enrollment.
I’m also not clear on the benefit to me, since I already use a password manager with extremely long random passwords unique to each login.
Google shouldn’t be able to store it. It’s in your TPM.
I’m sure you’re right, but none of the dialog messages give any hint of it. I know where my passwords are stored, in contrast.
I can’t say much about the hijacking side, other than that you have to be careful when you set them up.
The advantage over passwords isn’t on your side of the equation; it’s everywhere else.
With a password, the password or its hash has to be sent to some other party who then has to hold it in cleartext in memory to validate it. This means some other person or software can steal it and use it at their leisure. TOTP improves this by adding a second factor in the authentication chain… except that to make it work smoothly, a token is set that is almost as easy to steal as the password — it’s just got a shorter expiry.
But with a passkey, once it is set up, every interaction uses a unique token based on the existing relationship— so sniffing part of a transaction is useless to decrypt it, agent in the middle will fail, and if either side is compromised, the new actor won’t be able to do anything with the secret without setting up a NEW passkey.
So yeah; the risk with passkeys is that they’re opaque enough that someone could be tricked into establishing a new one with an untrustworthy party.
I appreciate the reply. I’ll read more about it.
So, if Bitwarden, all good?
KeePass.
Well…for now? Bitwarden looking to enshittify lately. But yes right now Bitwarden passkeys work great across multiple devices desktop and mobile. Been using them for a number of years now.
I use vaultwarden with the bitwarden clients on my devices. Works a treat. Make sure you know what you’re doing and have an effective backup strategy if you decide on this!
I’m pretty confident in my backups, but passwords are just too important for me to risk, especially since I’ve started using unique usernames and email addresses for accounts.
Great opsec! I also have a catch all domain for usernames and use bitwarden generated complex passwords. I have a local backup and two off-site backups that themselves have redundancy so I should be fine. I hope :)
Misleading headline. Appropriate one:
FIDO Alliance’s implementation of passkeys maybe a slippery slope. Beware.
