• 📛Maven@lemmy.sdf.org
    link
    fedilink
    English
    arrow-up
    64
    arrow-down
    4
    ·
    1 year ago
    1. Password managers are, generally speaking, far more security conscious than the average website. I’d rather send a password to my password manager a couple times a day than send passwords to every website I interact with.

    2. One click to confirm vs. 2-3 to autofill. Tiny gains in speed 🤷‍♀️ If you make a password manager even slightly more convenient than just using gregspassword123 for everything, you can onboard more normies.

    • Lem453@lemmy.ca
      link
      fedilink
      arrow-up
      18
      arrow-down
      2
      ·
      1 year ago

      Most people that have password managers are already using different passwords for each website. Usually randomly generated. What’s the difference between that and a passkey?

      • jet@hackertalks.com
        link
        fedilink
        English
        arrow-up
        19
        ·
        edit-2
        1 year ago

        The secret key pair of a passkey is never transmitted over the internet. Even if somebody snoops the authentication, they will not be able to reproduce the secret key to login in the future.

        Think of it just like SSH public and private keys.

        Normal passwords, are typically provided at login time, and get transmitted, relying on HTTPS to keep them secure, if somebody could observe the authentication, they could reproduce the password later.

        (Yes someone could hash the password client side and send over the output… But that’s extra work and not guaranteed)

        • towerful@programming.dev
          link
          fedilink
          arrow-up
          9
          ·
          1 year ago

          Client side hashing of a password just makes the hashed result the password, as far as security is concerned.
          Unless there is some back-and-forth with the server providing a one-time-use salt or something to make each submission of the password unique and only valid once, at which point that might get snooped as well.
          Better off relying on client certificates if you are that concerned

        • Lem453@lemmy.ca
          link
          fedilink
          arrow-up
          4
          arrow-down
          1
          ·
          1 year ago

          Ah, thanks for that explanation. That makes sense. Eliminates a possible attack vector with https

      • AmberPrince@kbin.social
        link
        fedilink
        arrow-up
        9
        ·
        1 year ago

        A pass key is the private key in a private/public key pair. The private key is stored in the TPM on your device. The website contains the public key. When you use your “one password” you’re in effect giving your device permission to access the key storage in your TPM to fetch the private key to present it to the site.

        What this means in practice is that if a website has a data breach they won’t have your hashed password, only your public key which… is public. It doesn’t and can’t do anything on its own. It needs the private key, which again only you have and the website doesn’t store, to do anything at all.

        If you want to read more about it look into cryptographic key pairs. Pretty neat how they work.

        • jet@hackertalks.com
          link
          fedilink
          English
          arrow-up
          3
          ·
          1 year ago

          I’m not sure there’s a requirement for the TPM to be used. To me that would imply the private key is stored in the TPM so you couldn’t export it. But a lot of the passkey providers have remote sync available.

          Which to implement, would mean they’re storing the key outside of the TPM, but using the local TPM to decrypt the secret stored outside of the TPM. IE the certificate payloads are decryptable by a variety of keys that are stored in different TPMs. There’s lots of assumptions here of course.

          • Natanael@slrpnk.net
            link
            fedilink
            arrow-up
            1
            ·
            1 year ago

            It would be backed up at the point of provisioning.

            A TPM can be set to allow exports or block them, so if you program the TPM to export a key once and then flip the switch to block exports then you can have this kind of backups and synchronization

        • meteokr@community.adiquaints.moe
          link
          fedilink
          arrow-up
          3
          ·
          1 year ago

          When you use your “one password” you’re in effect giving your device permission to access the key storage in your TPM to fetch the private key to present it to the site.

          Very small correction as I understand, but your private key is never presented. The web service should never interact with the private key directly. Your device is signing some bit of data, then the server uses your public key to verify that it was signed by your private key. Its a small distinction, but is one of the principal uses of asymmetric encryption is that the public key can truly be public knowledge and given to anyone, while the private key is 100% always only accessed by you the user.

          • Natanael@slrpnk.net
            link
            fedilink
            arrow-up
            2
            ·
            1 year ago

            Yeah, the TPM should perform the signature inside of the security chip, the key is always off limits from everything else

      • 📛Maven@lemmy.sdf.org
        link
        fedilink
        English
        arrow-up
        9
        arrow-down
        1
        ·
        1 year ago

        Right. Most people that have password managers. Making a password manager easier and more convenient to use means some portion of people who aren’t using one may start.

        • Amju Wolf@pawb.social
          link
          fedilink
          arrow-up
          3
          ·
          1 year ago

          Realistically this is the biggest overall advantage.

          Sure, there are minor advantages to people already using password managers, but that’s such a tiny minority of people…

      • Natanael@slrpnk.net
        link
        fedilink
        arrow-up
        2
        ·
        1 year ago

        Passkeys use cryptographic keys held client side which are never transmitted, they user cryptographic challenge-response protocols and send a single use value back. You can’t intercept and reuse it unlike with passwords.

    • locuester@lemmy.zip
      link
      fedilink
      English
      arrow-up
      5
      arrow-down
      2
      ·
      1 year ago

      But does their advantage in security overcome the fact that they’re a much larger target?

      It’s similar to how money under a pillow could be safer than money in the bank; depending on who you are.

      • 📛Maven@lemmy.sdf.org
        link
        fedilink
        English
        arrow-up
        5
        ·
        edit-2
        1 year ago

        In general, yes. Big sites get hacked all the time. Passwords from those sites get cracked all the time. Anyone who uses the same password on multiple sites is almost guaranteed to have that password stolen and associated with a username/email at some point, which goes on a list to try on banks, paypal, etc.

        Conversely, to my knowledge, there has been one major security breach at a password manager, LastPass, and the thieves got more-or-less useless encrypted passwords. The only casualty, at least known so far, is people who used Lastpass to store crypto wallet seed phrases in plaintext, who signed up before 2018 when the more secure master password requirements were put in effect, chose an insecure master password, and never changed it once in the four years prior to the breach.

        It’s not perfect, but the record is lightyears better.

        Put it this way: Without a password manager, you’re gambling that zero sites, out of every single site you sign on to, ever gets hacked. From facebook, google, netflix, paypal, your bank, your lemmy or mastodon instances, all the way down to the funny little mom-n-pop hobby fansite you signed up for 20 years ago that hasn’t updated their password hashing functions since they opened it. With a password manager, you’re gambling that that one site doesn’t get hacked, a site whose sole job is not to get hacked and to stay on the forefront of security.

        (Also, you don’t even have to use their central servers; services like BitWarden let you keep your password record locally if you prefer, so with a bit of setup, the gamble becomes zero sites)

        • locuester@lemmy.zip
          link
          fedilink
          English
          arrow-up
          2
          ·
          1 year ago

          I use a different password for every site tho. Using same pw for every site, that’s another extreme entirely.

          • 📛Maven@lemmy.sdf.org
            link
            fedilink
            English
            arrow-up
            4
            ·
            1 year ago

            Most people do not. The average user has one or two passwords, and maybe swaps out letters for numbers when the site forces them to. Because remembering dozens of passwords is hard. If you, personally, can remember dozens of secure passwords, you’re some kind of prodigy and the use-case for a password manager doesn’t apply to you, but it still applies to the majority.

            • locuester@lemmy.zip
              link
              fedilink
              English
              arrow-up
              2
              arrow-down
              1
              ·
              1 year ago

              One doesn’t have to remember dozens. Just a basic algorithm for deriving it from the name of the site. Complex enough that it’s not obvious looking at a couple passwords but easy to remember.

              This method works for me. I understand its dangers (can still correlate. Dozen passwords and figure out the algo). But it’s my current approach. I hate even discussing it since obscurity helps.

              • Amju Wolf@pawb.social
                link
                fedilink
                arrow-up
                4
                ·
                1 year ago

                Your system is most likely way less secure than you think. I mean, possibly not since you’re here, but most schemes are trivial to solve even automatically.

                …and that doesn’t really matter either, because so many people have such shitty passwords (and use the same ones everywhere) that noone really bothers checking for permutations when they have thousands of valid accounts.

                But if truly enough people are convinced to be more secure your scheme may eventually become a target, too.

                With passkeys (and password managers in general) the security gets so good that the vast majority of current attacks on passeord protection get obsolete.

                • locuester@lemmy.zip
                  link
                  fedilink
                  English
                  arrow-up
                  2
                  ·
                  1 year ago

                  I agree 100%. As mentioned, I rarely share my approach and I’ll be deleting that comment in a bit. It works well for me.

                  No hacker is attempting to decode the password algorithm because they don’t know of its existence on my logins, and they have thousands of better ways to go - as you said.

              • 📛Maven@lemmy.sdf.org
                link
                fedilink
                English
                arrow-up
                4
                ·
                1 year ago

                Okay, I’m glad you have a system, but it’s not really relevant? I didn’t say you should use a password manager. I said it’s good for the majority of people who can only remember one or two passwords.

                • locuester@lemmy.zip
                  link
                  fedilink
                  English
                  arrow-up
                  2
                  ·
                  1 year ago

                  I’m of the mindset that locally stored keys and/or social solutions are better than throwing all passwords in a single place.

                  All passwords for large amounts of people in a single place is begging for a break-in.

                  I spend a lot of time studying solutions in this space as I’m a long time crypto solutions dev. Lots of ideas and discussions to be had.

                  I’m not disagreeing with you, just having a dialogue.

                  • 📛Maven@lemmy.sdf.org
                    link
                    fedilink
                    English
                    arrow-up
                    3
                    ·
                    1 year ago

                    That’s probably true, but perfect can’t be the enemy of good. Getting everyone who currently uses the worst method (a single global password) to use a better method means that better method has to be easier than that, and as things lie right now, most security researchers agree that the method most likely to succeed is removing roadblocks, both client-side and server-side, to make password mangers even easier and more secure (whether you want to store it locally or not is really up to you, and again, it is already an option). We’re not talking about people who already try to stay secure, or care about the exact details. You and I already know we care about security and do our best, presumably. The crucial thing is to onramp Bob Q. Public, the middle manager whose password on everything is rover73 because he loves his dog, and any solution more complicated than remembering one password and clicking one button is going to be too much change for him to get around to doing it