Passkey marketing is lying to you (it's actually really simple)

https://www.smokingonabike.com/2025/01/04/passkey-marketing-is-lying-to-you/

by coldpie • 2 years ago

26 24 2 years ago

I don’t know what a “relying party” is, so I’m not sure exactly what this threat entails

A relying party is basically just "the website that you're trying to log in to".

but this statement really puts the Passkey spec authors in a bad light. It should not be possible to block me from logging into a service because they don’t like the password manager I use. Between the fact that the spec author sees this capability as a good thing and the Big Tech-focused marketing, this really makes me think that the Passkey spec authors do not have users’ best interests in mind. They clearly think using this technology to lock users into Big Tech ecosystems is a feature, and other uses are an annoyance that they have to grudgingly support.

Indeed. That (anti)feature is called attestation, and it really does exist for the sole purpose of letting websites lock users into Big Tech ecosystems.

toomuchtodo6• 2 years ago

Power users will always detest certain aspects of higher levels of digital identity assurance. Regardless, some use cases call for those assurances (that your passkey is you, especially as it relates to privileged actions).

As long as you can always create a new passkey on a new device (through some identity proofing or assurance process), the risk is minimal that you're locked into an ecosystem.

josephcsible3• 2 years ago

How is that "identity assurance"? All attestation proves is, e.g., that the passkey is stored on an iPhone, not that it's stored on your iPhone.

coldpie8• 2 years ago

A website could use this feature to require that I only log in using (say) Google or Microsoft or Apple's implementations, right? Under those conditions, how could I log in using my Linux desktop?

coldpie8• 2 years ago

Oof, I found a whole ton of anti-open-source-software quotes on the related Github issue https://github.com/keepassxreboot/keepassxc/issues/10406 :

When required, the authenticator must perform user verification (PIN, biometric, or some other unlock mechanism). If this is not possible, the authenticator should not handle the request.
[A passkey provider certification process] is currently being defined and is almost complete.
This implementation is not spec compliant and has the potential to be blocked by relying parties.
Then you should require its use when passkeys are enabled ... [You may be blocked because] you have a passkey provider that is known to not be spec compliant.
I suspect we'll see [biometrics] required by regulation in some geo-regions.
I see a lot of misinformation and incorrect guesses about the intentions of various parties in the recent threads. If it would be helpful, I'm willing to have a [private, non-public] call with interested parties to try and answer some of the questions that have been raised to ensure we have a common technical understanding of FIDO/WebAuthn.

I felt reasonably positive about Passkeys while writing this blog post, but continuing to read the spec authors' insistence that only Big Tech may handle these problems is extremely worrying. I really want to like this feature, but the authors are acting like complete jerks and driving me away.

I'm going to update the blog post, or maybe even delete it. Attestation is a complete deal-killer for this tech.

lapcat2• 2 years ago

I'm going to update the blog post, or maybe even delete it.

Please don't delete the blog post! I think it's important for us to have these conversations.

sowbug• 2 years ago

That (anti)feature is called attestation, and it really does exist for the sole purpose of letting websites lock users into Big Tech ecosystems.

The FIDO spec for security keys supports attestation as well. It makes sense; an enterprise might want to limit employee authentication to specific hardware that it has vetted, or another company might have determined that the supply chain for a specific brand or model of security key wasn't hardened enough for their threat model.

You, as an individual, might not want the relying party to be able to use this information when deciding whether to authenticate you. But authentication is a dialogue, not a monologue.

Attestation might allow the lock-in you fear, but that's absolutely not its primary purpose.

nabla9• 2 years ago

Passkeys are a public/private keypair authentication system. That’s it.
Ignore all the lock screen and biometric stuff that the marketing is screaming at you. You can generate Passkeys on your computer just like we’ve been doing with SSH keypairs for decades. You can store those keys however you like, so long as you have a way to feed them into your web browser to provide to the service at login-time. You can copy your Passkeys around as much as you like, to any device you like. You can share them with friends.

lapcat2• 2 years ago

You can store those keys however you like, so long as you have a way to feed them into your web browser to provide to the service at login-time.

There's the rub. Unfortunately, KeePassXC doesn't have a Safari extension, for example, and I don't want to use iCloud Keychain. All I ever wanted was this:

if you’re willing to manage your private keys manually by copying your keystore around, then there’s no need to use the Big Tech Cloud Service Magic stuff.

I can currently accomplish this with passwords but not with passkeys.

I predict that commenters are going to say, "you shouldn't use Apple devices then, duh", but you can't just look at the downsides in isolation without also looking at the many upsides of Apple tech, at least for me. There are always tradeoffs, no perfect technology, especially in a duopolistic market.

vayup• 2 years ago

The premise that this is a new drawback introduced by passkeys is false. If a relying party wants to lock you into big tech ecosystem for authentication, they can do that today by only supporting SSO from them. They don't need to wait until passkeys come about.

zamadatix• 2 years ago

The relying party usually doesn't care about big tech, they just want to put the easiest method in front of the user. Passkeys mays don't need to be the original invention of lock in to be used in a way as to cause more of it.

coldpie8• 2 years ago

The people behind SSO efforts or whatever aren't going around to open source projects and threatening them with their users being blocked if they don't implement anti-user features. The people behind Passkeys are doing that. It's a really bad look.

Passkey marketing is lying to you (it's actually really simple)

Related Stories