I don't know enough to argue about whether passkeys are a trap or not, but I do know as a user that they appear to be a confusing mess.
When a website prompts me to set up a passkey, depending on the device I happen to be using at the time it could end up going to Google password manager, Samsung password manager, iCloud Keychain, or Windows somethingorother.
What happens when I go to the same site on a different platform? What if I can't use cross-device authentication because I'm on a locked-down work machine or one that simply doesn't have bluetooth? What if I want to consolidate them all in one platform just for the sake of being organised? What if I lose or simply don't have the device with a certain passkey near me?
I don't have the time or patience to work out any of that, which might absolutely be a 'me' problem, but TOTPs are pretty sodding frictionless in comparison. Scan QR in my chosen manager; type number into website; done. Why are passkeys better?
I thought "Passkeys are a trap" was going to be about this usability nightmare. Some sites, once connected via passkey, make it all but impossible to connect in another way. Some support multiple passkeys. Some do not. Some support passkey or something else. Some do not.
The idea and protocol are pretty solid, though we're back to a "biometrics as password" problem in many device flows, but every time I'm urged by a site to convert to a passkey, I wonder "is this site the sort that would screw this up?"
I can’t adopt Passkeys if I’m not certain they’re going to work as well as my password manager and Authenticator app, which is to say 100% of the time.
When sites ask to set up passkeys, it’s usually native passkeys (especially on iOS). And figuring out how to get the flow to set up a LastPass key by default seems unusually difficult.
I also use a MacBook, windows desktop, an iPhone and iPad. I use Firefox, edge, brave across these devices.
When I say “passkeys are a trap” they are a usability trap where no one can attest with certainty that I won’t wake up in a painful situation because I decided to adopt passkeys.
I think the repeated posts and articles constantly rehashing this topic is telling. Every thread is nearly the same in terms of some people saying “here are the reasons why passkeys don’t work for me” and other people saying “you’re holding it wrong”. I don’t think many people come away with their views changed.
If you need a tutorial for something that’s supposed to be as simple and transparent as a website authentication, your standard has already failed the usability test.
This isn't a standards problem, this is an "Apple, Google, and Microsoft made using your own software difficult" problem. They have an interest in making their authenticators the default, and the settings UX on all three platforms makes it unclear that their authenticator is active as well as your own "third-party" authenticator choice.
My takeway from “Passkeys are a trap” is that there are like four different approaches to something that everyone just calls “passkeys”, and they are not the same. For example, some are portable and some are not.
> Some sites, once connected via passkey, make it all but impossible to connect in another way.
That's the issue I had with Okta a few years back. I used a password then later added a passkey through Bitwarden on my work laptop. Bitwarden hadn't yet implemented passkeys for mobile.
I went to authenticate through Okta on my work phone. It prompted me for the passkey. Since mobile passkeys didn't exist, I got stonewalled. I had to make a blood sacrifice just to get Okta to allow password access again.
Same. I don't understand it, and there is enough conflicting information (See this article pair as an example) that I suspect it's not something where I just need to do more reading. I suspect there's something fundamentally confusing, and subjectively-interpretable about this.
My suspicion: There is a significant chance I will lose access to one or more account by doing this, so I'm not going to until the air clears. I don't trust the motivations of the services pushing it.
This may or may not help depending on how technical you are, but at the core a passkey works through public key cryptography, like SSH keys work. Setting up a passkey with a site involves sending a public key to the site, which they store as being owned by your account. Then, to sign in, they use your public key to generate a challenge, you use your private key to solve the challenge, and you respond proving you have the corresponding private key.
This means you never send your private key to the site, so if their database is compromised they only get a public key, which can’t do anything (it is public, after all)
No amount of phishing can get you or your client to hand over your private key, because there is no use case where that is required. There is no possibility of MITM, since your private key is never sent anywhere in any situation.
As for getting locked out of your account, losing your passkey would be the same as losing a password. You would need to follow the site’s password reset flow, and if you can recover from a lost password, you can recover from a lost passkey.
This is a fantastic explanation and analogy. Thank you!
I will poke at this a bit:
> As for getting locked out of your account, losing your passkey would be the same as losing a password. You would need to follow the site’s password reset flow, and if you can recover from a lost password, you can recover from a lost passkey.
Do you think this is one of those scenarios that sounds reasonable at first, but can get torn apart by unknowns, edge cases etc? To use an analogy from a recent HN thread that is stretched a bit, is this like saying "If you use a crypto hardware wallet, you're safe", then reading about compromised hardware wallets due to something outside the assumption set.
It doesn't help that the primary benefit we get from passkeys, in exchange for a lot of pain and fragility, is that phishing is harder to pull off. That's a big deal for a lot of people, but frankly, I'm not one of them. I already know not to click on links in emails.
I've never fallen for a phishing attack and any attack targeted and sophisticated enough to catch me is probably going to be sophisticated enough to steal/hijack a passkey anyway. In the extremely improbable event that I did get phished and somebody got into my account somewhere, they'd only have access to that one account because unlike most people I don't re-use passwords and recovery would no more complicated than contacting customer service and resetting my password with them.
Considering the horror stories of people who been screwed by using passkeys, I'm sticking with "not worth the trouble"
Randomly generated strong passwords for all practical purposes are just as good as passkeys and keep you as the user in control. If you really need to copy/paste between a laptop and mobile or give it to a friend/family member, you can.
What do passkeys offer users that rand strong password + password managers don't?
They are tied to the issuing domain and the system that carries the passkey will refuse to present it to any other domains. It’s more or less impossible to fall for phishing or a spoofed site. Your password manager may have similar functionality for automatic filling of forms but less sophisticated users can often be tricked into providing passwords via copy and paste.
The less sophisticated users can use their passkeys then, and the rest of us who know what we’re doing and have been for 25 years can continue to not support vendor and platform lock-in and forced device attestation. The amount of marketing and push behind passkeys does not feel entirely genuine to me.
Phishing is even easier. Instead of "open your password manager, copy your password and paste it here" it becomes "your passkey is out of date, click here to enroll a new passkey. As part of this process a reset link will be sent to your email and code to your phone. Do not share the code with anyone."
---------
Oct 14 - 12:30pm...
---------
There is a wall of text below your question and _none coherently, concisely answer your question: "What do passkeys offer users that rand strong password + password managers don't?"
They have to be transmitted. They (or their hash) have to be stored. And so so many get that wrong.
There is nothing to prevent you from entering your super secure u quiet password on the wrong site if you get phished.
Passkeys don’t get transmitted. They’re used for cryptographic signing.
Passkeys can’t be entered on the wrong site, the sites they work on is an inherent property of the key.
You can’t store a passkey wrong on the server, it’s a unique public key. If your entire database is stolen, it’s useless. No one else can login with your credentials because they don’t have the private key.
Unique strong passwords, TOTP, 2FA, one time sign in emails, none of those offer this stuff.
Passwords are fundamentally broken. They cannot be fixed. Cryptography is the solution in passkeys are the implementation.
Everyone knows to hash passwords now and browsers basically enforce SSL. This is not a practical differentiator.
>Passkeys can’t be entered on the wrong site, the sites they work on is an inherent property of the key.
They are still susceptible to malicious enrollment. If a user is convinced a fake site is real, to the point that they are opening their password manager to copy the password to it, you should assume they will do the equivalent with a passkey (re-enroll attacker's key or register attacker's passkey).
>If your entire database is stolen, it’s useless.
As are databases containing strong randomly generated password hashes. What is your threat model here, they somehow forgot to hash their passwords yet they are still hashing session tokens, storing customer data in completely separate databases, safely storing private keys, etc.? It requires quite the strawman scenario to apply.
> They are still susceptible to malicious enrollment. If a user is convinced a fake site is real, to the point that they are opening their password manager to copy the password to it, you should assume they will do the equivalent with a passkey (re-enroll attacker's key or register attacker's passkey).
This is only technically true because of the definition of what a passkey is is vague.
Hardware Attestation solves this problem and is "good actually". The issue with attestation is when site attempt to restrict which enclaves/sources can register keys. But if you don't restrict who/what can register keys, attestation is super useful for preventing this exact issue.
When you register your key initially you establish your hardware attestation parameters. The attacker cannot know those parameters unless they were the ones to initially register you for the site as the public attestation signature is unique per-key and the private one per-use with the public one verifying the private one.
So if you have remote attestation you can verify whether the source presenting the signature for auth is the same source that created the signature and trivially block MITM attacks. Likewise for more complicated custody/proxy chains.
This just by itself largely solves MITM key re-enrollment attacks but tech camps that support passkeys either ideologically oppose attestation (due to understandable enclosure fears) or enforce hardware attestation for enclosure purposes without bothering to address MITM/signature origin checks.
Can I do hardware attestation across several devices yet? My desktop, my phone, a console, my girlfriends phone of a different brand if I need to log into a shared account, etc?
It seems like one of those things that only works if you're sticking to one ecosystem.
Only in theory. Suppose you are a bank, which enclaves/sources/devices do you support vs. not support? What do you do for users on a desktop PC that don't have an enclave? Phishing sites will likely leverage your weakest enrollment option.
You're arguing theory and not practice. In theory they're better of course. The problem is the implementation. And implementation is a mess because everyone is trying to lock you into their own little ecosystem.
Exactly! Whereas passwords are extremely flexible and can be stored, managed, and written down in numerous ways that are vendor-independent. Want to store your passwords on sticky notes in a safe? Go ahead! Want to use Bitwarden? Yep, you can. KeePass for offline storage? Yes! With good password hygiene (128-bit entropy, never reusing passwords) there is virtually no risk, especially with 2FA added.
> There is nothing to prevent you from entering your super secure u quiet password on the wrong site if you get phished.
You replied to someone talking about password managers, which objectively do exactly that.
> Unique strong passwords, TOTP, 2FA, one time sign in emails, none of those offer this stuff.
And Passkeys don't offer portability, user choice, or user control.
Cryptography may be a solution, passkeys are one technical implementation that at is core is designed around smartphone-first, vendor-first, brand-loyality-first thinking.
password managers do not do that. open up your password manager, press "copy" on the password, and then paste it into a random website. it will paste it.
(i think 1password just recently enabled an option that will warn you if the website is different than the one it has, but it still lets you paste it)
It is Schrodinger's Bob - Both technically literate enough to know how to do that, while also not being technically literate enough to spot the phish or determine why autofill isn't working/the password manager isn't matching.
This is where Passkeys shine, in an edge-case user that is neither of the two most common user types. Basically a unicorn situation.
>It is Schrodinger's Bob - Both technically literate enough to know how to do that, while also not being technically literate enough to spot the phish or determine why autofill isn't working/the password manager isn't matching.
you must not work in regular corporate environments. this happens all the time.
yes, they know how to hit the big "copy" button but don't know how to debug an extension.
take a year or two to work security (or general IT support) in a non-tech-company corporate environment, and get ready to have your socks blown off. people become exceptionally literate with things they interact with all day (excel is great example of this) yet have no idea that google.example.com isn't an official google website.
Passkeys can be, and have been, stolen and hijacked. They make it more difficult for scammers and hackers to get into your accounts, but not impossible. How many phishing emails have you personally fallen for that this is your #1 concern over the fragility and complexity of passkeys?
Typically the user gives a website their public passkey, which does not need to be kept secret since it’s public. If the website is hacked the attackers only get information that is already public.
You seem to be talking about a scenario where a user’s private keychain on their computer is compromised and the attacker is able to access other systems from that same machine without the user’s knowledge. (Note that the keychain data is itself encrypted so can’t be used from a different computer.)
Nothing of this explains anything, at best it increases the confusion. If anything, all this mumbo jumbo pushes me further away from using passkeys than before.
That's not accurate. If that were true, then a hacker stealing password hashes would
enable them to instantly log in, without cracking them. Rainbow tables and dictionary attacks exist for a reason.
Pass-the-hash has been tried in NTLMv1 and thankfully that was the end of that failed experiment.
Modern password authentication is performed by the client sending a plaintext password encapsulated within a symmetrically-encrypted tunnel. On the Web that's with TLS. The server then uses bcrypt or another scheme to hash the password (along with the stored salt) and compared that resulting hash with the value in the table.
Sure, you could MITM still if all you do is that, as with anything it depends on what you are defending against.
If you are defending against clear text being discoverable, then bcrypt hashing with a unique salt on the client is good enough.
If you are trying to prevent MITM you can combine that salting with public/private key transmission of the bcrypt hash to the backend (effectively the same idea as pass keys without the downsides).
MITM just affects your service, and doesn't always matter depending on what the service is, for example, a recipe manager doesn't need to have bullet proof security.
As the hash is being encrypted with the public key in the client, that would require that the client be compromised. In which case the original password is already exposed at that point, thus a discussion of the transport is no longer the concern.
> Whenever I've written authentication, passwords are hashed on the client side and never transmitted in the clear.
While rare, a couple of sites which has many (>1000) users have sent me my password in the plain when I told I forgot them.
Many sites have e-mailed my password in the open when I registered, as well.
I don't defend passkeys here, but too many weak links are present in password based flows today. If someone uses per-site strong passwords, one can contain the leaks, but use the password even once, and the problem grows exponentially.
But the sites where I actually care if my account gets compromised - Steam, FastMail, DigitalOcean etc. - are very unlikely to screw up password storage.
I'm never going to bother with paranoid security inconveniences for the crappy website my local pizza place uses.
As I understand it, in theory, there is no "secret" exchange over the network with passkeys, once they are initially set up (one side sends a challenge to decrypt, and the challenge is one-time use. The decryption all happens locally.) And so they aren't as vulnerable to phishing or other common ways to steal passwords (such as key loggers, which don't even involve the network.)
But in my opinion, the solutions that passkeys provide come with the costs that are being discussed here, and I haven't found the trade-off worthwhile.
Definitely not wrong here. It is a confusing mess for most people. Thankfully, for folks all in on the Apple ecosystem, it should be pretty decent of an experience. Everyone else? not so much.
I think this is exactly the "Passkeys are a trap" argument though right? If you lock yourself into a single vendor, everything is easy and beautiful. If you choose a diverse set of vendors, it sucks so much more than passwords and password managers ever did.
Which changed to KeepassXC looking to support the standarization work to allow passkeys to be moved between user-controlled software products.
The complaint wasn't in allowing credentials to move (that is the point of the CXF and CXP work). The complaint was in having sensitive data in a plaintext file live long-term without any protections. That is also why one of Tim's early recommendations was to require encrypting the file via a passphrase.
This is not accurate. The very first sentence of that issue is:
> Passkeys should never be allowed to be exported in clear text.
and from another comment by the issue creator:
> I don't quite understand why requiring file protection/encryption can't be a temporary minimum bar here.
They're arguing for storing them in encrypted form. That's very much a different argument than arguing against exporting. I'm not taking any sides here, I just think it's bad to so badly misrepresent people's standpoints.
Asking that services require you to encrypt your backup file by default to protect against local malware or malicious access is certainly not "The people behind passkeys do not like...allowing you to export your passkeys".
Well, KeePass is self-hosted, and I hadn't heard of strongbox before, but it says on the website:
> Store your data anywhere you like, online or offline. Sync with every major cloud storage provider or your own server over WebDAV or SFTP. Use your Strongbox database with any KeePass compatible client on any platform.
Generally, if you want to restrict the user to use a particular authenticator, you need to own that authenticator. At that point you can have the attestation you are looking for. If you want Yubikey policy and behavior, you're gonna have to get your user a Yubikey.
The passkey provider vendors are motivated to serve their customer's needs (the end users, and secondarily enterprise deployments) over non-customer needs.
So Apple platform support (for example) will only send an attestation when one is configured via MDM. Your provisioned work device can indicate to work systems that it is in policy.
The compatibility-limiting risk, if it exists, is more likely from regulators putting their hands on the scale and pushing for security policies that would prevent synchronization and backup, and requiring attestations to make sure those policies are in effect.
I'm not saying it's impossible, I'm saying there's a barrier that's useful to further vendor lock in. My mom is going to use Apple passwords on her iPhone. When she needs a new phone, the complexity of import/export and fear of losing access to her accounts is going to push her to buying another iPhone. It's just another avenue of lock in, like existing OS level password managers, just with an extra level of confusion for the end user.
Mostly, though, it is not true lock-in, as in they mostly don't force you to do things their way. They encourage it, make the features pretty seamless to use, etc, so that you want to stay in their system, but they generally permit you to use whatever tools you want.
The fact that the password manager someone might use on another system is a complete piece of crap does not mean passkeys are an Apple lock-in attempt.
There are an open standard. You just have terrible software.
My issue isn't with the standard, but if all implementations lead to the same shitty experience of 3 different apps begging to store and use my passkeys, then something isn't working right. In my case, the terrible software is Apple's Mac OS, Google's Chrome and/or Firefox, and sometimes Bitwarden still acting weird. Lets not even get into how wild Windows acts when a passkey shows up.
Saying it's an open standard, and that it's just all the major players I'm forced to interact with that make it suck isn't very helpful. That's like the people that say "Don't like iOS? Build your own successful mobile OS lol"
As the previous article says, some passkeys are open, while others require lock-in, and megacorporations deliberately create confusion between the two.
As a Bitwarden (and Vaultwarden) user on Mac/iOS/Safari, Linux/Firefox and Android I have had zero issues with passkeys since I started using them a few years ago.
The first two accounts I switched over to passkeys were my Nintendo and Playstation Accounts as it made sign-in much smoother.
I now use passkeys pretty much everywhere I have the option (at least on high value accounts such as Amazon) and I have not once had an issue. Not having to use a TOTP (or worse an SMS or email based one use code/link!) is much nicer in my personal opinion.
Some sites have a much better designed on-boarding process than others I 100% agree there. I find the sites that do a poor job with their passkey enrolment are the same sites that also did a terrible job of 2FA/MFA setup as well though.
One blessing with passkeys is since I set it up for my mother with her Amazon account she has not once had to ask me to help me reset her password. At least once every 6 months I would have to help her sort things our as she would forget it, reset it and then forget what she reset it to and can't reset it again as she hadn't clicked to update the password in her password manager so it had an old or incorrect password, etc. Always a pain to sort out. Not happened once since switching her to a passkey which is wonderful for me.
Also it is essentially impossible for her to use the passkey on a fake site. Multiple times she has fallen for phishing emails with realistic looking site logins and she would just blindly enter her username and password as many elderly people do.
Both of my systems are apple, one has a Work Apple account and one has a Home apple account. How do I log into website X with 1 identity WITH FIREFOX? (people are going to jump through hoops when they find out my work laptop blocks mozilla services when I can just use a TOTP token on my phone and everything works.)
Step away from HN, and there are probably a lot of people who only use their phone to access the Internet. Smartphone brand loyalty seems to be strong, too.
Same here. My only nitpick is that I have to carefully go through the various machines and browsers, etc, and ensure that only 1Password is ever consulted for password storage.
I was under the impression that most credential managers won't allow you to export a passkey to a plain text format, but will only allow limited app-to-app transfer of keys (with a limited selection of compatible apps only)
That still requires recreating every passkey, even if both can exist at once. If I want 50 sites to use a passkey on macOS and Linux, I need to go through the setup process 100 times, and all 50 sites will likely handle it slightly differently.
It also requires foresight if switching. I ran into this with 2FA as well. When I got a new phone, after setup it offered to wipe the old one, I declined. When I went to open my 2FA app for work on the new phone, it needed to be setup. I needed the 2FA on my old phone to login to the portal and setup the new phone. Had I wiped my old phone when prompted, I would have been locked out and on the phone with the help desk. This same scenario can happen with Passkeys.
Anything that randomly makes a Windows 8-style popup offer to keep my login credentials safe makes me want to run farrrrr away.
The vibe of the original criticism, even with its technical flaws was this: are passkeys - as a standard, and a user interface - vulnerable to corporate capture? I think passkey defenders are focusing far more on the theoretical technical superiority, and ignoring how instinctively alarming the average implementation is.
We face a lot a lot of attempts to capture our data, and passkey feels like a new frontier.
For me, I know exactly where I am with my password manager & TOTP. I think the current confusing interface of passkeys will make me less secure rather than more, so I've not invested the time to think about how to use them.
Agreed. They put someone else between you and your access, between you and your security.
Lets give the guys at the Home Depot all the keys to our super secure house locks. Any time you want to get in, just roll down to one of 5 convenient locations, authenticate with the HD, and they will issue you a one time entrance pass to the house. Easy.
So far, I've had a hard time setting up an iCloud passkey on desktop Windows. Windows Hello keeps intercepting most attempts at a passkey, and 1Password will usually step in otherwise. The UX around it continues to be baffling to me.
At least there's a dedicated migration protocol for passkeys, but I'm not super stoked about how basic Apple's password management is, and how few fields there are for each profile.
But I also feel like it's time to retire my YubiKeys ...
You act as if the experience on Windows is the point of Apple's password manager. I'm not surprised the experience is pretty bad -- as far as I can tell, accessing the passwords and notes is pretty much the only thing you can really do on Windows, and the user experience is significantly impaired compared to Apple devices.
(For example, it only stores the passwords in memory and never persists them locally in any form, because there's no way to secure that, so it has to redownload them from scratch every time you open the app. It also only supports proper Windows Hello PINs rather than normal account passwords, because that's the only way to get proper hardware backed cryptography locked behind authentication, etc. It's a mess)
This, I've been an engineer for 25 years and I hate passkeys. I have a work laptop and a home laptop and I connect to some websites from both and I... it's just a mess.
Passkeys only make sense if multiple passkeys are supported. What if I lose my Fido key? One issue here is that passkeys don’t have a clear role. If they are replacing passwords, only, then they are 100% an improvement even when not hardware backed, but you still need 2fa. If they are hardware backed, you probably don’t need a second factor and different sites see different roles. Assuming I can setup a backup key, hardware backed covers all of sites’ misconceptions, though.
It moves the attack surface to password managers, which is arguably a better situation than phishing. I'm skeptical that the war is over, though. I have no proof to back this up as phishing is the low-hanging fruit today, so the numbers 'largely' back you up. I personally include device compromise in my threat model and I'll concede that may be overdoing it for the average person.
Also consider the case where you use Google password manager and your Google account gets locked for any (or no) reason. It's unclear whether you can even still use your passkeys, much less migrate them away.
> When a website prompts me to set up a passkey, depending on the device I happen to be using at the time it could end up going to Google password manager, Samsung password manager, iCloud Keychain, or Windows somethingorother.
This is the same problem we've had for 20 years with password managers, though.
The solutions are mostly the same as well (with the change to a QR + BLE based mechanism over manual transcription to go cross-device, and a protocol to support moving passwords and passkeys over to different software rather than using a plaintext password CSV export).
Many password managers also manage passkeys (and were managing TOTP before).
Passkeys provide perfect protection from phishing attacks, since it's impossible to send a passkey to the wrong domain. That's a huge improvement over TOTP.
Re: it being confusing where they're stored, I agree. The solution is to make sure you store your passkeys in your cross-platform password manager. The experience can be confusing though. In Chrome I've found that by default when creating a new Passkey Chrome offers to store it first. But if I click cancel, I'm then given the option to store it in 1Password where I want it.
TOTPs are already not that great in my opinion. It's like democracy: the least bad option. It's a decent trade-off between convenience and security, so I'll stick to unless there are good reasons not to. Passkeys have managed to make that experience worse, with a very large potential gotcha in the future, while not introducing any improved security I see why I should care about.
Yeah, there needs to be a way to link password managers to share passkeys, and also to share passkeys between people. There are also a lot of great features that could be implemented with passkey sharing too, like revocation, time limits, or capability limits.
Adding the kind of sharing it sounds like you are describing would just shift the attacks to that new attack surface. The attackers would basically try to trigger and intercept those shares.
If machines, browsers, phones etc are set up properly (yes, I know, big ask, especially with the confusion surrounding this, so I acknowledge the caveat), then the vast majority of passkey requests will go right into the preferred method (i.e. 1Password, Bitwarden, even Apple, browser of choice, etc). And most of those now will allow that passkey then to be used on a different device if signed in and synced.
I have found it to work pretty well with a password manager. I would suspect OS level passkeys would be much less "portable", especially across different manufacturer devices, like Mac/Windows, or even Windows/Android, etc. Which is why I waited to start using passkeys until I could use a password manager to store them, and I turned off all other passkey storages (same as I did for password storage before).
Obviously any new feature in a password manager is a new attack surface. That doesn't mean we should never add new features to password managers.
If we don't add decent sharing to passkeys then people will continue to use passwords, which is worse for security than adding a sharing feature for passkeys.
I don't think I have seen a case where using a passkey stops me from using my password on another device/platform that doesn't have access to the passkey.
Maybe, but ultimately a website/service wants active users, and making it too hard to log in from different platforms or reset your auth and get back in is not going to get them more users or better user retention.
It's not even clear what happens with Google Password Manager. It might go into your Google account or your local device. I somehow ended up with a mix of both.
TOTP is phishable. The push to get away from TOTP is driven by phishing.
I've done authentication projects for financial institutions that were actively targeted by phishing attacks, and it is difficult to mitigate TOTP phishing. Defeating TOTP is very much in the standard playbook for high-dollar scam operations.
Every time I've used a passkey with a site was in addition to the regular user password. So like a cached auth saved in the phone secure storage, protected by my PIN/fingerpring.
If it gets lost for whatever reason, I don't care, I will login again with regular username/password.
So as long as you also have a regular username/password login, phone passkeys are great time savers.
Security matters, users who want choice have to take responsibility, users that don't can just use Apple.
"What happens when I go to the same site on a different platform?" = "If you meant device, then Chrome has a feature to allow you to use a different device such as a NFC YubiKey"
"What if I can't use cross-device authentication because I'm on a locked-down work machine or one that simply doesn't have bluetooth?" = "Good, Passkeys are doing their job correctly and you cannot export credentials"
"What if I want to consolidate them all in one platform just for the sake of being organised?" = "Then log in and add more passkeys to things rather than copy-pasting passwords everywhere"
"What if I lose or simply don't have the device with a certain passkey near me?" = "You should have multiple passkey's or use the various cloud versions that exist"
That it’s possible to know the answers to these questions doesn’t mean the system is good. This is a level of complexity that most people simply do not have the time or bandwidth for.
>>users who want choice have to take responsibility, users that don't can just use Apple
I'm perfectly happy to take responsibility — when using a well-designed system that isn't a massive pain-in-the-arse up front designed for vendor lock-in and to penalize small vendors.
Criticizing the new system isn't avoidance of responsibility, it is demanding a product that is worth using, i.e., NOT designed for the manufacturers to extract more money from us without providing more value or locking in their market position, but designed to be actually useful to the people who will actually use it.
"...if attestation is the thing you're worried about, the post's own recommendation pushes you towards attestation rather than away from it!"
It is plainly obvious that the worry isn't attestation per se, it's the restrictions that attestation may in the future require when they turn the dial on restrictiveness up, that was extremely clear to me from reading the first article. If you can get attestation without those restrictions, "sure, why not", and a Yubikey seems like a way to do that which could avoid those restrictions. Most of this article makes sense, but this particular line makes me wonder how the author got it so far off the mark.
They also did nothing to quell my fears that they will in the future use passkeys to prevent people from using software they can modify themselves by saying "...the guidance for consumer sites has been to not even request attestation for years now." as if everyone always followed the guidance, and as if there aren't tens of thousands of managers that think their case is special and they really do need the extra control because they're a bank or handle copyrighted content or have PII or PCI and feel extra risk-averse today.
I don't know if they failed to do so because they can't (and this is a valid fear of the original author) or if they just are bad at reading the room at what the concern is and vastly overestimate how much people trust companies to always have their best interests at heart.
What I am getting from this, though, is "If you authenticate with a yubikey then that's attested, so they can't use attestation through passkeys to make sure your OS and browser aren't modified", and I'm not sure if that's the correct take away or even a correct statement.
> If you can get attestation without those restrictions, "sure, why not", and a Yubikey seems like a way to do that which could avoid those restrictions.
Remote attestation is never to your advantage. To do it at all, they have to restrict you to a specific set of device manufacturers and yours may not be on the list.
Then, what does it get you? Google-approved Android phones are allowed, but any attacker can trivially get one of those so knowing it's that type of device is completely worthless. All it does is prevent you from using some other type of device.
Notice that this is different from keeping the key in a HSM, which you can do without remote attestation and without the other side having to do anything at all.
Worse, the "approved" devices often have worse security than the one you want to use, e.g. using a Yubikey as your HSM will generally be better than using a phone which has orders of magnitude more attack surface and is constantly connected to the internet, but the phone is way more likely to be on the approved list than the Yubikey.
Attestation is to your advantage if your phone gets rooted/hacked (evil maid attack). It will let you know that something is wrong when you try to login into an attested site.
the reality is that evil maid attacks, and more broadly (and realistically) physical access attacks are exceedingly rare. The vast majority of stolen credentials are phished or some other social-engineering trick, not James Bond sneaking in with his badusb.
Then you just entered your unlock code / password into the compromised device which immediately transmits it to the attacker who has your real device.
On top of that, secure boot doesn't require remote attestation. If your device doesn't like the new configuration then it doesn't release the key. The site has nothing to do with that except insofar as you need the key to sign into it. Your device manufacturer's key doesn't have to sign anything, all your device has to do is not give up your key unless the device is in the configuration you specified. And if it will do that then it would also sign an attestation to the same effect, so remote attestation still provides you with no advantage whatsoever.
Yeah this article is confusing for me. The one a few days ago was basically saying "this is a slippery slope", which the post today acknowledges, then goes on to say "These passkeys don't give websites an attestation statement at all, and though a site can ask, what comes back is none" as though it invalidates the post a few days ago.
The whole point is that once everyone is accustomed to passkeys, they ARE going to ratchet it up to "you need attestation".
This is the browser wars all over again. Google spent something like 20 years winning the browser wars, and once they felt snug and secure, slowly started eroding users' abilities to control the content they see (making features adblock relies on increasingly ineffective).
At the same time the current authentication horseshit of the internet in 2026 is awful. I routinely spend 3+ minutes trying to log into a site - first it blocks logins because of my VPN, then it requires a password reset, then it requires me to login with new password, but then it needs email verification, but then I don't get the email so I have to click resend, then I type in the verification and then it asks for blah blah blah.
I am grateful that LLMs are going to be doing 95% of my browser usage very soon.
This blog post is the perfect example of someone rationalizing away the bigger picture.
It's true that passkeys do not require hardware and OS attestation today, so all of the specific examples you cite are true. But the point remains that that passkeys can be EASILY extended to require hardware and OS attestation, and this will happen.
Banks have already done this. Before using an app was optional. Play protect was optional. It's like my uncle ted used to say, techonolgy is not optional.
When my state introduced seatbelt laws they assured the public that they would only be a secondary offense, never the primary basis for getting pulled over and issued a ticket.
Now they run "Officers are watching! Click it or ticket!" as an advertising campaign.
And I'm not arguing that seatbelt laws are bad per se, just that any time there is a pathway for more control, it will eventually be taken, even if assurances are made that it will not happen.
I think it's more that attestation can require a specific "approved" authenticator, and that authenticator is what would enforce all of the required OS/Software/Hardware requirements, even if it didn't get included in the attestation standard.
People who are more tech libertarian don't like when critical aspects of their life requires a smart phone from either Apple or Google. The ability to avoid these companies is becoming increasingly difficult, and attestation is one piece of that puzzle.
I don't think that means throwing out passkeys entirely, but that's why you're seeing a lot of "slippery slope" stuff in here
How? It wouldn't be easy at all it would be totally unconventional and break all sorts of expected workflows for passwords if you had to take a photo every time. For example at my work we have a ton of computers and none of them have webcams.
Passwords are client-neutral. Passkeys aren't: you can force a certain client, and now those clients can force an OS through attestation.
It happens now with 2fa today. I have gone through college for 4 years having to use this shitty duo mobile app and we have to take out our smartphones 20 times a day to do things and re-login after every 20 minutes.
and your bank can't force a certain client for a password if they decide to? or that you need to drink a confirmation can? or whatever arbitrary technical constraints they want to do in general?
anything can happen. if your passkey stops working because you're using it from your smart fridge to access your banking app, then just use your password anyway.
They effectively can't to the extent that it's not a social norm to enforce that level of security theater. You are arguing in favor of normalizing an increased degree of security theater.
My point here is that this specific step on the slippery slope is a cliff, not some infintessimal change, because now the authentication is done through a program and not copyable information. If verification-can technology is standardized on an OS level and advocated by four out of five tech priests (and maybe even enshrined in law (think of the children)), then you are going to be drinking a whole lot more mountain dew in the future to say the least.
If it was just a single bank or something that tried this, people would get pissed off, leave, and the frog would not be boiled. It takes a slow industry-wide movement to shift the standards of what is acceptible to the common man.
> When it is present, WebAuthn attestation tells the site the make and model of the authenticator, identified by its AAGUID, with a certificate chain from the vendor to back it up. It says nothing about your OS, your browser, your extensions, whether your phone is rooted or jailbroken, your firmware version, or even what colour it is.
Am I missing something? "Attestation tells websites what the authenticator is but it doesn't tell the website what the authenticator is".
The entire argument in this blogpost amounts to "nobody would ever turn on passkey attestation because it would require migration of people who already setup passkeys" which is a questionable argument- you could trivially imagine allowing unattested passkeys for existing users, but require it for new users. Most websites don't yet support passkeys to begin with, so this argument doesn't hold for the majority of websites.
The "biggest providers" bit at the end is odd too because the biggest providers are apple/google- who, as far as I know, do support attestation.
I've worked at places where we use a password manager to manage lots of passwords for random services that we subscribe to. The engineering manager always says "you can put your own passwords in for free" and I say "no thanks, they're going to get hacked" and then six months later... they get hacked.
I use the password manager on my iPhone because it seems pretty secure and it is so miserable to type passwords in on a phone but my other solution for passwords has used cryptographic generation with the database playing only a secondary role and it is fine for passwords but does nothing for passkeys.
The idea of keeping my passwords in my work-sponsored password manager just sounds absurd. Who thinks that's a good idea? What happens when you leave the job?
My workplace doesn't offer this, but I like the idea of how 1Password does it. If your workplace has a business account with 1Password, each of the business users gets a personal account for free. If you change jobs you can pay for your own account, but it isn't tied to the company account other than getting it for free with the corporate account.
What I did was use usernames on those services that included a few chars to remind me which business I'd created it for. I was a software engineer bug changed jobs/contracts on average about once per year (that's a very, very rough average though).
it's work-owned or work-managed accounts that get stored in a work-sponsored password manager.
most will come with free personal accounts for employees, if they want and choose to set them up. those are separate, and have smooth offboarding for the no-longer-employee.
eh the companies account for that. for example 1password basically gives you a "free" extra personal account if you enroll into a work account. and when you leave, you just keep the personal account.
"free" because im not sure if your employer pays for it or if its like a free benefit to a bussiness licence
What you describe is a different attack surface than the much more problematic on that password managers solve well: password re-use across websites where the blast radius is super high.
If I had to trade off the risk of a password manager being hacked versus password re-use, I'm going to strongly recommend to people generally to use a password manager. Yeah there's a lots of "if this, if that"--but that's almost a universally better risk for most people.
I think this part is where TOTP's 2FA/MFA model is "safer": you do not need to trust the TOTP manager. Even if the app sends all your TOTP secret keys to the server, they cannot hack your account because your password is stored elsewhere, and TOTP code alone is useless.
Not GP, but I've seen this happen a few times with $work managed password managers. From memory and in no particular order, the reasons for the breach were:
- User account with access to the SaaS password manager was compromised.
- User account with access to the SaaS password manager was compromised.
- User account with access to the SaaS password manager was compromised.
- Password safe file (keepass) was compromised/leaked and its (medium-strength) master password was presumably brute-forced.
EDIT forgot one:
- Password manager was used by a user-facing web backend, which unlocked it with an unscoped read-everything master password. Web backend was hacked, predictable consequences ensued.
The author is really missing the forest for the trees here
> When it is present, WebAuthn attestation tells the site the make and model of the authenticator, identified by its AAGUID, with a certificate chain from the vendor to back it up. It says nothing about your OS, your browser, your extensions, whether your phone is rooted or jailbroken, your firmware version, or even what colour it is.
So if I was Netflix or a bank or w/ever I'd only allow new registrations from "trusted" authenticators, which would incidentally only run on iOS and play-protected Android.
A closed-firmware USB key is really no better option.
Dear Yubico / Kensington / Google Titan, can I export my private key components to this other device, or even print them out on paper for storage?
No - you're just an untrustworthy user granted the fleeting privilege of using BigCorp devices. Now stop asking such questions or you might have your attestation revoked.
> [Attestation] say nothing about your OS, your browser, your extensions, whether your phone is rooted or jailbroken, your firmware version, or even what colour it is.
Largely false. The Pixel verifies the OS and will reveal `verifiedBootState != Verified` on GrapheneOS in the attested passkey at registration, which websites may choose to reject. Apple Silicon has an undocumented SEP which prevents Asahi Linux from accessing it. There may be other examples now or in the future.
Also, I think you can deduce the device color from [1] on Android.
"The unfortunate piece is that your product choices can have both positive and negative impacts on the ecosystem as a whole. I've already heard rumblings that KeepassXC is likely to be featured in a few industry presentations that highlight security challenges with passkey providers, the need for functional and security certification, and the lack of identifying passkey provider attestation (which would allow RPs to block you, and something that I have previously rallied against but rethinking as of late because of these situations)."
"This implementation is not spec compliant and has the potential to be blocked by relying parties."
Proponents keep trying to hand wave away the attestation lock-in problem as some vague faraway threat that we may never encounter. It isn't. It's the actual plan.
These are very damning. Pretty straightforward about removing all software freedoms in favour of some sense of security. It really is already happening:
> I have a sneaky suspicion that some of our failures with various RP's is because they are only accepting certain authenticator GUIDs.
This comment from the KeepassXC maintainer makes me feel like the whole spec is already completely flawed if such a situation is even possible.
Do not handover your identity, or verification of it (as the current case is) to anyone else, irrespective of the benefits, including the security aspect.
---
The author has strong incentives for the success of passkeys.
1. Scott Helme is founder and CEO of Report URI, and Companies House records his ownership at over 25% and up to 50%. Report URI markets a "Passkeys Protection" offering, giving him a commercial interest in services for passkey adopters.
2. His WhyNoPasskeys.com campaign pushes websites to adopt passkeys, is sponsored by Report URI, and promotes its passkey protection services. The "Passkeys Are Not a Trap" article also carries a Report URI sponsor banner.
3. Troy Hunt, Helme’s Report URI business partner and investor, joined 1Password’s advisory board in 2020; Helme has also appeared in Hunt’s 1Password-sponsored content. That establishes an indirect vendor connection.
Virtually every authority on passkeys is going to have an industry connection. Just like how most climate change authorities receive funding to do climate research, how SEC investigators typically have backgrounds in banking, open source military analysts are veterans, etc.
It's not because people are bought by the powers that be, it's the way the world works. People enter the fields they have expertise in.
I still don't use passkeys because I don't know what advantage it has over my existing method of generating random passwords in my passport manager and using that. My password manager generally autofills it anyway.
I know where my password manager syncs, it's on all my devices. Passkey prompts always seem confusing, I don't know if it's going to save to my browser, or my OS, or if those are gonna sync on what devices. It's just more confusing.
The number one gain I see with passkeys is that they are phishing resistant. The biggest issue I've had with TOTP keys is they aren't phishing resistant.
Forcing people to use passkeys gives the authentication layer a stronger means to ensure that people are logging into the correct domain. A password manager accomplishes this, but it's very difficult to enforce. (I've heard a number of variants of "John Smith sent me an important document and when I went to open it, the password manager didn't work so I just copied password")
I’ve seen tech-savvy people getting phished into entering their password on a fraudulent site, despite the password manager blaring alarms that the login looked fishy.
This cannot happen with passkeys at all because crypto magic.
I assume a phishing site wouldn't even attempt to use the passkey because it can't. So wouldn't it just ask for a password, and at that point, if you're gonna fall for it, you'd go and grab the actual text password anyway?
My password manager matches off of domains too, so it wouldn't suggest to autofill on a phishing site.
Right. The “correct” way for a service to handle this is to disable password logins for any account that has enrolled a passkey. A few services do this, but boy howdy is it ever unfriendly to users (or at best, difficult for them to get their heads around).
Right. It didn’t suggest it but the phishing message was convincing enough that the tech-savvy person fished the password out manually and input it anyway. A mistake for sure, and one the password manager was trying to help with, for sure, but this mistake would have been impossible with a passkey.
you can have a TOTP variant which has the browser display a challenge string & QR code, authenticator generates a 5-6 digit response. include more entropy in the response if you want to do away with the password entirely.
passkeys are trash, I would never opt for dedicated hardware (or a cloud service) and using them with a password manager is extremely messy when you want the password manager to be properly isolated from the rest of your system.
Passkeys are great for developers who are into cryptography and security, and who understand the idea and implementation behind it. For the rest of us it's something to avoid.
I don't use passkeys anywhere for fear of losing access. I just don't care enough to study how it really works. With passwords, I occasionally print out all my important passwords and store them in a safe and I know there's no way I could lose access.
I think the passkey standard included attestation for good reasons, but it is obviously also possibly a trap in the sense that I'm sure there were some people on the standards committee(s) envisioning a glorious world where they can flip this on for everyone and instantly all the bad stuff stops.
I have to admit I don't worry too much about the entire internet flicking attestation=true anytime though, because the resulting support nightmare would be ferociously expensive. I wouldn't be surprised that, on its own, it would be more expensive than the cases that the companies flipping the switch are trying to avoid. Which means it isn't going to happen.
The simple truth is metaphorical-Grandma can't handle the degree of responsibility put on the user that strict hardware attestation implies. Netflix et al are more likely to want metaphorical-Grandma's money more than an incremental improvement in their ability to be sure it's an attested login, and won't want metaphorical-Grandma to call Netflix every other week trying to figure out how to log in again. There is no way around the fact that strict attestation implies more user responsibility to make sure they don't lose their token, and at scale, they absolutely will. Work environments can get away with this because work environments have a scalable mechanism to re-verify identity to the extent the business cares about it personally, and reissue tokens. At scale the big companies do not have this for individuals. You can't use hardware attestation without this infrastructure for reverification, and any infrastructure for reverification a large corporation tries to create will have exploitable holes in it.
> When it is present, WebAuthn attestation tells the site the make and model of the authenticator, identified by its AAGUID, with a certificate chain from the vendor to back it up. It says nothing about your OS, your browser, your extensions, whether your phone is rooted or jailbroken, your firmware version, or even what colour it is.
Practical experience from Austria where attestation is used to limit which hardware tokens can be used for the EU digital identity: it sucks. You're limited to a very limited number of keys: https://www.id-austria.gv.at/de/hilfe/hilfe-zu-ida/authentif...
Now: will more people do this? I don't know. But I fault the standard for enabling it in the first place.
Exactly. From the page about the requirements for the app under 1) in your link:
> System requirements
> Android 12 or iOS 16
So one of four methods is, by default, already completely dependent on having an account with $american_megacorp.
4) is another app where it doesn’t outright say, but I’m guessing the requirements are also a mainstream OS, mobile at that as well since they seem to use biometrics.
That leaves 2) dedicated hardware and 3) dedicated hardware. Great. (see the “my house burned down” article/thought experiment as to why I’m against that.)
Let us consider the average user. The one who manages to lose their iPhone and has no idea what their iCloud account login is because they were aware of having to log into it once when they created the account at phone purchase 3 years previously.
Impossible. Because iPhones randomly force you to enter your iCloud password, often at the worst possible time. Such a user would have already been prevented from signing in to their own iMessage on a random Tuesday afternoon.
One of the most frustrating issues with Apple's UX.
That person is fucked when they lose their phone anyway, because they're also the sort of person who has never backed up all their photos/contacts/iCloud files anywhere that doesn't require iCloud auth to get at. At some point we have to either properly educate people on the fact that they need to have a recovery path, or we have to accept that they're going to need to rebuild their entire digital life every 2-3 years.
This is your cue to go get your parents to add you as recovery contacts for their Apple account now, rather than finding out that exists when they lose their phone.
What I'd like to understand is why the majority of sites that allegedly supoprt passkeys do not let me store them on Yubikey hardware but instead are pushing into "cloud" passkeys. That's what is triggering my spidey sense about the whole scheme. If they are so great all around and vendor neutral why is everyone pushing me to store my keys in some "cloud" password manager? If I'm going to the trouble of setting up passkeys I want to be in control of them across all my accounts. That means my own hardware dongle. Not some cloud vendor's pinky swear that they'll take care of them and let me use them on my terms.
I have seen an exception to this with Microsoft Entra. I was not able to store and use the passkey in my password manager of choice, I had to save it in Microsoft Authenticator. I haven't tried again lately since that was for a previous job, and I didn't look into the underlying reason it failed, whether it was attestation of some sort or something else about how they set it up.
I'm generally pro-passkeys, but also acknowledge they are a hot mess for the average non-techy consumer. And there does seem to be room for the screws to tighten, and we definitely need to resist that.
Every point in that post has been discussed at length other places, some of which is in the HN thread the author mentions. And the discussions make it clear that the points being made are not seeing the problem - not that there isn't a problem.
Passkeys have benefits - but they also have problems. Many people just don't think the benefits are worth the problems. And many people are afraid that sites will just stop accepting passwords in favor of passkeys, leaving people worse off.
Last time I tried using Firefox on Linux with Keepass's passkey implementation it worked on the test page and a couple other sites but Facebook refused to add it, so I definitely believe that e.g. banks and various other important sites won't balk at restricting passkeys to Android, iOS/MacOS, and Windows. I am curious what other people's practical experience is with these kinds of sites.
I've set up a few passkeys to see what it's like and the experience is wildly different between sites.
State Farm is the only place I've actually liked it. I don't have to type ANYTHING in.
Open browser, open password manager, click the "sign in with existing passkey", browser and password manager talk, prompt me to confirm the passkey choice, and I'm in.
Most sites I've messed with insist on you entering a username first.
Some context I think is missing: TFA's author claims to use passkeys for 2FA (and so, not as a password replacement as I think is often implicitly assumed in discussion):
> This one can be tricky because I've seen many sites using passkeys to replace passwords, but that's not something we've done on Report URI, passkeys are used as a 2FA mechanism.
Look, at best, Passkeys shift your logins from your head to OS-supplied keychain management. Whether they do attestation today or not, they big, industry-wide effort to move away from "what you know" (i.e. username/password) + "what you have" (2FA) towards "platform-authenticates-you-to-website automatically" has both security benefits and lock-in risks.
Maybe it was too strong to say the were a "trap", but it is also too strong to say there is no worries here.
TFA's author has also explicitly precluded the "platform-authenticates-you-to-website automatically" workflow, in a separate blog post [0]:
> This one can be tricky because I've seen many sites using passkeys to replace passwords, but that's not something we've done on Report URI, passkeys are used as a 2FA mechanism.
Well, they can (and likely will be) used in both modes. Either these things are just a different way of generating a password for a password manager (itself a big target of attacks), or they are a way "to move beyond password with TPM-level security". If it's the former, the security benefits are limited. If it's the latter, the "it's a trap" logic applies at least in part.
> Well, they can (and likely will be) used in both modes.
I agree - and that makes me wish that the messaging was more clear from passkey supporters. Some may be genuinely confused and talking about one or the other mode (or not even realize that multiple modes exist), and some may be trying to claim the benefits of one mode while/or handwaving away the tradeoffs of the other mode.
It's notable that several of the claims on that page conflict with the other info in both the OP article and the follow-on.
As for choice as the user, it's a choice "for now"... and only for users who understand all of these details (which seems unlikely).
Personally, my observation is that if one tries to properly configure 2FA with any major website lately (no, I don't mean AWS console), the level of "your choice" and properly implemented security has actually gotten worse...
I have to say the messaging around passkeys is bad. So many providers show modals with big friendly lock logos superimposed on a smartphone to announce the change without offering any explanation about why the change is happening, why the change is happening now, or how the technology works.
I don't know when it started, I don't know who is to blame, but we've definitely arrived at a conceptualization of "the user" that is passive, uncurious, and incapable of being talked to like an adult.
> When it is present, WebAuthn attestation tells the site the make and model of the authenticator, identified by its AAGUID, with a certificate chain from the vendor to back it up.
Me: The person who posted this post critical of The King on Facebook was totally not me!
Police: Here's "a WebAuthn attestation" that told Facebook "the make and model of the authenticator, identified by its AAGUID, with a certificate chain from the vendor to back it up" and it fits Evidence A.
Let’s assume passkeys are the greatest thing since sliced bread.
Passkeys face the same problem as the USB-C rollout. Lots of different incompatible implementations and standards rolled under one name that are almost impossible to distinguish between. Very little education on how to use it and be prepared for it.
The difference is that the consequences of getting passkeys wrong for the user is significantly greater than getting the wrong cable, and while the latter can easily be fixed, the former may be irreversible.
Passkeys can be tied to a root of trust, like those owned by google, microsoft, apple.
Currently they aren't tied to that root of trust.
Most of those organizations have shown that they don't want people owning their own devices or being able to run their own software, and they use developer attestations, IE a revocable programming license to accomplish that.
Tools like android's safetynet makes it so that you can't run banking apps on a phone running your own software. One that bypasses developer attestations.
Passkeys are currently an open standard, but attestation is built in such a way as that it could be only usable on n approved operating system with programmer licenses.
Big websites like amazon, or websites you need to exist in society, could gradually start requiring the usage of attested passkeys.
---
There is a clear path from passkeys to the death of general purpose computing for 99% of people. Don't be a useful idiot, don't assume these corporations have your best interest in heart. See this for what it is, a path towards killing people's ability to run unlicensed software on their own devices.
> If a consumer website decided tomorrow that it would only accept attested passkeys, it would lock out almost all of its own users, instantly. What website is going to do that? Besides, the guidance for consumer sites has been to not even request attestation for years now.
This isn't a rebuttal to the claim that they're a hidden dial. It's just saying that it's too early to crank the dial.
>Attestation Isn't What You Think It Is
>The post describes attestation as proving "that an approved passkey manager, operating system, and firmware are in use" which is simply not true.
>When it is present, WebAuthn attestation tells the site the make and model of the authenticator, identified by its AAGUID, with a certificate chain from the vendor to back it up. It says nothing about your OS, your browser, your extensions, whether your phone is rooted or jailbroken, your firmware version, or even what colour it is.
This point is bypassed by websites only supporting specific authenticators and then those specific authenticators only supporting specific devices/OSs/browsers/etc via other attestation frameworks.
Then guess what - people stop using those websites.
The big players who want to gatekeep you in their ecosystem do not want attestation - they want you to give them your passkeys for them to store under the guise of "hey, we'll sync it for you!".
A yubikey is easy to use. Buy a second as back-up. If you're clumsy and lose things all the time then set up recovery codes. Add a recovery contact. Use insecure 2fa like TOTP or really insecure 2fa like email/sms/etc. codes.
There's plenty of options for authentication in the modern world and passkeys are at the top. If users are 'too stupid' to use them then that's a user problem.
I'd rather spend the 5 minutes reading how these things work and then not hand the keys over to big tech.
Only a few people stop using those websites, because most people will use the Apple or Google authenticators and be done with it. And if those websites are essential services, those few people who don't conform will be left out in significant ways.
> Then guess what - people stop using those websites.
Wishful thinking. Sadly, the vast majority of people will be perfectly OK with a website telling them they have to use a recent iPhone or Play-enabled Android phone to do something. This is already the case for banking apps and a huge number of other phone-app-only services.
Lot's of additional great information for consumers and prosumers at whatarepasskeys.info. Many of the questions that are constantly discussed in these comments are answered in the FAQ and content.
Contributions and feedback are welcome! GitHub link is at the bottom of the page.
I don't use passkeys but the thing that raised a red flag for me while reading the article that the OP is responding to is the "non-copyable" property. It's not possible to prohibit delegation[0], so the idea that a key can only be used on one specific device necessarily involves a form of DRM/wishful thinking.
The entire point of passkeys is to force DRM onto all corners of the web. It lets sites require attestation of the software running on the client device. Once they use that to eliminate hardware and operating system competition, they’ll ramp up surveillance and censorship even higher than current windows levels.
Passkeys are the second prong of the age verification push.
If you want more evidence, read up on Project 2025’s plans for forcing the internet to adhere to American Christian Nationalist values, then try to figure out how that could work in the absence of passkeys.
If they are not a trap, then the standard should be amended to allow third party implementations to forge attestations.
Otherwise, it is a trap. The story of the last 25 years of the internet is user hostile ratcheting away of the open web. Passkeys are obviously another step in the process.
I was expecting the author to at least address the thinly veiled threat to blacklist KeePassXC at [0] (via the very same mechanism they claim is harmless), but of course it's not even mentioned.
I'm sorry, but if your system allows someone to make a credible threat like this, you should make sure to redesign your protocol so that kind of abuse is not possible BEFORE advocating for it. I'm so incredibly sick of people repeating history, only to disappear once we're all roped into yet another anti-user scheme.
I'm a happy user of 1Password myself, but warning that they only allow export of passkeys through a specific protocol, and it has to be done on the mobile app. [0]
> 1Password for iOS exports ... directly to other supported apps, including your passkeys.
They pick the list of other supported apps. There is no ability to export to a standard encrypted file, nor is there a way to develop an open source app that can receive an export over the objections of 1Password Inc.
Exactly. So much for TFA's "or whatever other software of your choosing" claim.
Passkeys are a trap, trying to lock users in to the service providers.
I did say I like and use 1Password, but I do remember that they switched from a one-time payment model to a subscription model, and have now stopped supporting the old software and only support their subscription software. If it wasn't for my non-tech-savvy, aging family I support their usage of 1Password for, I would still be on Keepass[XC] for my own private usage.
What's annoying about passkeys (and not talked about enough, including in this article) is that passkeys seem to be a boon for the targeted-advertising industrial complex.
Since passkeys are tied to verified devices, they guarantee absolute de-anonymization -- and further spread that advertising "wealth" by seamlessly linking across devices, and therefore to their respective corporate stakeholders (i.e. via bluetooth to conveniently login on a laptop via a phone-domiciled passkey).
Username + password at least requires circumstantial marketing analysis to "verify" whether a user is who marketers think they are. But with passkeys, your login confirms your Windows account ID, cell phone MAC address, home address, what have you.
Reminds me of when The Powers That Be forced me to connect to websites with HTTPS. Then they stopped supporting Internet Explorer 5. What were they trying to hide?
Wouldn't web browsers themselves be the ultimate passkey managers like they already do with passwords? They'd need a way to export the passkeys to another passkey manager though.
Every single IT person thought it would be an extreme mess, too complicated for regular users. In my company we work on the (gas) grid so lot's of blue collar types.
We went there, gave the pilot group a Yubikey and said: This is like the company pass you already have. Without the company pass you cannot enter any buildings. Without the Passkey you cannot enter a computer or app.
If you lose it report to the same people (service desk).
The response has been EXTREMELY POSITIVE. People fucking LOVE getting rid of passwords, password requirements and taking off their gloves to enter it every time.
We are now rolling it out to everyone and next year when we stop our silly "phishing game" contract we will actually save money while reducing a massive cyber security risk for our company: (voice) phishing.
Perfectly fine in a business environment where you don't have privacy. It is unacceptable for any personal computer(including phones) to be leaking unique ids so you can be tracked.
Passkey attestation hands control of the client software to the website. Since surveillance capitalism funds most of the web, this means that, over time, the only approved clients will be surveillance devices, and those devices will slowly add more and more invasive spyware.
Initially, they will probably “just” require hardware serial numbers or similar (so they can join IDs on the backend).
There are already serious proposals to require live web cam feeds for porn site login biometrics purposes, so I can’t really come up with any hyperbole to add.
I mean the desire to trap seems to be among the big corporations already.
I keep seeing major players promoting their own apps over standard TOTP, which I guess could be seen as a sort of proprietary passkey. Shopify, Google, Microsoft, and more, they all want you to download their app for MFA, instead of using a very open format.
As someone who works in IT, I just can't even imagine myself doing this. I have probably around 60 codes in my Aegis, how would it look if I had just a quarter of those in apps instead?
But the main issue I have with passkeys is the simple issue of backups. I can backup my Aegis keys, I can't backup an app, or a hw passkey. I have to get a second one, and keep signing for it or something, not sure of the details, I just know it would be a major hassle. And there is no way I'm trusting a little usb device to not break.
Right now I see no compelling reason to switch from regular OTP codes, change my mind.
Just came back from doing a bit of research and apparently I can use Bitwarden to generate and store passkeys.
I have been dismissing the entire concept because I assumed it had to do with hardware keys, which I would never trust. But if it's bitwarden, then I can easily do a backup, and that would be very reliable.
I think it's a bad sign when someone immediately resorts to strawmen and argument from incredulity in their counter-argument:
>If a consumer website decided tomorrow that it would only accept attested passkeys, it would lock out almost all of its own users, instantly. What website is going to do that?
The original didn't argue that, nor has absolutely anyone else concerned, nor has that been what has happened in historical examples people were concerned about. Because yeah of course that's ridiculous, it's "boiling a frog" by throwing it in already boiling water, that's not how it works. If anyone has freedom-reducing longer term plans for use of passkey attestation, the emphasis is on "longer term", being malicious doesn't mean being stupid. Step 1 is obviously getting people into the passkey ecosystem and out of passwords at all, which could well take years. And importantly as much as possible into closed passkey ecosystems. This is indeed one of the initial danger signs, because the author:
>iCloud Keychain, Google Password Manager, 1Password, Bitwarden
Is mixing together things that aren't like the other. Quick author, what's the EXPORT story for each of these ecosystems? Of those, Bitwarden can export a passkey into a plain JSON if you want. Do the others support that too, or at best only "app to app" encrypted transfer, creating a closed ecosystem? Already, can I get passkeys from iCloud/Google/1Pass into KeePass? Or is this restricted """for my protection :^)"""?
Author doesn't even touch on the lock-in that's already beginning. And right now everyone can technically claim "oh no of course you're not locked in! You just have to use an official option, or you can merely visit hundreds of sites individually and register new passkeys in all of them". Is it hard to see how players like Bitwarden would be pressured on continuing to offer plain export?
Then when most of the population is using passkeys everywhere in a closed ecosystem, now what is the response if friction slowly starts getting added. OK, you can still use what you like, but only export to other approved players. OK, you can still use unattested, but it's off by default now, "advanced users" can go enable it with this checkbox in the settings. OK, manual is still an option, but now it's buried deep and behind dark patterns and requires a text command. Hi everyone, we have statistics to show that only 0.85% of our users still use unattested keys. The support burden and security risk is now too high."
I hate passkeys because they're always tied to a specific account or a device like a phone. I hate being dependent on phones/devices. That being said I know they solve a lot of problems so....
I still prefer a good password written down in a paper book, with multiple methods of 2FA. But I know there are attack vectors for that.
Syncable passkeys are a thing which the OP addressed. Apple, Bitwarden, and other password managers all implement syncable passkeys. In fact, I just did an upgrade of my iPhone 15 Pro Max to an 18 Pro Max and all of my passkeys came along with the upgrade.
I don't think it's appropriately addressed. The apple ecosystem has really good syncing between devices but only when they share an iCloud account. What happens when your work mac isn't permitted to use your personal account? What happens when your company issued password manager and your personal one fights? What happens when your company issued device is an Apple device AND you have to use a mandatory password manager from the company?
The problem to me is that passkeys assume the user owns the device and CAN choose to make a single store authoritative for their credentials. The only professional environments I've encountered that haven't/wouldn't hit this issue are ones small enough that they don't really have device or security governance in place which you can't use as a secure reference baseline.
Saying "attestation can't hurt you, your password manager returns `none` today so it's not a concern" is avoiding the entire point of the original article which was that that can change at any time! I'm already seeing in a corporate context, IT departments forcing hardware attestation as required everywhere. Justifiable, but also clear evidence that it's no longer in your control as the person authenticating. That's the point, passkeys are marginally more secure for you, while handing huge amounts of control to centralized platforms.
There is nothing about passkeys that requires biometrics. Synced passkeys on android will work with your screen unlock code if you do not have biometrics enabled. Same with passkeys stored in a password manager. Same with hardware passkeys that do not support biometrics.
Anything that's tied to hardware is one accident away from locking you out forever unless you set of "2 of 3" or some other "let's make life even worse when it comes to authentication" solution.
"Is not a trap" does not follow from "Is currently good".
A defining feature of traps is that they start out good.
There are a lot of good points in this article, but it fundamentally missed the point of the word trap. The most it said on that topic is:
> If a consumer website decided tomorrow that it would only accept attested passkeys, it would lock out almost all of its own users, instantly. What website is going to do that? Besides, the guidance for consumer sites has been to not even request attestation for years now.
Which is a statement about the near future. There is room for a conversation about the long term, but this article is not a part of that conversation.
> If a consumer website decided tomorrow that it would only accept attested passkeys, it would lock out almost all of its own users, instantly. What website is going to do that?
Any of them? All of them?
"Starting next year, only Google Authenticator and Google Chome passkeys will be valid for gmail logins. Help us keep your account safe by limiting access so ONLY YOU can read your emails"
"Good news! Your Instagram account is getting safer from hackers and spammers. As of next month, you'll use your Meta Metaverse token for all logins to Instagram, Facebook, Theads and WhatsApp"
Google already forced OAuth2 on Thunderbird [0] and the rest of the email-client universe.
There's absolutely nothing insecure or wrong with app passwords for a local client application.
The whole point of OAuth2 is to allow logging in to some untrusted 3rd party site via an authentication provider without having to key your password into the 3rd party site.
a) Local client software like Thunderbird is/must be trusted, it's not a random 3rd party website.
b) App passwords remove the risk of Thunderbird stealing your password, even if for some reason you didn't like typing a password into Thunderbird.
c) Google is both the Authentication Provider and the Resource Server in this example, so it adds zero security.
App passwords are not scoped, are they? When I set up an app password for my whole google account it is never asked whether it is for email, docs, youtube, etc... . The oauth token is properly scoped.
Google would not do something that would lock out half of the mobile device market. iOS doesn't do attestation.
Also, is there a reason Thunderbird or other clients couldn't use OAuth? I'm fairly certain I can login to GMail on Mail.app in macOS and other clients, so they're not using that to lock people into the official app or their browser
Are you sure iOS doesn't do attestation? Google recently turned on requiring an iOS or Google-attested Android device with a camera for some reCAPTCHA challenges(i.e. take a photo of this QR code). They waited for Apple to support it before doing so.
Is that the same thing we're talking about here? That sounds like a CAPTCHA, not Passkeys. I mean iOS isn't doing attestation in Passkeys, I'm sure there's some thing on the phone that it's doing that is a version of attestation
Google today might not do that, but Google tomorrow, when some upper manager's multi-million dollar bonus gets tied by a performance metric on how many people are using passkeys for gmail would in a heartbeat.
Okay? At some point mail applications didn't support IMAP, because it was new. Was IMAP bad because it forced POP3 clients to build new support that they didn't previously do in order to support the improved functionality?
OAuth wasn't about lock-in (since any client can support it), it was about getting off shitty legacy auth
"A passkey is bound to the domain it was created for, so your browser simply won't use your example.com passkey on examp1e.com."
What happens if a service you use loses its domain? For example, if I run a marxist online forum, it could happen at any time that the US regime sanctions my site and seizes my domain. Would my comrades still be able to log in with their passkeys?
I absolutely love them now that I have a Mac. They're shared between my phone and my Mac automatically so I can just sign in to anything with my fingerprint.
Passwords just suck. If we're all going to use password managers anyway, what is the point? Might as well use a randomly generated passkey.
Passkeys are confusing, fragmented, awkward, and annoyingly implemented. They aren't a trap, but they are far less efficient and less proven than a password and app-based MFA.
When a website forces a passkey into my password manager without even asking me (fucking Amazon), it is pretty unambiguously something that is not good for me.
"AAGUIDs are unique identifiers assigned to FIDO authenticators (including passkeys and security keys) and are used to identify authenticator models for attestation and metadata purposes."
If there is any unique id that can track you, then it's a trap. No security system should be leaking unique ids that can be used to track users.
That being said, password and 2FA is the best combo, where you control the token of the 2FA and it’s on a separate app/platform/etc than where you have your passwords.
I don't like them, they offer no advantages to logins with random passwords. They would only be more secure if they were forced to be stored on hardware devices like Yubikeys, which almost never happens in practice. In reality it's true that they can be dangerous because they can be set up in a way that doesn't allow storing them in software and using them on multiple devices, and such device-bound passkeys will eventually lock you out or be reset in the same way as password+login (usually just by email).
The standard and implementations are also unnecessarily complex and obtuse. IMHO passkeys are not a good technology.
At the end of the day, I just don't really want them. I already have passwords and I already have to put up with 2FA. Passkeys are just one more damn thing to understand in an ecosystem I already want to spend as little time in as possible.
Thankfully someone with some sense. I saw that post title and didn't even bother to read it. It sounded like someone having argued with me a decade ago that IPv6 is a mechanism for the government to track you because you have no more privacy anymore because you don't have NAT...
I’ll be silly, but having a unique address per device, is indeed a simpler vector to track, right?
On topic, I’m not sure I even trust my own password sanitation, and seeing service A and B hacked every other month, I feel weary. Knowing that someday my passwords might be compromised as well, so what should I do as just a person who can’t remember things? Write them down, I guess.
Because I too understand passkey attestation and have written code to do exactly that and have worked in multiple enterprises where we've done a mass Yubikey rollout across thousands of people. So I've got a pretty solid understanding of passkeys, yubikeys, and attestation. As well as I don't read headlines of people claiming it's "tracking you".
1. One time when I was abroad in Poland, a thief walked into my room at night and stole my wallet, phone, and laptop.
(The thief was eventually caught 6 months later, but that's another story).
Question: what to do in that case if I were using passkeys?
Is there a solution that doesn't require trusting a cloud provider?
2. Currently passkeys are offered as an alternative to passwords. What are the mechanisms that require passwords to be available as well?
I.e. what stops my bank from simply giving me a passkey at a branch and offering no other option?
3. Clouds are currently the easiest way to use passkeys. Last time I checked, you were locked into that cloud, but things move fast.
What ensures the ability to move the keys out of the cloud?
And what do I need to do to have my own "cloud" like that?
4. What protection does the passkey ecosystem offer for physical threat to the user?
With passwords, there's no way for anyone to know which Hacker News accounts are mine, or whether I still have access to them. I don't remember has plausible deniability (who hasn't ever forgotten a password?).
With passkeys, getting detained with your device means surrendering all your passwords, to my understanding.
Because, apparently, passkey evangelists are a cult.
The spec requires passwords to still be an option, they say, so there's nothing to see here, move along — and avert their eyes should an inconvenient argument come their way.
Because, see, we all know that specs are ironclad, never change, and are always fully implemented.
Also, putting all your eggs, ahem, passkeys into one cloud basket (as this article recommends) to "move around" is surely the most best solution better than passwords.
Because we can always trust the cloud, right? Not like it's somebody else's computer or anything, that they can instruct to not do what you tell it.
Anyway, none of the passkey lovers ever answered me what to do if my computer and cell phone ever get stolen again when I'm traveling abroad in the Brave New Passkey World.
The best answer I got was carry a yubikey with me at all times.
One more thing to worry about losing, yay. Much convenience, very security, wow.
If there are any new developments on that front, would love to hear them.
Do passkeys have issues? Sure. Most of them are UX and are being worked on. As a user, I 1000% immediately register a passkey when a site or app offers it as at least on iOS and macOS, it is a superior user experience IMO and more secure. I never worry if I'm getting prompted for a Passkey, am I on the right site?
Also the remote connect functionality of modern browsers and mobile operating systems makes it trival if I need or want to sign into a personal account on my work PC where my personal passwords are not sync'd. Need to get into my personal GMail in an incognito window at work? No problem at all.
Anti-Passkey folks are just people who want to be against something to be against it
Google and other services like PayPal make Passkeys default if you generated one.
Now they expect you to always use them to login on all devices.
I had to remove my passkey from one device for these services because i also use a PasswordManager and I do not trust my local chrome installation to just manage my passkey.
I want to have a Password Manager which I need to unlock when I use it. I also want to keep my 2fa and not break it due to passkey usage.
GitHub was also super shitty with it, suddenly a passkey broke my YubiKey login...
One of the bigger issues with passkeys has been that they get locked to one provider (like apple in your case). Now i HAVE to use an Apple device to unlock passwords, same with Google and Android. Its very much all eggs in one basket.
If it was easy to migrate between services, then i would be a lot more open to using passkeys.
It's fairly easy to export/transfer passkeys (I think, I've never actually done it)
Also, many if not all of the sites I've got passkeys setup with support multiple keys, which I sometimes take advantage of. For example I've got a passkey into my Google account in my Apple account ecosystem but I also have a physical Yubikey setup as a Passkey device, in case I were to get locked out of my Apple account
Too add to my own comment: I know that its coming, but until i can export to something like. keepass and not a commercial entity then i don't consider it ready.
On my MacBook with the latest macOS I still can't use them.
I use Brave and 1Password. Clicking the Use Passkey button typically results in some Chrome Bluetooth permission dialog rather than accessing my PassKeys.
I tried to look into this once or twice with no success.
I suspect macOS is at fault. Apple does not seem to care about getting basic functionality right.
To this day Universal Clipboard between the MacBook and my iPhone does not work half of the time.
Well, they're synchronized to my Apple account so that's not an issue. They're available on all of my Apple devices, or even ones I don't have right now that I log into in the future
Plus, none of the sites that I use passkeys for would I be locked out. They all have account recovery procedures just like if I forgot my password. And, finally, for the important ones like my Google account (where my email lives) I have other non-Apple devices like a Yubikey setup as additional Passkey/FIDO authenticators
It's just not a replacement for TOTP and password entirely. It's a shortcut, a super-cookie that is more secure. If I lose the device that has my passkey, I need a way to access my account from another device.
One might say "just use a password/credentials manager", but all these passkey prompts don't emphasize that you should use one that is not tied to hardware, or that you should backup your passkey to a thumb drive, or anything like that.
Same reason I hate TOTP that is tied to a device. If you require me to have proprietary 2FA apps on my phone to login to your account, I don't use 2FA. Looking at you, Steam.
When a website prompts me to set up a passkey, depending on the device I happen to be using at the time it could end up going to Google password manager, Samsung password manager, iCloud Keychain, or Windows somethingorother.
What happens when I go to the same site on a different platform? What if I can't use cross-device authentication because I'm on a locked-down work machine or one that simply doesn't have bluetooth? What if I want to consolidate them all in one platform just for the sake of being organised? What if I lose or simply don't have the device with a certain passkey near me?
I don't have the time or patience to work out any of that, which might absolutely be a 'me' problem, but TOTPs are pretty sodding frictionless in comparison. Scan QR in my chosen manager; type number into website; done. Why are passkeys better?
The idea and protocol are pretty solid, though we're back to a "biometrics as password" problem in many device flows, but every time I'm urged by a site to convert to a passkey, I wonder "is this site the sort that would screw this up?"
So far, it's about 30% of sites screwing it up...
I can’t adopt Passkeys if I’m not certain they’re going to work as well as my password manager and Authenticator app, which is to say 100% of the time.
When sites ask to set up passkeys, it’s usually native passkeys (especially on iOS). And figuring out how to get the flow to set up a LastPass key by default seems unusually difficult.
I also use a MacBook, windows desktop, an iPhone and iPad. I use Firefox, edge, brave across these devices.
When I say “passkeys are a trap” they are a usability trap where no one can attest with certainty that I won’t wake up in a painful situation because I decided to adopt passkeys.
Seems that way. Better luck next year, passkey standards(?) people. Hope it’ll be ironed out at some point.
Other password managers do, too: https://bitwarden.com/help/auto-fill-ios/#keyboard-autofill
That's the issue I had with Okta a few years back. I used a password then later added a passkey through Bitwarden on my work laptop. Bitwarden hadn't yet implemented passkeys for mobile.
I went to authenticate through Okta on my work phone. It prompted me for the passkey. Since mobile passkeys didn't exist, I got stonewalled. I had to make a blood sacrifice just to get Okta to allow password access again.
My suspicion: There is a significant chance I will lose access to one or more account by doing this, so I'm not going to until the air clears. I don't trust the motivations of the services pushing it.
This means you never send your private key to the site, so if their database is compromised they only get a public key, which can’t do anything (it is public, after all)
No amount of phishing can get you or your client to hand over your private key, because there is no use case where that is required. There is no possibility of MITM, since your private key is never sent anywhere in any situation.
As for getting locked out of your account, losing your passkey would be the same as losing a password. You would need to follow the site’s password reset flow, and if you can recover from a lost password, you can recover from a lost passkey.
I will poke at this a bit:
> As for getting locked out of your account, losing your passkey would be the same as losing a password. You would need to follow the site’s password reset flow, and if you can recover from a lost password, you can recover from a lost passkey.
Do you think this is one of those scenarios that sounds reasonable at first, but can get torn apart by unknowns, edge cases etc? To use an analogy from a recent HN thread that is stretched a bit, is this like saying "If you use a crypto hardware wallet, you're safe", then reading about compromised hardware wallets due to something outside the assumption set.
I've never fallen for a phishing attack and any attack targeted and sophisticated enough to catch me is probably going to be sophisticated enough to steal/hijack a passkey anyway. In the extremely improbable event that I did get phished and somebody got into my account somewhere, they'd only have access to that one account because unlike most people I don't re-use passwords and recovery would no more complicated than contacting customer service and resetting my password with them.
Considering the horror stories of people who been screwed by using passkeys, I'm sticking with "not worth the trouble"
What do passkeys offer users that rand strong password + password managers don't?
They have to be transmitted. They (or their hash) have to be stored. And so so many get that wrong.
There is nothing to prevent you from entering your super secure u quiet password on the wrong site if you get phished.
Passkeys don’t get transmitted. They’re used for cryptographic signing.
Passkeys can’t be entered on the wrong site, the sites they work on is an inherent property of the key.
You can’t store a passkey wrong on the server, it’s a unique public key. If your entire database is stolen, it’s useless. No one else can login with your credentials because they don’t have the private key.
Unique strong passwords, TOTP, 2FA, one time sign in emails, none of those offer this stuff.
Passwords are fundamentally broken. They cannot be fixed. Cryptography is the solution in passkeys are the implementation.
Everyone knows to hash passwords now and browsers basically enforce SSL. This is not a practical differentiator.
>Passkeys can’t be entered on the wrong site, the sites they work on is an inherent property of the key.
They are still susceptible to malicious enrollment. If a user is convinced a fake site is real, to the point that they are opening their password manager to copy the password to it, you should assume they will do the equivalent with a passkey (re-enroll attacker's key or register attacker's passkey).
>If your entire database is stolen, it’s useless.
As are databases containing strong randomly generated password hashes. What is your threat model here, they somehow forgot to hash their passwords yet they are still hashing session tokens, storing customer data in completely separate databases, safely storing private keys, etc.? It requires quite the strawman scenario to apply.
This is only technically true because of the definition of what a passkey is is vague.
Hardware Attestation solves this problem and is "good actually". The issue with attestation is when site attempt to restrict which enclaves/sources can register keys. But if you don't restrict who/what can register keys, attestation is super useful for preventing this exact issue.
When you register your key initially you establish your hardware attestation parameters. The attacker cannot know those parameters unless they were the ones to initially register you for the site as the public attestation signature is unique per-key and the private one per-use with the public one verifying the private one.
So if you have remote attestation you can verify whether the source presenting the signature for auth is the same source that created the signature and trivially block MITM attacks. Likewise for more complicated custody/proxy chains.
This just by itself largely solves MITM key re-enrollment attacks but tech camps that support passkeys either ideologically oppose attestation (due to understandable enclosure fears) or enforce hardware attestation for enclosure purposes without bothering to address MITM/signature origin checks.
It seems like one of those things that only works if you're sticking to one ecosystem.
Only in theory. Suppose you are a bank, which enclaves/sources/devices do you support vs. not support? What do you do for users on a desktop PC that don't have an enclave? Phishing sites will likely leverage your weakest enrollment option.
got a good chuckle out of me. your optimism is inspiring.
Can you walk me through how that would work?
You replied to someone talking about password managers, which objectively do exactly that.
> Unique strong passwords, TOTP, 2FA, one time sign in emails, none of those offer this stuff.
And Passkeys don't offer portability, user choice, or user control.
Cryptography may be a solution, passkeys are one technical implementation that at is core is designed around smartphone-first, vendor-first, brand-loyality-first thinking.
password managers do not do that. open up your password manager, press "copy" on the password, and then paste it into a random website. it will paste it.
(i think 1password just recently enabled an option that will warn you if the website is different than the one it has, but it still lets you paste it)
It is a pretty big red-flag.
right. and in an office setting, bob in accounting will go "weird, autofill isnt working, ill copy/paste it".
that is not a possibility with a passkey.
This is where Passkeys shine, in an edge-case user that is neither of the two most common user types. Basically a unicorn situation.
you must not work in regular corporate environments. this happens all the time.
yes, they know how to hit the big "copy" button but don't know how to debug an extension.
take a year or two to work security (or general IT support) in a non-tech-company corporate environment, and get ready to have your socks blown off. people become exceptionally literate with things they interact with all day (excel is great example of this) yet have no idea that google.example.com isn't an official google website.
Typically the user gives a website their public passkey, which does not need to be kept secret since it’s public. If the website is hacked the attackers only get information that is already public.
You seem to be talking about a scenario where a user’s private keychain on their computer is compromised and the attacker is able to access other systems from that same machine without the user’s knowledge. (Note that the keychain data is itself encrypted so can’t be used from a different computer.)
Proof needed.
> How many phishing emails h
The point is the average Joe will not be phished - especially important stuff - like email or eBay or bank. That is the reason for passkey.
Yes, many people in HN can avoid scammers.
What do you image happens with passkeys?
> They (or their hash) have to be stored.
What do you image happens with passkeys?
> If your entire database is stolen, it’s useless. No one else can login with your credentials because they don’t have the private key.
From the consumer, do you imagine a hacker has my key to unlock my password database?
From a service provider, do you imagine they are not using encryption at rest?
> Cryptography is the solution in passkeys are the implementation.
Do you imagine cryptography is not used with passwords?
- you can't get phished
- you dont need to worry if your password is securely stored
The way passkeys are being pushed is so clearly an attempt to add friction to leaving walled gardens. Stop talking in absolutes in a world of greys.
Pass-the-hash has been tried in NTLMv1 and thankfully that was the end of that failed experiment.
Modern password authentication is performed by the client sending a plaintext password encapsulated within a symmetrically-encrypted tunnel. On the Web that's with TLS. The server then uses bcrypt or another scheme to hash the password (along with the stored salt) and compared that resulting hash with the value in the table.
Unless I'm misunderstanding what you're doing, this achieves nothing.
Hashing the password on the client side makes the hash the password, and MITM attacks are still possible.
If you are defending against clear text being discoverable, then bcrypt hashing with a unique salt on the client is good enough.
If you are trying to prevent MITM you can combine that salting with public/private key transmission of the bcrypt hash to the backend (effectively the same idea as pass keys without the downsides).
MITM just affects your service, and doesn't always matter depending on what the service is, for example, a recipe manager doesn't need to have bullet proof security.
While rare, a couple of sites which has many (>1000) users have sent me my password in the plain when I told I forgot them.
Many sites have e-mailed my password in the open when I registered, as well.
I don't defend passkeys here, but too many weak links are present in password based flows today. If someone uses per-site strong passwords, one can contain the leaks, but use the password even once, and the problem grows exponentially.
A phpBB forum era classic!
Don't assume everyone coding a login page is as competent as you though...sadly.
I'm never going to bother with paranoid security inconveniences for the crappy website my local pizza place uses.
But in my opinion, the solutions that passkeys provide come with the costs that are being discussed here, and I haven't found the trade-off worthwhile.
I think passkeys make a messy credential situation even messier, but make a tidy credential situation even tidier.
Isn't that a single vendor (or two)? How is this not lock-in?
The complaint wasn't in allowing credentials to move (that is the point of the CXF and CXP work). The complaint was in having sensitive data in a plaintext file live long-term without any protections. That is also why one of Tim's early recommendations was to require encrypting the file via a passphrase.
> Passkeys should never be allowed to be exported in clear text.
and from another comment by the issue creator:
> I don't quite understand why requiring file protection/encryption can't be a temporary minimum bar here.
They're arguing for storing them in encrypted form. That's very much a different argument than arguing against exporting. I'm not taking any sides here, I just think it's bad to so badly misrepresent people's standpoints.
Please explain how self hosting open source software is locking me into a vendor.
If the sky falls and strongbox ceases working with mac/iOS I can use android and linux. Nobody is locking my lockbox.
> Store your data anywhere you like, online or offline. Sync with every major cloud storage provider or your own server over WebDAV or SFTP. Use your Strongbox database with any KeePass compatible client on any platform.
In my experience, migrating between Apple Passwords and Bitwarden worked without issues, in both directions.
The passkey provider vendors are motivated to serve their customer's needs (the end users, and secondarily enterprise deployments) over non-customer needs.
So Apple platform support (for example) will only send an attestation when one is configured via MDM. Your provisioned work device can indicate to work systems that it is in policy.
The compatibility-limiting risk, if it exists, is more likely from regulators putting their hands on the scale and pushing for security policies that would prevent synchronization and backup, and requiring attestations to make sure those policies are in effect.
Microsoft Authenticator, Bitwarden, 1Password, etc. all support storing passkeys and support multiple hardware platforms.
It's no different than making your own decision on which password manager you want to use.
There are an open standard. You just have terrible software.
Saying it's an open standard, and that it's just all the major players I'm forced to interact with that make it suck isn't very helpful. That's like the people that say "Don't like iOS? Build your own successful mobile OS lol"
The first two accounts I switched over to passkeys were my Nintendo and Playstation Accounts as it made sign-in much smoother.
I now use passkeys pretty much everywhere I have the option (at least on high value accounts such as Amazon) and I have not once had an issue. Not having to use a TOTP (or worse an SMS or email based one use code/link!) is much nicer in my personal opinion.
Some sites have a much better designed on-boarding process than others I 100% agree there. I find the sites that do a poor job with their passkey enrolment are the same sites that also did a terrible job of 2FA/MFA setup as well though.
One blessing with passkeys is since I set it up for my mother with her Amazon account she has not once had to ask me to help me reset her password. At least once every 6 months I would have to help her sort things our as she would forget it, reset it and then forget what she reset it to and can't reset it again as she hadn't clicked to update the password in her password manager so it had an old or incorrect password, etc. Always a pain to sort out. Not happened once since switching her to a passkey which is wonderful for me.
Also it is essentially impossible for her to use the passkey on a fake site. Multiple times she has fallen for phishing emails with realistic looking site logins and she would just blindly enter her username and password as many elderly people do.
How many people are for now and forever more all in on the Apple ecosystem. You never have to login on another non Apple device ever?
It also requires foresight if switching. I ran into this with 2FA as well. When I got a new phone, after setup it offered to wipe the old one, I declined. When I went to open my 2FA app for work on the new phone, it needed to be setup. I needed the 2FA on my old phone to login to the portal and setup the new phone. Had I wiped my old phone when prompted, I would have been locked out and on the phone with the help desk. This same scenario can happen with Passkeys.
Anything that randomly makes a Windows 8-style popup offer to keep my login credentials safe makes me want to run farrrrr away.
The vibe of the original criticism, even with its technical flaws was this: are passkeys - as a standard, and a user interface - vulnerable to corporate capture? I think passkey defenders are focusing far more on the theoretical technical superiority, and ignoring how instinctively alarming the average implementation is.
We face a lot a lot of attempts to capture our data, and passkey feels like a new frontier.
For me, I know exactly where I am with my password manager & TOTP. I think the current confusing interface of passkeys will make me less secure rather than more, so I've not invested the time to think about how to use them.
Lets give the guys at the Home Depot all the keys to our super secure house locks. Any time you want to get in, just roll down to one of 5 convenient locations, authenticate with the HD, and they will issue you a one time entrance pass to the house. Easy.
Bullshit.
At least there's a dedicated migration protocol for passkeys, but I'm not super stoked about how basic Apple's password management is, and how few fields there are for each profile.
But I also feel like it's time to retire my YubiKeys ...
Why, specifically?
(For example, it only stores the passwords in memory and never persists them locally in any form, because there's no way to secure that, so it has to redownload them from scratch every time you open the app. It also only supports proper Windows Hello PINs rather than normal account passwords, because that's the only way to get proper hardware backed cryptography locked behind authentication, etc. It's a mess)
New and interesting ways to get locked out of your system.
Then the user still controls the passkey using a password and then everything else flows from that.
This is the same problem we've had for 20 years with password managers, though.
The solutions are mostly the same as well (with the change to a QR + BLE based mechanism over manual transcription to go cross-device, and a protocol to support moving passwords and passkeys over to different software rather than using a plaintext password CSV export).
Many password managers also manage passkeys (and were managing TOTP before).
Passkeys provide perfect protection from phishing attacks, since it's impossible to send a passkey to the wrong domain. That's a huge improvement over TOTP.
Re: it being confusing where they're stored, I agree. The solution is to make sure you store your passkeys in your cross-platform password manager. The experience can be confusing though. In Chrome I've found that by default when creating a new Passkey Chrome offers to store it first. But if I click cancel, I'm then given the option to store it in 1Password where I want it.
Heck, as an engineer even I don't get them. What ever happened to password + yubikey?
[0]https://bitwarden.com/
If machines, browsers, phones etc are set up properly (yes, I know, big ask, especially with the confusion surrounding this, so I acknowledge the caveat), then the vast majority of passkey requests will go right into the preferred method (i.e. 1Password, Bitwarden, even Apple, browser of choice, etc). And most of those now will allow that passkey then to be used on a different device if signed in and synced.
I have found it to work pretty well with a password manager. I would suspect OS level passkeys would be much less "portable", especially across different manufacturer devices, like Mac/Windows, or even Windows/Android, etc. Which is why I waited to start using passkeys until I could use a password manager to store them, and I turned off all other passkey storages (same as I did for password storage before).
If we don't add decent sharing to passkeys then people will continue to use passwords, which is worse for security than adding a sharing feature for passkeys.
I've done authentication projects for financial institutions that were actively targeted by phishing attacks, and it is difficult to mitigate TOTP phishing. Defeating TOTP is very much in the standard playbook for high-dollar scam operations.
If it gets lost for whatever reason, I don't care, I will login again with regular username/password.
So as long as you also have a regular username/password login, phone passkeys are great time savers.
"What happens when I go to the same site on a different platform?" = "If you meant device, then Chrome has a feature to allow you to use a different device such as a NFC YubiKey"
"What if I can't use cross-device authentication because I'm on a locked-down work machine or one that simply doesn't have bluetooth?" = "Good, Passkeys are doing their job correctly and you cannot export credentials"
"What if I want to consolidate them all in one platform just for the sake of being organised?" = "Then log in and add more passkeys to things rather than copy-pasting passwords everywhere"
"What if I lose or simply don't have the device with a certain passkey near me?" = "You should have multiple passkey's or use the various cloud versions that exist"
I'm perfectly happy to take responsibility — when using a well-designed system that isn't a massive pain-in-the-arse up front designed for vendor lock-in and to penalize small vendors.
Criticizing the new system isn't avoidance of responsibility, it is demanding a product that is worth using, i.e., NOT designed for the manufacturers to extract more money from us without providing more value or locking in their market position, but designed to be actually useful to the people who will actually use it.
EDIT: add last 8 words
It is plainly obvious that the worry isn't attestation per se, it's the restrictions that attestation may in the future require when they turn the dial on restrictiveness up, that was extremely clear to me from reading the first article. If you can get attestation without those restrictions, "sure, why not", and a Yubikey seems like a way to do that which could avoid those restrictions. Most of this article makes sense, but this particular line makes me wonder how the author got it so far off the mark.
They also did nothing to quell my fears that they will in the future use passkeys to prevent people from using software they can modify themselves by saying "...the guidance for consumer sites has been to not even request attestation for years now." as if everyone always followed the guidance, and as if there aren't tens of thousands of managers that think their case is special and they really do need the extra control because they're a bank or handle copyrighted content or have PII or PCI and feel extra risk-averse today.
I don't know if they failed to do so because they can't (and this is a valid fear of the original author) or if they just are bad at reading the room at what the concern is and vastly overestimate how much people trust companies to always have their best interests at heart.
What I am getting from this, though, is "If you authenticate with a yubikey then that's attested, so they can't use attestation through passkeys to make sure your OS and browser aren't modified", and I'm not sure if that's the correct take away or even a correct statement.
Remote attestation is never to your advantage. To do it at all, they have to restrict you to a specific set of device manufacturers and yours may not be on the list.
Then, what does it get you? Google-approved Android phones are allowed, but any attacker can trivially get one of those so knowing it's that type of device is completely worthless. All it does is prevent you from using some other type of device.
Notice that this is different from keeping the key in a HSM, which you can do without remote attestation and without the other side having to do anything at all.
Worse, the "approved" devices often have worse security than the one you want to use, e.g. using a Yubikey as your HSM will generally be better than using a phone which has orders of magnitude more attack surface and is constantly connected to the internet, but the phone is way more likely to be on the approved list than the Yubikey.
Like SecureBoot.
On top of that, secure boot doesn't require remote attestation. If your device doesn't like the new configuration then it doesn't release the key. The site has nothing to do with that except insofar as you need the key to sign into it. Your device manufacturer's key doesn't have to sign anything, all your device has to do is not give up your key unless the device is in the configuration you specified. And if it will do that then it would also sign an attestation to the same effect, so remote attestation still provides you with no advantage whatsoever.
The whole point is that once everyone is accustomed to passkeys, they ARE going to ratchet it up to "you need attestation".
This is the browser wars all over again. Google spent something like 20 years winning the browser wars, and once they felt snug and secure, slowly started eroding users' abilities to control the content they see (making features adblock relies on increasingly ineffective).
At the same time the current authentication horseshit of the internet in 2026 is awful. I routinely spend 3+ minutes trying to log into a site - first it blocks logins because of my VPN, then it requires a password reset, then it requires me to login with new password, but then it needs email verification, but then I don't get the email so I have to click resend, then I type in the verification and then it asks for blah blah blah.
I am grateful that LLMs are going to be doing 95% of my browser usage very soon.
It is genuinely an ordeal.
It's true that passkeys do not require hardware and OS attestation today, so all of the specific examples you cite are true. But the point remains that that passkeys can be EASILY extended to require hardware and OS attestation, and this will happen.
Banks have already done this. Before using an app was optional. Play protect was optional. It's like my uncle ted used to say, techonolgy is not optional.
Now they run "Officers are watching! Click it or ticket!" as an advertising campaign.
And I'm not arguing that seatbelt laws are bad per se, just that any time there is a pathway for more control, it will eventually be taken, even if assurances are made that it will not happen.
Most consumer websites won't use attestation.
Places where additional security is required (bank, employer, etc) can.
I don't think that means throwing out passkeys entirely, but that's why you're seeing a lot of "slippery slope" stuff in here
Passwords are client-neutral. Passkeys aren't: you can force a certain client, and now those clients can force an OS through attestation.
It happens now with 2fa today. I have gone through college for 4 years having to use this shitty duo mobile app and we have to take out our smartphones 20 times a day to do things and re-login after every 20 minutes.
anything can happen. if your passkey stops working because you're using it from your smart fridge to access your banking app, then just use your password anyway.
My point here is that this specific step on the slippery slope is a cliff, not some infintessimal change, because now the authentication is done through a program and not copyable information. If verification-can technology is standardized on an OS level and advocated by four out of five tech priests (and maybe even enshrined in law (think of the children)), then you are going to be drinking a whole lot more mountain dew in the future to say the least.
If it was just a single bank or something that tried this, people would get pissed off, leave, and the frog would not be boiled. It takes a slow industry-wide movement to shift the standards of what is acceptible to the common man.
Am I missing something? "Attestation tells websites what the authenticator is but it doesn't tell the website what the authenticator is".
The entire argument in this blogpost amounts to "nobody would ever turn on passkey attestation because it would require migration of people who already setup passkeys" which is a questionable argument- you could trivially imagine allowing unattested passkeys for existing users, but require it for new users. Most websites don't yet support passkeys to begin with, so this argument doesn't hold for the majority of websites.
The "biggest providers" bit at the end is odd too because the biggest providers are apple/google- who, as far as I know, do support attestation.
Not so easy.
I've worked at places where we use a password manager to manage lots of passwords for random services that we subscribe to. The engineering manager always says "you can put your own passwords in for free" and I say "no thanks, they're going to get hacked" and then six months later... they get hacked.
I use the password manager on my iPhone because it seems pretty secure and it is so miserable to type passwords in on a phone but my other solution for passwords has used cryptographic generation with the database playing only a secondary role and it is fine for passwords but does nothing for passkeys.
most will come with free personal accounts for employees, if they want and choose to set them up. those are separate, and have smooth offboarding for the no-longer-employee.
"free" because im not sure if your employer pays for it or if its like a free benefit to a bussiness licence
If I had to trade off the risk of a password manager being hacked versus password re-use, I'm going to strongly recommend to people generally to use a password manager. Yeah there's a lots of "if this, if that"--but that's almost a universally better risk for most people.
- User account with access to the SaaS password manager was compromised.
- User account with access to the SaaS password manager was compromised.
- User account with access to the SaaS password manager was compromised.
- Password safe file (keepass) was compromised/leaked and its (medium-strength) master password was presumably brute-forced.
EDIT forgot one:
- Password manager was used by a user-facing web backend, which unlocked it with an unscoped read-everything master password. Web backend was hacked, predictable consequences ensued.
Ideally you should be isolating your passwords across the company so that one user doesn’t compromise every login, no?
I am not GP. GP said:
> I say "no thanks, they're going to get hacked" and then six months later... they get hacked.
I interpreted that to mean "they (the passwords) were compromised" not necessarily "they (the password vault provider) were compromised".
> you should be isolating your passwords across the company so that one user doesn’t compromise every login, no?
Correct.
> When it is present, WebAuthn attestation tells the site the make and model of the authenticator, identified by its AAGUID, with a certificate chain from the vendor to back it up. It says nothing about your OS, your browser, your extensions, whether your phone is rooted or jailbroken, your firmware version, or even what colour it is.
So if I was Netflix or a bank or w/ever I'd only allow new registrations from "trusted" authenticators, which would incidentally only run on iOS and play-protected Android.
Dear Yubico / Kensington / Google Titan, can I export my private key components to this other device, or even print them out on paper for storage?
No - you're just an untrustworthy user granted the fleeting privilege of using BigCorp devices. Now stop asking such questions or you might have your attestation revoked.
Largely false. The Pixel verifies the OS and will reveal `verifiedBootState != Verified` on GrapheneOS in the attested passkey at registration, which websites may choose to reject. Apple Silicon has an undocumented SEP which prevents Asahi Linux from accessing it. There may be other examples now or in the future.
Also, I think you can deduce the device color from [1] on Android.
So, in conclusion: https://storage.ghost.io/c/ee/88/ee889f88-37ef-43e5-9180-f9b...
[1] https://source.android.com/docs/security/features/keystore/a...
https://github.com/keepassxreboot/keepassxc/issues/10407#iss...
https://github.com/keepassxreboot/keepassxc/issues/10406
"The unfortunate piece is that your product choices can have both positive and negative impacts on the ecosystem as a whole. I've already heard rumblings that KeepassXC is likely to be featured in a few industry presentations that highlight security challenges with passkey providers, the need for functional and security certification, and the lack of identifying passkey provider attestation (which would allow RPs to block you, and something that I have previously rallied against but rethinking as of late because of these situations)."
"This implementation is not spec compliant and has the potential to be blocked by relying parties."
Proponents keep trying to hand wave away the attestation lock-in problem as some vague faraway threat that we may never encounter. It isn't. It's the actual plan.
> I have a sneaky suspicion that some of our failures with various RP's is because they are only accepting certain authenticator GUIDs.
This comment from the KeepassXC maintainer makes me feel like the whole spec is already completely flawed if such a situation is even possible.
---
The author has strong incentives for the success of passkeys.
1. Scott Helme is founder and CEO of Report URI, and Companies House records his ownership at over 25% and up to 50%. Report URI markets a "Passkeys Protection" offering, giving him a commercial interest in services for passkey adopters.
2. His WhyNoPasskeys.com campaign pushes websites to adopt passkeys, is sponsored by Report URI, and promotes its passkey protection services. The "Passkeys Are Not a Trap" article also carries a Report URI sponsor banner.
3. Troy Hunt, Helme’s Report URI business partner and investor, joined 1Password’s advisory board in 2020; Helme has also appeared in Hunt’s 1Password-sponsored content. That establishes an indirect vendor connection.
It's not because people are bought by the powers that be, it's the way the world works. People enter the fields they have expertise in.
I know where my password manager syncs, it's on all my devices. Passkey prompts always seem confusing, I don't know if it's going to save to my browser, or my OS, or if those are gonna sync on what devices. It's just more confusing.
What would I gain from using a passkey?
The correct question is What did others gain?
- Phishing free press fingerprint or faceID or Windows Hello for login into many important sites
- many people don't have time to type password, then otp. If most of the world did that then this would not be needed.
- And finally, YOU are not OBLIGED to use it. Let the rest of population use it.
- It is like SOME pay with phone/NFC-Watch etc. MANY still use card or cash...
They are.
The number one gain I see with passkeys is that they are phishing resistant. The biggest issue I've had with TOTP keys is they aren't phishing resistant.
Forcing people to use passkeys gives the authentication layer a stronger means to ensure that people are logging into the correct domain. A password manager accomplishes this, but it's very difficult to enforce. (I've heard a number of variants of "John Smith sent me an important document and when I went to open it, the password manager didn't work so I just copied password")
This cannot happen with passkeys at all because crypto magic.
My password manager matches off of domains too, so it wouldn't suggest to autofill on a phishing site.
you can have a TOTP variant which has the browser display a challenge string & QR code, authenticator generates a 5-6 digit response. include more entropy in the response if you want to do away with the password entirely.
passkeys are trash, I would never opt for dedicated hardware (or a cloud service) and using them with a password manager is extremely messy when you want the password manager to be properly isolated from the rest of your system.
I don't use passkeys anywhere for fear of losing access. I just don't care enough to study how it really works. With passwords, I occasionally print out all my important passwords and store them in a safe and I know there's no way I could lose access.
I have to admit I don't worry too much about the entire internet flicking attestation=true anytime though, because the resulting support nightmare would be ferociously expensive. I wouldn't be surprised that, on its own, it would be more expensive than the cases that the companies flipping the switch are trying to avoid. Which means it isn't going to happen.
The simple truth is metaphorical-Grandma can't handle the degree of responsibility put on the user that strict hardware attestation implies. Netflix et al are more likely to want metaphorical-Grandma's money more than an incremental improvement in their ability to be sure it's an attested login, and won't want metaphorical-Grandma to call Netflix every other week trying to figure out how to log in again. There is no way around the fact that strict attestation implies more user responsibility to make sure they don't lose their token, and at scale, they absolutely will. Work environments can get away with this because work environments have a scalable mechanism to re-verify identity to the extent the business cares about it personally, and reissue tokens. At scale the big companies do not have this for individuals. You can't use hardware attestation without this infrastructure for reverification, and any infrastructure for reverification a large corporation tries to create will have exploitable holes in it.
Practical experience from Austria where attestation is used to limit which hardware tokens can be used for the EU digital identity: it sucks. You're limited to a very limited number of keys: https://www.id-austria.gv.at/de/hilfe/hilfe-zu-ida/authentif...
Now: will more people do this? I don't know. But I fault the standard for enabling it in the first place.
Exactly. From the page about the requirements for the app under 1) in your link:
> System requirements
> Android 12 or iOS 16
So one of four methods is, by default, already completely dependent on having an account with $american_megacorp.
4) is another app where it doesn’t outright say, but I’m guessing the requirements are also a mainstream OS, mobile at that as well since they seem to use biometrics.
That leaves 2) dedicated hardware and 3) dedicated hardware. Great. (see the “my house burned down” article/thought experiment as to why I’m against that.)
That's where the trap is.
One of the most frustrating issues with Apple's UX.
This is your cue to go get your parents to add you as recovery contacts for their Apple account now, rather than finding out that exists when they lose their phone.
> That person is fucked when they lose their phone anyway
I am hoping nowadays most people lock their devices. I rarely see unlocked in my adventures anymore.
I'm generally pro-passkeys, but also acknowledge they are a hot mess for the average non-techy consumer. And there does seem to be room for the screws to tighten, and we definitely need to resist that.
Passkeys have benefits - but they also have problems. Many people just don't think the benefits are worth the problems. And many people are afraid that sites will just stop accepting passwords in favor of passkeys, leaving people worse off.
State Farm is the only place I've actually liked it. I don't have to type ANYTHING in.
Open browser, open password manager, click the "sign in with existing passkey", browser and password manager talk, prompt me to confirm the passkey choice, and I'm in.
Most sites I've messed with insist on you entering a username first.
> This one can be tricky because I've seen many sites using passkeys to replace passwords, but that's not something we've done on Report URI, passkeys are used as a 2FA mechanism.
Source: https://scotthelme.co.uk/xss-is-deadly-for-passkeys-the-hidd...
Maybe it was too strong to say the were a "trap", but it is also too strong to say there is no worries here.
> This one can be tricky because I've seen many sites using passkeys to replace passwords, but that's not something we've done on Report URI, passkeys are used as a 2FA mechanism.
[0]: https://scotthelme.co.uk/xss-is-deadly-for-passkeys-the-hidd...
I agree - and that makes me wish that the messaging was more clear from passkey supporters. Some may be genuinely confused and talking about one or the other mode (or not even realize that multiple modes exist), and some may be trying to claim the benefits of one mode while/or handwaving away the tradeoffs of the other mode.
That is your choice as the user. You can use the default credential manager that is offered out of box, or you can use your own.
https://whatarepasskeys.info
As for choice as the user, it's a choice "for now"... and only for users who understand all of these details (which seems unlikely).
Personally, my observation is that if one tries to properly configure 2FA with any major website lately (no, I don't mean AWS console), the level of "your choice" and properly implemented security has actually gotten worse...
I don't know when it started, I don't know who is to blame, but we've definitely arrived at a conceptualization of "the user" that is passive, uncurious, and incapable of being talked to like an adult.
Me: The person who posted this post critical of The King on Facebook was totally not me!
Police: Here's "a WebAuthn attestation" that told Facebook "the make and model of the authenticator, identified by its AAGUID, with a certificate chain from the vendor to back it up" and it fits Evidence A.
No thanks.
Passkeys face the same problem as the USB-C rollout. Lots of different incompatible implementations and standards rolled under one name that are almost impossible to distinguish between. Very little education on how to use it and be prepared for it.
The difference is that the consequences of getting passkeys wrong for the user is significantly greater than getting the wrong cable, and while the latter can easily be fixed, the former may be irreversible.
And the solution was: make it the user's problem.
Yay.
Currently they aren't tied to that root of trust.
Most of those organizations have shown that they don't want people owning their own devices or being able to run their own software, and they use developer attestations, IE a revocable programming license to accomplish that.
Tools like android's safetynet makes it so that you can't run banking apps on a phone running your own software. One that bypasses developer attestations.
Passkeys are currently an open standard, but attestation is built in such a way as that it could be only usable on n approved operating system with programmer licenses.
Big websites like amazon, or websites you need to exist in society, could gradually start requiring the usage of attested passkeys.
---
There is a clear path from passkeys to the death of general purpose computing for 99% of people. Don't be a useful idiot, don't assume these corporations have your best interest in heart. See this for what it is, a path towards killing people's ability to run unlicensed software on their own devices.
> If a consumer website decided tomorrow that it would only accept attested passkeys, it would lock out almost all of its own users, instantly. What website is going to do that? Besides, the guidance for consumer sites has been to not even request attestation for years now.
This isn't a rebuttal to the claim that they're a hidden dial. It's just saying that it's too early to crank the dial.
>Attestation Isn't What You Think It Is
>The post describes attestation as proving "that an approved passkey manager, operating system, and firmware are in use" which is simply not true.
>When it is present, WebAuthn attestation tells the site the make and model of the authenticator, identified by its AAGUID, with a certificate chain from the vendor to back it up. It says nothing about your OS, your browser, your extensions, whether your phone is rooted or jailbroken, your firmware version, or even what colour it is.
This point is bypassed by websites only supporting specific authenticators and then those specific authenticators only supporting specific devices/OSs/browsers/etc via other attestation frameworks.
The big players who want to gatekeep you in their ecosystem do not want attestation - they want you to give them your passkeys for them to store under the guise of "hey, we'll sync it for you!".
A yubikey is easy to use. Buy a second as back-up. If you're clumsy and lose things all the time then set up recovery codes. Add a recovery contact. Use insecure 2fa like TOTP or really insecure 2fa like email/sms/etc. codes.
There's plenty of options for authentication in the modern world and passkeys are at the top. If users are 'too stupid' to use them then that's a user problem.
I'd rather spend the 5 minutes reading how these things work and then not hand the keys over to big tech.
You can’t just stop using those websites if your university uses them for student/employee accounts.
Wishful thinking. Sadly, the vast majority of people will be perfectly OK with a website telling them they have to use a recent iPhone or Play-enabled Android phone to do something. This is already the case for banking apps and a huge number of other phone-app-only services.
Contributions and feedback are welcome! GitHub link is at the bottom of the page.
[0] http://www.erights.org/elib/capability/delegations.html
Passkeys are the second prong of the age verification push.
If you want more evidence, read up on Project 2025’s plans for forcing the internet to adhere to American Christian Nationalist values, then try to figure out how that could work in the absence of passkeys.
Otherwise, it is a trap. The story of the last 25 years of the internet is user hostile ratcheting away of the open web. Passkeys are obviously another step in the process.
True, but doesn’t actually refute the original.
I'm sorry, but if your system allows someone to make a credible threat like this, you should make sure to redesign your protocol so that kind of abuse is not possible BEFORE advocating for it. I'm so incredibly sick of people repeating history, only to disappear once we're all roped into yet another anti-user scheme.
And yes, passkeys absolutely ARE a trap.
[0]: https://github.com/keepassxreboot/keepassxc/issues/10407#iss...
[0]: https://support.1password.com/export/?ios
> 1Password for iOS exports ... directly to other supported apps, including your passkeys.
They pick the list of other supported apps. There is no ability to export to a standard encrypted file, nor is there a way to develop an open source app that can receive an export over the objections of 1Password Inc.
Passkeys are a trap, trying to lock users in to the service providers.
I did say I like and use 1Password, but I do remember that they switched from a one-time payment model to a subscription model, and have now stopped supporting the old software and only support their subscription software. If it wasn't for my non-tech-savvy, aging family I support their usage of 1Password for, I would still be on Keepass[XC] for my own private usage.
Since passkeys are tied to verified devices, they guarantee absolute de-anonymization -- and further spread that advertising "wealth" by seamlessly linking across devices, and therefore to their respective corporate stakeholders (i.e. via bluetooth to conveniently login on a laptop via a phone-domiciled passkey).
Username + password at least requires circumstantial marketing analysis to "verify" whether a user is who marketers think they are. But with passkeys, your login confirms your Windows account ID, cell phone MAC address, home address, what have you.
Every single IT person thought it would be an extreme mess, too complicated for regular users. In my company we work on the (gas) grid so lot's of blue collar types.
We went there, gave the pilot group a Yubikey and said: This is like the company pass you already have. Without the company pass you cannot enter any buildings. Without the Passkey you cannot enter a computer or app.
If you lose it report to the same people (service desk).
The response has been EXTREMELY POSITIVE. People fucking LOVE getting rid of passwords, password requirements and taking off their gloves to enter it every time.
We are now rolling it out to everyone and next year when we stop our silly "phishing game" contract we will actually save money while reducing a massive cyber security risk for our company: (voice) phishing.
I mean you're logging in to some software, surely they need some info from you?
Initially, they will probably “just” require hardware serial numbers or similar (so they can join IDs on the backend).
There are already serious proposals to require live web cam feeds for porn site login biometrics purposes, so I can’t really come up with any hyperbole to add.
I think they've been implemented well in some cases. I think they've been implemented poorly in others.
So it goes.
I keep seeing major players promoting their own apps over standard TOTP, which I guess could be seen as a sort of proprietary passkey. Shopify, Google, Microsoft, and more, they all want you to download their app for MFA, instead of using a very open format.
As someone who works in IT, I just can't even imagine myself doing this. I have probably around 60 codes in my Aegis, how would it look if I had just a quarter of those in apps instead?
But the main issue I have with passkeys is the simple issue of backups. I can backup my Aegis keys, I can't backup an app, or a hw passkey. I have to get a second one, and keep signing for it or something, not sure of the details, I just know it would be a major hassle. And there is no way I'm trusting a little usb device to not break.
Right now I see no compelling reason to switch from regular OTP codes, change my mind.
The phishing potential?
Just came back from doing a bit of research and apparently I can use Bitwarden to generate and store passkeys.
I have been dismissing the entire concept because I assumed it had to do with hardware keys, which I would never trust. But if it's bitwarden, then I can easily do a backup, and that would be very reliable.
I think I'm going to start using passkeys... :D
>If a consumer website decided tomorrow that it would only accept attested passkeys, it would lock out almost all of its own users, instantly. What website is going to do that?
The original didn't argue that, nor has absolutely anyone else concerned, nor has that been what has happened in historical examples people were concerned about. Because yeah of course that's ridiculous, it's "boiling a frog" by throwing it in already boiling water, that's not how it works. If anyone has freedom-reducing longer term plans for use of passkey attestation, the emphasis is on "longer term", being malicious doesn't mean being stupid. Step 1 is obviously getting people into the passkey ecosystem and out of passwords at all, which could well take years. And importantly as much as possible into closed passkey ecosystems. This is indeed one of the initial danger signs, because the author:
>iCloud Keychain, Google Password Manager, 1Password, Bitwarden
Is mixing together things that aren't like the other. Quick author, what's the EXPORT story for each of these ecosystems? Of those, Bitwarden can export a passkey into a plain JSON if you want. Do the others support that too, or at best only "app to app" encrypted transfer, creating a closed ecosystem? Already, can I get passkeys from iCloud/Google/1Pass into KeePass? Or is this restricted """for my protection :^)"""?
Author doesn't even touch on the lock-in that's already beginning. And right now everyone can technically claim "oh no of course you're not locked in! You just have to use an official option, or you can merely visit hundreds of sites individually and register new passkeys in all of them". Is it hard to see how players like Bitwarden would be pressured on continuing to offer plain export?
Then when most of the population is using passkeys everywhere in a closed ecosystem, now what is the response if friction slowly starts getting added. OK, you can still use what you like, but only export to other approved players. OK, you can still use unattested, but it's off by default now, "advanced users" can go enable it with this checkbox in the settings. OK, manual is still an option, but now it's buried deep and behind dark patterns and requires a text command. Hi everyone, we have statistics to show that only 0.85% of our users still use unattested keys. The support burden and security risk is now too high."
Like, we've seen this movie before.
I still prefer a good password written down in a paper book, with multiple methods of 2FA. But I know there are attack vectors for that.
The problem to me is that passkeys assume the user owns the device and CAN choose to make a single store authoritative for their credentials. The only professional environments I've encountered that haven't/wouldn't hit this issue are ones small enough that they don't really have device or security governance in place which you can't use as a secure reference baseline.
Until we change our laws in the US on this front, I will continue to use passwords and hardware keys separate from my phone box.
no thanks, passwords are not a burden to me
A defining feature of traps is that they start out good.
There are a lot of good points in this article, but it fundamentally missed the point of the word trap. The most it said on that topic is:
Which is a statement about the near future. There is room for a conversation about the long term, but this article is not a part of that conversation.> If a consumer website decided tomorrow that it would only accept attested passkeys, it would lock out almost all of its own users, instantly. What website is going to do that?
Any of them? All of them?
"Starting next year, only Google Authenticator and Google Chome passkeys will be valid for gmail logins. Help us keep your account safe by limiting access so ONLY YOU can read your emails"
"Good news! Your Instagram account is getting safer from hackers and spammers. As of next month, you'll use your Meta Metaverse token for all logins to Instagram, Facebook, Theads and WhatsApp"
Google already forced OAuth2 on Thunderbird [0] and the rest of the email-client universe.
[0] https://support.mozilla.org/en-US/kb/automatic-conversion-go...
The whole point of OAuth2 is to allow logging in to some untrusted 3rd party site via an authentication provider without having to key your password into the 3rd party site.
a) Local client software like Thunderbird is/must be trusted, it's not a random 3rd party website.
b) App passwords remove the risk of Thunderbird stealing your password, even if for some reason you didn't like typing a password into Thunderbird.
c) Google is both the Authentication Provider and the Resource Server in this example, so it adds zero security.
An app password is basically just an API token, it's up to the backend what powers it grants.
Also, is there a reason Thunderbird or other clients couldn't use OAuth? I'm fairly certain I can login to GMail on Mail.app in macOS and other clients, so they're not using that to lock people into the official app or their browser
I assume Mail.app had to do the same.
OAuth wasn't about lock-in (since any client can support it), it was about getting off shitty legacy auth
You shouldn't need a web browser to read email.
Passwords just suck. If we're all going to use password managers anyway, what is the point? Might as well use a randomly generated passkey.
QED, a trap.
If there is any unique id that can track you, then it's a trap. No security system should be leaking unique ids that can be used to track users.
Few weeks later
>let me tell you why you should NOT use XYZ!!
Classic HN.
That being said, password and 2FA is the best combo, where you control the token of the 2FA and it’s on a separate app/platform/etc than where you have your passwords.
The standard and implementations are also unnecessarily complex and obtuse. IMHO passkeys are not a good technology.
On topic, I’m not sure I even trust my own password sanitation, and seeing service A and B hacked every other month, I feel weary. Knowing that someday my passwords might be compromised as well, so what should I do as just a person who can’t remember things? Write them down, I guess.
Which in turn makes it harder to track vs. your /64 which is approximates your old NAT'd public IPv4.
> Thankfully someone with some sense
Cannot be asserted with this:
> I saw that post title and didn't even bother to read it.
Can you help me figure out some things?
1. One time when I was abroad in Poland, a thief walked into my room at night and stole my wallet, phone, and laptop.
(The thief was eventually caught 6 months later, but that's another story).
Question: what to do in that case if I were using passkeys?
Is there a solution that doesn't require trusting a cloud provider?
2. Currently passkeys are offered as an alternative to passwords. What are the mechanisms that require passwords to be available as well?
I.e. what stops my bank from simply giving me a passkey at a branch and offering no other option?
3. Clouds are currently the easiest way to use passkeys. Last time I checked, you were locked into that cloud, but things move fast.
What ensures the ability to move the keys out of the cloud?
And what do I need to do to have my own "cloud" like that?
4. What protection does the passkey ecosystem offer for physical threat to the user?
With passwords, there's no way for anyone to know which Hacker News accounts are mine, or whether I still have access to them. I don't remember has plausible deniability (who hasn't ever forgotten a password?).
With passkeys, getting detained with your device means surrendering all your passwords, to my understanding.
What am I missing?
Thanks!
The spec requires passwords to still be an option, they say, so there's nothing to see here, move along — and avert their eyes should an inconvenient argument come their way.
Because, see, we all know that specs are ironclad, never change, and are always fully implemented.
Also, putting all your eggs, ahem, passkeys into one cloud basket (as this article recommends) to "move around" is surely the most best solution better than passwords.
Because we can always trust the cloud, right? Not like it's somebody else's computer or anything, that they can instruct to not do what you tell it.
Anyway, none of the passkey lovers ever answered me what to do if my computer and cell phone ever get stolen again when I'm traveling abroad in the Brave New Passkey World.
The best answer I got was carry a yubikey with me at all times.
One more thing to worry about losing, yay. Much convenience, very security, wow.
If there are any new developments on that front, would love to hear them.
Do passkeys have issues? Sure. Most of them are UX and are being worked on. As a user, I 1000% immediately register a passkey when a site or app offers it as at least on iOS and macOS, it is a superior user experience IMO and more secure. I never worry if I'm getting prompted for a Passkey, am I on the right site?
Also the remote connect functionality of modern browsers and mobile operating systems makes it trival if I need or want to sign into a personal account on my work PC where my personal passwords are not sync'd. Need to get into my personal GMail in an incognito window at work? No problem at all.
Anti-Passkey folks are just people who want to be against something to be against it
Now they expect you to always use them to login on all devices.
I had to remove my passkey from one device for these services because i also use a PasswordManager and I do not trust my local chrome installation to just manage my passkey.
I want to have a Password Manager which I need to unlock when I use it. I also want to keep my 2fa and not break it due to passkey usage.
GitHub was also super shitty with it, suddenly a passkey broke my YubiKey login...
If it was easy to migrate between services, then i would be a lot more open to using passkeys.
Also, many if not all of the sites I've got passkeys setup with support multiple keys, which I sometimes take advantage of. For example I've got a passkey into my Google account in my Apple account ecosystem but I also have a physical Yubikey setup as a Passkey device, in case I were to get locked out of my Apple account
On my MacBook with the latest macOS I still can't use them.
I use Brave and 1Password. Clicking the Use Passkey button typically results in some Chrome Bluetooth permission dialog rather than accessing my PassKeys.
I tried to look into this once or twice with no success.
I suspect macOS is at fault. Apple does not seem to care about getting basic functionality right.
To this day Universal Clipboard between the MacBook and my iPhone does not work half of the time.
Do you have bluetooth disabled half of the time?
I believe a reboot sometimes restores functionality.
Plus, none of the sites that I use passkeys for would I be locked out. They all have account recovery procedures just like if I forgot my password. And, finally, for the important ones like my Google account (where my email lives) I have other non-Apple devices like a Yubikey setup as additional Passkey/FIDO authenticators
How do you log in without having the passkey?
One might say "just use a password/credentials manager", but all these passkey prompts don't emphasize that you should use one that is not tied to hardware, or that you should backup your passkey to a thumb drive, or anything like that.
Same reason I hate TOTP that is tied to a device. If you require me to have proprietary 2FA apps on my phone to login to your account, I don't use 2FA. Looking at you, Steam.