Passkey is some sort of specific unique key to a device allowing to use a pin on a device instead of the password. But which won’t work on another device.
Now I don’t know if that key can be stolen or not, or if it’s really more secure or not, as people have really unsecure pins.
While I would agree this sounds more secure, I’m always worried about people getting further locked in to Google’s products.
Hopefully this system won’t take accounts “hostage” by requiring you use Chrome to log in to them, but it’s Google, so…
We’re sorry, Firefox cannot access your IMEI to fingerprint your device. Please use a modern web browser like Chrome, Chrome, or maybe try Chrome.
Yet another anti-consumer, anti-privacy, “for the sake of children!” Type tactic from Google.
Mozilla is in the process of implementing passkeys in Firefox. This page tracks the status of various implementations of passkeys.
Did you just make up something that could happen and then get mad about it?
Satire typically highlights something that has happened, not something made up.
Passkey is an open standard. It’s not Google specific.
it’s passkeys. they are getting integrated in a lot of stuff right now, including password managers like bitwarden
Mot likely it won’t need to have chrome. However maybe Google services may be required.
However it is also very likely, if a device cannot support such feature, it will only require a password and 2fa.
It’s definitely more secure, since stealing someone’s phone is much more difficult to scale up compared to stealing passwords.
I don’t think that access to your personal data/email/files being dependent on a battery-powered electronic device is a great idea, to be honest.
That’s why they invented chargers, eh.
But more seriously, there are recovery procedures if you lose a phone with or without a backup and if you are willing to share the keys with a cloud provider, you can also store them there and use them on any of your devices.
Or you can get something like a yubikey if the battery aspect is really that problematic for you.
The fact is that I fail to see something obviously wrong with outrageously long/complicated passwords managed by e.g. Bitwarden or the likes.
Bitwarden is also supporting passkeys, so it won’t make a difference for their users whether they use passwords or passkeys.
And the fact that you don’t see anything wrong is more a you problem. Boomer mentality, dude. Don’t became one.
Boomer you mom, idiot. Fuck off.
It would probably be better for you to explain what’s wrong and not just call them a boomer as if that explains it.
It’s not quite unique to a specific device. You can store your private key in a password manager or something similar, and then access it from other devices
Depends on your personal choice. You can definitely limit them to a single, hardeneddevice if you want the highest level of security.
For most users and most situations, a synced solution will be preferable.
But it becomes much easier if you want to compromise a specific target individual
No, not really.
Even if you want to target a specific user, it doesn’t become necessarily easier.
Unless you happen to target an individual that combines good password OpSec with shitty phone OpSec.
But I would expect those to be a minority.
Hi, yes, I am that minority
I have a 37 character password with both cases, numbers and special characters to login to my pw vault using long random strings
My phone has a swipe pattern lock since that is the safest lock option it allows in the first place. I wish I could lock it better, but the only other options available to me are a 4 character pin, and fingerprints/facial scan. I hope the problems with those are obvious
Couple that with the fact that I have a daily predictable commute in public transit where I have a habit to put my phone next to me during breakfast and you have a recipe for disaster.
Me, at the bank:
Robbers, as they enter the bank: everybody freeze
Me: ah shit
Robbers: everyone give me your phones
Me: aw hell naw
mission impossible style shootout
Nope. Not going to have my entire digital everything depend on me not losing or breaking a single electronic device.
You won’t need to?
The key is for a single device. Logging in on another one is going to generate another key.
They key is secured with the pin of the device, so when you try to log in, you can use the pin to log in, and not the password.
Would you have to set up multiple devices when making your account then, if you wanted more than just your phone?
Fuck google.
passkeys sounds good on paper and for most users on day to day stuff should improve their security. But the failure path is horrible and it happens at the worst case most of the time. If I have the keychain on the phone and lose it or is out of battery and usually happens that I need to access some service like email, then if the email provider starts forcing people to use passkeys or you only have that method on, then I’m locked out of the account and can’t use email. This will happen for all other services that one may need to use on an emergency. Personally I don’t like it.
Someone else correct me if I’m wrong but it works similar to PGP.
Background info:
- Your device generates two keys, a private key and a public key
- The public key can be given to anyone and the private key stays with you
- The public key is used to encrypt data and the private key is used to decrypt it
Usage:
- You sign up for a service with all the normal info minus a password and click submit
- In the background, a private key is generated and stored in iCloud Keychain, Google Passwords, or a 3rd party password manager (so all your devices can access it). A public key is also generated and given to the service
- Now you try and login. You enter your username and click login
- In the background, the server encrypts a challenge, token, or some piece of data and sends it to your device
- Your device decrypts that piece of data with the private key associated with the website
- At this point, your device either sends the decrypted data back to the server in exchange for an access token or maybe you decrypted the access token (not sure exactly how that will work. If it’s the former, the data would still be encrypted via ssl so only you and the server would see it)
- Now you are logged in
Closing:
So, it’s supposed to be more secure because every time you login, you never type in a password that gets transferred to the server for verification. The server is sending your device data to verify so that it can then verify you. This mainly prevents phishing and the reuse of passwords but I suppose if someone hacks into your iCloud account or whatever, they have the keys to the kingdom 🤷♂️
As you point out, the single point of failure is access to the passkey repository. Of course, this will usually be 2FA, so much more secure than simple passwords which people usually employ.
One major issue, IMHO, is vendor lock-in. I’ve no doubt Apple is going to make migration away from iCloud a huge pain in the ass. It’s just another way they’re going to make it difficult to leave their ecosystem.
I’m also worried about backups. People lose access to their Google and Apple accounts routinely for any and no reason at all. Will these keys be stored in the cloud? If so, access to EVERYTHING is just a capricious random algorithm away from being lost.
I wouldn’t touch any passkey system which doesn’t provide a seamless way to migrate away especially if I’ve lost access to my Apple/Google account.
How does this work with checking my emails on a public computer in a library, for example? Somehow my private key needs to be shared with the library pc?
Wouldn’t the private key stay in your phone and you’d be exchanging a challenge and a response?
deleted by creator
- Since passkeys are basically asymmetric keys, SSH technically had “passkeys” for years.
deleted by creator
Nothing of that?
You don’t need to export or know what is the key.
The key is different for each device.
i tested it on another device, it looks like it gets the passkey from the source device (not from cloud), i had to input the original device’s unlock pattern for it to work
And it’s expected as you still had that device. And it’s not the same key, a new key has been created for that new device. Now if that device cannot be accessed?
Here is an alternative Piped link(s):
https://piped.video/6lBixL_qpro?si=wFFQwrfjQBKDHs5B
Piped is a privacy-respecting open-source alternative frontend to YouTube.
I’m open-source; check me out at GitHub.
people have really unsecure pins.
Ok but what’s unsecure with ‘1111’ as long as I’m not telling the order of the digits to anybody?
It can be cracked in less than a second?
If someone never loses their phones, laptop… Maybe it’s secure.
But if someone steals it, how secure can it be? Is the key protected by the pin encryption? If so the encryption is now useless.
Here is a French video about Micode interviewing the French DGSE : https://youtu.be/g_jEz6aF2b4?si=-sUAIvDf4F7-7kGc
They crack the phone security in 4 seconds with the pin beeing : Mic0rp2022. The software used is hashcat, an open source tool.
Pretty sure he was being sarcastic
Here is an alternative Piped link(s):
https://piped.video/g_jEz6aF2b4?si=-sUAIvDf4F7-7kGc
Piped is a privacy-respecting open-source alternative frontend to YouTube.
I’m open-source; check me out at GitHub.
This is the best summary I could come up with:
Google is taking a big step toward making passkeys the default login option for its users.
Starting today, users logging in to personal Google accounts will be prompted to create and use passkeys instead of passwords when possible.
They’re both easier to use and more secure than passwords, so users no longer need to rely on the names of pets, birthdays or the infamous “password123.” Instead, passkeys let users sign in to apps and sites the same way they unlock their devices: with a fingerprint, a face scan or a screen lock PIN.
And, unlike passwords, passkeys are resistant to online attacks like phishing, making them more secure than things like SMS one-time codes.
Google has been experimenting with passkeys across numerous products, including Chrome, over the past year.
Users who want to forgo passkeys can uncheck the “skip password when possible” option in their accounts.
The original article contains 289 words, the summary contains 146 words. Saved 49%. I’m a bot and I’m open source!
This video about passkeys is fascinating. They are very secure even if your pin is 1234. The only way for someone to hack your account is if they have your device.
Here is an alternative Piped link(s):
Piped is a privacy-respecting open-source alternative frontend to YouTube.
I’m open-source; check me out at GitHub.
