Passkeys are generally available

https://github.blog/2023-09-21-passkeys-are-generally-available/

by yarapavan • 3 years ago

99 115 3 years ago

blfr• 3 years ago

OK, so I guess I will have to learn about these passkeys. Which source do you recommend to tell me what it actually is without marketing hype from one of the providers and honestly lays out whether it's better than my current firefox password manager + yubi keys combo.

NoZebra120vClip• 3 years ago

They will turn our security keys into junk: https://fy.blackhats.net.au/blog/2023-02-02-how-hype-will-tu...

snuxoll2• 3 years ago

Personally I think the rk requirement is just fine, the long-tail goal of Passkeys is to simply credential management for users and the UX of key wrapping stands in opposition of that.

Having a security key handle unlocking your platform authenticator/password manager seems to be the middle ground that's being driven towards, and as somebody with multiple YubiKey's I'm perfectly fine with it.

microtonal• 3 years ago

At the risk of setting up a straw man (but the sentiment of your comment seems negative), but should we slow down improved security for the for the whole population, so that a bunch of tech people who have hardware keys with a measly 20 or 32 slots can keep using them?

Sure, authentication could also be done without resident keys, but resident keys simplify the authentication workflow a lot, since the relying party doesn't need some additional credentials to send the correct wrapped key.

(Disclaimer: I have several Yubikeys.)

yencabulator2• 3 years ago

Interestingly, this link says

[The definition "passkey is a resident key"] has become so invasive that even FIDO now use it as their definition.

but the linked FAQ for "their definition" doesn't contain the word "resident" (anymore?).

toomuchtodo• 3 years ago

https://www.stavros.io/posts/clearing-up-some-passkeys-misco... (courtesy of u/stavros)

evil-olive• 3 years ago

the FIDO Alliance has an FAQ [0]

What is a passkey?
Any passwordless FIDO credential is a passkey.

I would recommend [1] as an excellent overview of the FIDO2 and WebAuthn standards that underlie passkeys. depending on how you use your Yubikeys, you may already be using these standards.

if you already have a password manager you're happy with, the appeal of adopting passkeys is somewhat marginal. if you're using your Yubikeys for FIDO2-based MFA you're already getting the majority of the benefit.

0: https://fidoalliance.org/passkeys/#faq

1: https://www.youtube.com/watch?v=DWrLBwi7ZBA

Ajedi323• 3 years ago

if you already have a password manager you're happy with, the appeal of adopting passkeys is somewhat marginal

This is where I'm at personally right now; basically just waiting for my favorite password manager to add support for passkeys. After that the transition will be pretty seamless; I'll just start storing passkeys in my password manager instead of passwords wherever possible, and get a nice UX improvement as a result.

fluidcruft• 3 years ago

0: https://fidoalliance.org/passkeys/#faq

"What is a passkey?" might as well redirect to zombo.com.

tgsovlerkhgsel4• 3 years ago

Any passwordless FIDO credential is a passkey.

Oh great. So a physical security key could be a passkey, but only if it's used as 1FA not 2FA. At the same time, this weird "store key material in a device and optionally sync to the cloud" thing is called passkey, but if someone uses it as 2FA it suddenly isn't a passkey?

harpiaharpyja2• 3 years ago

Is there a more technical explanation anywhere? I would like to know what they are not what they are used for and why they are so great.

thrill• 3 years ago

Works smoothly with MacOS and TouchID.

samcat1163• 3 years ago

Very nice! Passkeys can't come soon enough to more services.

throwawa14223• 3 years ago

I still don’t understand why anyone who isn’t in the walled garden business would consent to passkeys.

iknowstuff• 3 years ago

Because you don't understand passkeys. And you probably don't know password managers can store passkeys as well as the OS

CharlesW4• 3 years ago

Maybe you misunderstand how they work?

My GitHub account currently has a 1Password passkey and an Apple passkey. IIRC I added the Apple-generated passkey before 1Password supported them, but both work, and neither prevents me from moving to a different pass* manager in the future.

I personally feel safer that passkeys aren't sync'd across multiple vendors' products.

flkenosad• 3 years ago

Are there good open-source, self-hostable alternatives to 1Password that do this?

yomlica82• 3 years ago

I personally feel safer that passkeys aren't sync'd across multiple vendors' products.

Last time I checked into these hardware attestation was part of the specification but the ability export them from a vendors platforms is not. In practice that will mean unapproved platforms can be shut out and walled gardens strengthened. Which will happen sooner or later because it can. Apple supposedly zeroes their attestation but that is only a partial mitigation and relies upon the values of a giant corporation not changing its mind for any host of business reasons. And it does nothing to stop other platforms.

recursive2• 3 years ago

Maybe you misunderstand how they work?

For me, it's precisely because I know I don't understand how they work.

With a password, I can hold it "in my hand". It's a string. I can export, and basically know that I have the whole thing.

With a passkey, I don't understand it enough to convince myself that my password manager is not able to lock me out of my accounts. The test for me is whether I can copy some piece of data out of the password manager and use it to authenticate. If authentication has to "go through" the manager, then my access to my account is vulnerable to the whims of the password manager. Or perhaps the whims of the new corporate owners of the password manager.

I've migrated passwords once from one password manager to another. I don't understand at all how this is supposed to happen with passkeys.

I'll be holding out either until I can understand satisfactory answers to these, or until support for passwords gets dropped from services I use.

thewataccount• 3 years ago

From my understanding they're basically an extension of FIDO?

You can just use a yubikey unless I'm mistaken?

spoiler• 3 years ago

You can just use a yubikey unless I'm mistaken?

Yes, USB passkeys work!

0x457• 3 years ago

Something like that, they're Webauthn alternative outside the web and allows multi-device syncing (Webauthn doesn't support syncing)

You could use any FIDO2 software or hardware key with Passkey.

Arnavion• 3 years ago

A password manager can easily implement passkeys just like it implements passwords.

Though last I checked no browser had created an API for extensions to implement the passkey API. KeepassXC's implementation for example has to inject JS into every page to override `window.navigator.credentials` ( https://github.com/keepassxreboot/keepassxc-browser/pull/178... ). It works but is brittle, so a proper way through extension API would be nice.

coder543• 3 years ago

I can’t speak to other platforms, but iOS natively integrates with third party password managers for passkey support, including inside Safari.

samcat1163• 3 years ago

The 1Password extension in Chrome does this so I assume there is some API

aseipp4• 3 years ago

It's a really recent addition to Chrome/Edge to support that, and it only was supported on iOS in v17 which came out last week. Actually, 1Password probably released their support for Passkeys last week precisely because iOS 17 was finally out.

For reference, I just 5 minutes ago opened GitHub in Edge on my iOS device, clicked "Sign in with Passkey", and 1Password correctly popped up and offered to sign in with the passkey I had created in Edge on my desktop. I then opened Safari on my phone, and did the same thing. So it definitely is getting there.

varjolintu2• 3 years ago

I agree. An open API in browsers would simplify things a lot.

dwaite6• 3 years ago

Android and iOS 17 have native API to supply passkeys via system API, which will surface in browsers as well as native apps.

A pure web extension password/passkey manager currently has to go the injection route, and will not surface credentials in native apps. This generally means that if you use such a manager, you need to make not to select any options to remove your password, either from your password manager or from the account behind that native app.

heavyset_go7• 3 years ago

If your only exposure to passkeys is through their Android and iOS implementations, I could understand this initial reaction, but they don't only exist on Android and iOS.

It's entirely possible to use passkeys outside of either platform by using any FIDO2 security key with discoverable key storage. There are even existing open source apps that emulate FIDO2 security keys that you can use.

I also believe that passkeys can be backed up and exported on Android/iOS, either now or sometime in the future.

The FIDO Alliance is working on standardizing the backup and transfer of passkeys so that they can be exported and used however you see fit.

That said, I don't use the Android or iOS implementation of passkeys and probably never will. It's possible to use passkeys without ever giving closed platforms the keys to your castle.

raisedrased• 3 years ago

Good. Now I can access someone's entire life including their banking just by guessing the pin on their phone. We went from bad passwords to even worse pins.

But hey at least advertising agencies and the police can track you from one device to the next.

judge20202• 3 years ago

So step 1 is stalk someone to see their passcode, and step 2 is steal their phone. Is phone theft of this level rampant where you're from? Even if a phone is stolen, going far enough to commit wire fraud by stealing money from someone's bank is too much to ask for over selling it to China for $200+.

But hey at least advertising agencies and the police can track you from one device to the next.

Passkeys are unique per login (not per device/user) and the actual synchronization provider is not in the loop - and for e2ee solutions like Password managers or iCloud Keychain, they don't even know what websites are being synced.

musictubes• 3 years ago

How are passkeys worse than passwords for tracking you across devices?

tpmx4• 3 years ago

I think a weakness with Github might be ssh-based pushes. Hopefully the user uses an ssh passphrase (typed at every remote git interaction, or typed once per session via ssh-agent. MacOS does something special with their secure enclave thing.)

But how do you secure that against the threat of a keylogger running on a developer's Linux machine? Am I overthinking here? Is it already game over if the attacker runs software on that developer's machine?

heavyset_go7• 3 years ago

You can use FIDO security keys with SSH and a keylogger would be useless unless someone has physical access to your security key.

tpmx4• 3 years ago

Thanks, this looks interesting. Are you using Yubikeys or something else?

https://developers.yubico.com/SSH/Securing_SSH_with_FIDO2.ht...

MillionOClock• 3 years ago

Can this be "emulated" on macOS with the keychain?

shepherdjerred2• 3 years ago

I've had a great experience with 1Password + Passkeys [0]. With 1Password I can sync my Passkeys between my devices, and it pops up with a notification when I can use a Passkey to login which is handy. I'm not really sure how to use Passkeys on my iPhone with 1Password, but I'm sure that'll come as Passkeys gain traction.

1Password has a directory [1] of sites that have Passkey support, so one day I moved over those accounts.

[0] https://1password.com/product/passkeys

[1] https://passkeys.directory/

andix4• 3 years ago

This was always driving me crazy about webauthn, that you couldn't sync it between devices. You always had to add at least a few devices, not to lose access if you lose a device. And keep track of all services, so you can add new devices if you change them. Not very practical.

I try always to disable email or SMS 2FA/recovery, because I deem them to be rather unsafe.

Btw Bitwarden announced to support pass keys soon ("in October").

yencabulator2• 3 years ago

Hardware keys don't want to transfer the private key out of the hardware gadget, because that compromises the security model. That's their whole point, you can't extract the secrets, the hardware would rather self-destruct than expose the secret. Lack of "sync" (while retaining ease of transferring the key between computers) is the the primary purpose of a hardware security key.

You're opting to a lower security level by wanting something that can be synced.

judge20202• 3 years ago

I'm not really sure how to use Passkeys on my iPhone with 1Password, but I'm sure that'll come as Passkeys gain traction.

iOS 17 plus the latest 1Password allows you to use passkeys saved in 1P across apps and websites.

tzs2• 3 years ago

I wonder why they are requiring iOS 17? Apple's Passkey support includes iOS 16 so I had expected 1Password to also support 16.

donatj• 3 years ago

I think the biggest roadblock to widespread adoption outside major corporations is how complex they are to implement on the server side, in particular in comparison to passwords which are trivial. Every implementation I've seen so far has been multiple thousands of lines, whereas password auth can be done in several lines.

Libraries will come for every major language in time, we'll see how easy it becomes to implement. I'm hopeful.

andix4• 3 years ago

Safe password authentication is also not trivial to implement, especially not with a second factor. Let's hope even more people will use authentication frameworks created by experts, instead of some badly salted password databases.

teeray• 3 years ago

Every implementation I've seen so far has been multiple thousands of lines… Libraries will come for every major language in time, we'll see how easy it becomes to implement. I'm hopeful.

This becomes a liability for security when everyone becomes a user and very few people are contributing. OpenSSL has been an example of this in the past.

aseipp4• 3 years ago

whereas password auth can be done in several lines.

Secure password auth is complex and because of externally imposed constraints like phishing, generally needs more work to support. You also need recovery flows, etc, since just losing access typically isn't acceptable. So I don't think password auth can really be "done in several lines."

Realistically, I think the takeaway is that no matter what you're talking about, storing private material on behalf of someone sucks complete ass, and is not easy to accomplish on a modern computer in a secure manner, no matter how you slice it. But we still have to do it. Luckily Passkeys do have actual tangible benefits beyond passwords (e.g. unphishable, no private key material stored by the server), so getting this right does come with actual benefits beyond the status quo.

dwaite6• 3 years ago

A webauthn library will likely support things which you don't need for simply accepting passkeys, such as attestations and extension support.

A minimal implementation can be dramatically simpler; the problem comes in conveying to an application developer what their requirements are for implementing the minimal flow.

jopsen2• 3 years ago

Is it correct that a yubikey with U2F / webauthn can be used as a passkey, it's just the physically portable kind?

Isn't this just removing the password factor, for people already using a security key?

eli• 3 years ago

Passkey is really just a type of webauthn. It doesn't necessarily have to remove any other factors. I think the primary goal is to replace single-factor passwords with it.

rfoo• 3 years ago

In theory, passkey replaces password. Single factor passkey is more secure than single password, and it doesn't matter where it's stored. A passkey in whatever password manager we use (KeePass etc) makes sense. Such a passkey should not replace 2FA - you'd better still have a second factor.

The confusing part is Google, Apple and Microsoft implemented a hardware-secured (hardware is by default the enclave of your phone AND vendor's HSM in cloud) form of passkey, which can also serve as the second factor, replacing both password and 2FA. Some website then decided to support this type of passkey only, NOT passkey + security key, some are even deprecating security key U2F support.

dwaite6• 3 years ago

The passkey terminology is describing a "primary factor" user experience, which requires certain WebAuthn features to be implemented.

A U2F-only key does not have storage so it cannot implement discoverability on its own. So it won't work as a passkey.

A more modern Yubikey/security key will have the storage to do discoverability, as well as user verification (via pin or possibly via biometric) which some sites might also require.

tzs2• 3 years ago

Looks like GitHub is handling Passkeys smoothly. I added one on my Mac stored in 1Password with no problems.

Note that not all sites are handling it quite as well. For example I tried to add one at Home Depot. As part of this they emailed me a verification code. I entered the code, and it then asked if I wanted to enable login by Face ID or Touch ID.

I'm on a Mac which has neither Face ID or Touch ID so said no. It continued and I was logged in.

It turns out that if you say no it doesn't actually make a Passkey. It just does a one time password free login via entering that code that was mailed to you.

To actually make a Passkey for Home Depot you have to say yes to Face ID or Touch ID.

ajyey• 3 years ago

I also went through this today. Kind of confusing but worked in the end

dilippkumar• 3 years ago

We found that Linux and Firefox users struggled to use passkeys, as those platforms don’t yet have strong support for passkeys.
As a result, we decided to enable cross-device registration of passkeys. That means, you can register a passkey on your phone while you’re using your desktop. The passkey lives in the phone, but users can connect it to their desktop and set-up and authenticate through the desktop’s browser. This enables Linux and Firefox users to set up passkeys.

This has always been the real no-go for me when I was implementing auth.

I looked into supporting passkeys and found that they're basically useless unless you can make some strong guarantees about who/what can access the keys stored on the device. Linux and the various BSDs can not do this today (and likely will ever be able to do this well given that someone can always recompile a malicious OS that pretends to be another well-trusted OS).

If a user needs to reach to their phone to log into something on their laptop - that's never going to be really secure. It's only a matter of time before everyone starts having "We will never ask for you to log in through your phone, don't do this if someone asks you to" warning labels and respawn the entire industry of anti-phishing mechanisms for this new attack vector.

butz• 3 years ago

Did any Linux distro showed any interest to implement Passkeys? Ubuntu and Fedora are probably most likely to do something about it first. Ubuntu already has encryption that uses TPM chip.

hex-m3• 3 years ago

If you mean "FIDO2 platform authenticator", this project looks promising: https://github.com/AlfioEmanueleFresta/xdg-credentials-porta...

kevincox• 3 years ago

and likely will ever be able to do this well given that someone can always recompile a malicious OS that pretends to be another well-trusted OS

I don't understand your concern here. Do you mean an evil-maid style attack? At some point you need to trust the user to keep their device secure. A Windows can also have malware.

wkat42425• 3 years ago

Linux supports Yubikeys though, in Chrome and Firefox. It's a really secure way of using the same mechanism that is passkeys.

I'm even using it on my FreeBSD desktop.

BillinghamJ• 3 years ago

All forms of FIDO2 authentication do fundamentally rely on being able to trust the browser to not misrepresent the "relying party" (the RP, aka the registered domain, github.com in this case)

They are phishing resistant, even when using the cross-device QR code thing, but that does rely on some base level of trust in the user agent

At the end of the day though, if the browser is the malicious actor, there's simply nothing you can do. That is not a realistic or defensible scenario in most threat models

Passkeys do represent an enormous improvement in security for users, including in the scenario you've highlighted

I know in traditional auth setups, that kind of situation does tend to invite additional concerns, but (again assuming you trust the user agent) FIDO2 still provides full protection when that's happening

lostindetails4• 3 years ago

Using passkeys as an additional login method I can understand, but I have a problem that I don't know how to solve:

How can I guard against losing permanent access to my github account?

Until know I have memorized a very long and random password, that I sometimes type in to keep it in memory. In case of a fire or some similar event in which I would lose my stuff (like devices recovery codes) I'd have no issue, but with the upcoming requirement on github which enforces 2-factor authentication I don't know how I would be able to get access to my account?

neonnomad• 3 years ago

1password can store passkeys for you and sync between multiple devices. Then I add a Yubikey Bio to add of these accounts as a backup.

lostindetails4• 3 years ago

Thank you for the answer! I don't want to use a cloud service for sync, I will take a look if an opensource solution has a direct device to device sync, I haven't thought about that. I will also checkout the yubikey bio - I guess as it's hardware so no pesky account cloud connected? Thanks for the ideas!

tgsovlerkhgsel4• 3 years ago

Given GitHubs policy of "no account recovery if you lose 2FA, ever, if you screw up you lose that account forever", lockout seems a bigger threat than takeover. Luckily, Github lets you add SMS 2FA. That isn't secure, but at least you should be able to get access to your phone number in case of a disaster.

A TOTP seed backed up (on paper only) in multiple locations is also a good fallback.

lostindetails4• 3 years ago

I agree - at least for me, the lockout scenario seems more likely.

The SMS 2FA is great point! Until now I was able to not hand out my number to bigtech, eg. for Chatgpt I bought an new SIM card with a 5 EUR deposit that I just used for the registration process, but those cards expire after a couple of months if you don't use them. Guess I have to give out cellphone number after all...

Printing out the TOTP seed and hiding the paper in multiple locations sounds somewhat wrong to me. Maybe the TOTP seed will be my new, even longer password to remember j/k

Hmm, but if you would cryptographically hide it in publicly available data, it would be easy to recover.

Thanks for the input!

klooney• 3 years ago

You can set up multiple 2FA- I have two yubikeys and a TOTP key registered.

wkat42425• 3 years ago

The super annoying thing with github is that while it supports passkeys now, it still requires you to set up TOTP (eg Google authenticator) as the main MFA method and requires you to "verify" it often. Leading me to have to go find my phone, open the MFA app etc when I could just simply tap my Yubikey.

It's really dumb and I hate github for it. I don't even have anything important on my account, I just use it to log some bugs in FOSS apps. It's time for the FOSS community to compete moving away from this platform as they started to do when Microsoft took it over.

abraham2• 3 years ago

GitHub has a "Preferred 2FA method" method that you can set to passkeys.

wkat42425• 3 years ago

Yes I know. During normal use it uses it.

But you still can't remove the TOTP and it will keep asking to 'verify' it every month or so.

tgsovlerkhgsel4• 3 years ago

The rapid change in standards coupled with confusing/changing naming got me to the point where I have no clue what the currently best approach for "passwordless and/or actually secure 2FA" is.

I also got locked out of an account (not Github) that I now can't recover without providing photo ID and god knows what other data, because something about their implementation changed and now my security key is no longer accepted.

Most of the few sites that accept security keys also only let you register one, which means you can't have a backup.

As I understand Passkeys "solve" this by effectively being backed up to your Google or Apple account, so once that's compromised, you've lost.

As long as you're using a password manager (which will not autofill on phishing sites), passwords still seem like the way to go, unfortunately...

dwaite6• 3 years ago

As I understand Passkeys "solve" this by effectively being backed up to your Google or Apple account, so once that's compromised, you've lost.

Lowercase p, like passwords

As long as you're using a password manager (which will not autofill on phishing sites), passwords still seem like the way to go, unfortunately...

Many password managers have rolled out passkey support; iOS 17 and Android 14(?) have support for third party passkey providers at the OS level, while some of these managers inject support directly into the browser via a web extension.

ryanisnan• 3 years ago

Thank you for the correction. I have been referring to them as Passkeys.

Passkeys are generally available

Related Stories