Passkey is some sort of specific unique key to a device allowing to use a pin on a device instead of the password. But which won’t work on another device.

Now I don’t know if that key can be stolen or not, or if it’s really more secure or not, as people have really unsecure pins.

  • alvvayson@lemmy.world
    link
    fedilink
    English
    arrow-up
    33
    ·
    1 year ago

    It’s definitely more secure, since stealing someone’s phone is much more difficult to scale up compared to stealing passwords.

    • Engywuck@lemm.ee
      link
      fedilink
      English
      arrow-up
      33
      arrow-down
      3
      ·
      1 year ago

      I don’t think that access to your personal data/email/files being dependent on a battery-powered electronic device is a great idea, to be honest.

      • alvvayson@lemmy.world
        link
        fedilink
        English
        arrow-up
        7
        arrow-down
        5
        ·
        1 year ago

        That’s why they invented chargers, eh.

        But more seriously, there are recovery procedures if you lose a phone with or without a backup and if you are willing to share the keys with a cloud provider, you can also store them there and use them on any of your devices.

        Or you can get something like a yubikey if the battery aspect is really that problematic for you.

        • Engywuck@lemm.ee
          link
          fedilink
          English
          arrow-up
          15
          arrow-down
          4
          ·
          1 year ago

          The fact is that I fail to see something obviously wrong with outrageously long/complicated passwords managed by e.g. Bitwarden or the likes.

          • alvvayson@lemmy.world
            link
            fedilink
            English
            arrow-up
            4
            arrow-down
            13
            ·
            1 year ago

            Bitwarden is also supporting passkeys, so it won’t make a difference for their users whether they use passwords or passkeys.

            And the fact that you don’t see anything wrong is more a you problem. Boomer mentality, dude. Don’t became one.

            • Kusimulkku@lemm.ee
              link
              fedilink
              English
              arrow-up
              11
              arrow-down
              1
              ·
              1 year ago

              It would probably be better for you to explain what’s wrong and not just call them a boomer as if that explains it.

              • alvvayson@lemmy.world
                link
                fedilink
                English
                arrow-up
                2
                arrow-down
                10
                ·
                1 year ago

                If they want to be a Boomer and stick to 20th century solutions, why should I care?

                If it works for them, fine. Nothing wrong with that.

                It’s obviously not working for most people. Most people reuse weak passwords and get their passwords hacked. Passkeys solve that for those users.

                That’s why the whole industry is shifting to passkeys.

                • Kusimulkku@lemm.ee
                  link
                  fedilink
                  English
                  arrow-up
                  10
                  arrow-down
                  1
                  ·
                  1 year ago

                  “It’s old so it’s bad” is not a very convincing argument.

                  I think he was wondering how technically the new solution is better, especially compared to password database solutions where complex password and password reuse isn’t an issue.

                  • Natanael@slrpnk.net
                    link
                    fedilink
                    English
                    arrow-up
                    1
                    ·
                    1 year ago

                    Webauthn has domain bindings and single use challenges which prevents MITM credential stealing, etc

                  • alvvayson@lemmy.world
                    link
                    fedilink
                    English
                    arrow-up
                    2
                    arrow-down
                    8
                    ·
                    1 year ago

                    I said the exact opposite. If the old thing works for you, go ahead and stay on it, but don’t complain about the rest of the world improving and moving forward.

                    Why put quotes when you are misquoting…

                    And I answered him, he just doesn’t want to know. I can’t solve that.

                • wildginger@lemmy.myserv.one
                  link
                  fedilink
                  English
                  arrow-up
                  3
                  ·
                  1 year ago

                  It kinda sounds like you dont actually know whats wrong, and are just blindly following the trends.

                  Doesnt that make you the boomer?

            • V0lD@lemmy.world
              link
              fedilink
              English
              arrow-up
              4
              arrow-down
              1
              ·
              1 year ago

              What do you see that’s wrong with it that we don’t if I may ask?

              • DeadlineX@lemm.ee
                link
                fedilink
                English
                arrow-up
                7
                ·
                1 year ago

                Mostly phishing. Passkeys can’t be phished. And really, passwords are awful in general for security purposes. You don’t have to use your phone or google or apple or whatever.

                I actually have a physical usb key that I use as a passkey. Its just a more secure login implementation and will likely be the only option in the future.

                • hedgehog@ttrpg.network
                  link
                  fedilink
                  English
                  arrow-up
                  2
                  ·
                  1 year ago

                  Passkeys can be phished, it’s just much more difficult than with passwords, TOTP MFA, SMS MFA, other OTPs, or push notification-based MFA (e.g., Duo or the way Microsoft, Apple, and Google push a notification to their app and you confirm and/or enter the key).

                  Passkey is extremely phishing resistant in the same as Webauthn MFA and U2F MFA are, in that origin checks by the browser prevent attackers from initiating the auth process. But it can still be attacked in these ways:

                  1. XSS bug in the target website
                  2. Browser vulnerability
                  3. Malicious browser (not a concern on iOS but a concern everywhere else)
                  4. Compromise of any cert in the chain between you and the target website
                  5. Convincing the user to install (or using malware to install) a root certificate, or compromising one you already installed (e.g., for work)
                  6. Bookmarklet/clipboard/devtools attacks

                  From memory, passkeys, webauthn, and u2f should prevent over 99% of phishing attacks that are successful without them in place.

                  There’s also the risk of the passkey itself being compromised, though that level of risk is dependent on your device / how you’re storing your passkeys and isn’t a “phishing” risk.

                  • Natanael@slrpnk.net
                    link
                    fedilink
                    English
                    arrow-up
                    2
                    ·
                    1 year ago

                    The main point is all those attacks need to attack the local software or hardware implementation on one of the two ends (or a cert issuer), and even then it’s replay protected so for example an XSS attack lasts only for one session, so it’s more robust.

      • AA5B@lemmy.world
        link
        fedilink
        English
        arrow-up
        1
        ·
        1 year ago

        My understanding of Apple Keychain is that every credential is useable from every device, and can be backed up and restored to a new device. Most importantly Apple doesn’t have access, although we have to trust them on that

    • Ada@lemmy.blahaj.zone
      link
      fedilink
      English
      arrow-up
      9
      ·
      1 year ago

      It’s not quite unique to a specific device. You can store your private key in a password manager or something similar, and then access it from other devices

      • alvvayson@lemmy.world
        link
        fedilink
        English
        arrow-up
        4
        ·
        1 year ago

        Depends on your personal choice. You can definitely limit them to a single, hardeneddevice if you want the highest level of security.

        For most users and most situations, a synced solution will be preferable.

    • wreckedcarzz@lemmy.world
      link
      fedilink
      English
      arrow-up
      5
      arrow-down
      1
      ·
      1 year ago

      Me, at the bank:

      Robbers, as they enter the bank: everybody freeze

      Me: ah shit

      Robbers: everyone give me your phones

      Me: aw hell naw

      mission impossible style shootout

    • V0lD@lemmy.world
      link
      fedilink
      English
      arrow-up
      5
      arrow-down
      1
      ·
      1 year ago

      But it becomes much easier if you want to compromise a specific target individual

      • alvvayson@lemmy.world
        link
        fedilink
        English
        arrow-up
        4
        arrow-down
        5
        ·
        1 year ago

        No, not really.

        Even if you want to target a specific user, it doesn’t become necessarily easier.

        Unless you happen to target an individual that combines good password OpSec with shitty phone OpSec.

        But I would expect those to be a minority.

        • V0lD@lemmy.world
          link
          fedilink
          English
          arrow-up
          10
          arrow-down
          2
          ·
          1 year ago

          Hi, yes, I am that minority

          I have a 37 character password with both cases, numbers and special characters to login to my pw vault using long random strings

          My phone has a swipe pattern lock since that is the safest lock option it allows in the first place. I wish I could lock it better, but the only other options available to me are a 4 character pin, and fingerprints/facial scan. I hope the problems with those are obvious

          Couple that with the fact that I have a daily predictable commute in public transit where I have a habit to put my phone next to me during breakfast and you have a recipe for disaster.

          • GreyBeard@lemmy.one
            link
            fedilink
            English
            arrow-up
            3
            ·
            1 year ago

            Finger prints on Android stop working after 24 hours, a reboot, and some other cercumstances. I feel pretty OK using fingerprint to unlock my phone, because in about 99% of cases I might be compelled to unlock my phone, I will either be able to restart it first, or that 24 hour timer will have expired.

            • V0lD@lemmy.world
              link
              fedilink
              English
              arrow-up
              1
              ·
              1 year ago

              I may be misunderstanding you, but how does that stop an attacker?

              Getting a copy of someone’s fingerprint can be done without their knowledge since it is the easiest biometric to accidentally leave behind. Having to restart my phone doesn’t suddenly change my fingerprints.

              Or, do you have to actually re-register your prints on a daily basis via a different form of authentication? That’d seem inconvenient and like it would just move the problem around

              • AA5B@lemmy.world
                link
                fedilink
                English
                arrow-up
                3
                ·
                1 year ago

                US legal system can compel you to give biometrics, but not password/pin

              • SnipingNinja@slrpnk.net
                link
                fedilink
                English
                arrow-up
                2
                ·
                1 year ago

                You have to enter your pin/pattern to re-enable biometrics

                Also, I’m not sure which phone you’re using, but if it’s an Android there should be the option for password, some OEMs don’t give that option but they’re rare and the standard set by Google is to provide that and also the pins to be very long (I haven’t personally checked the limit, but you can make them longer than reasonable)

              • GreyBeard@lemmy.one
                link
                fedilink
                English
                arrow-up
                2
                ·
                edit-2
                1 year ago

                After the phone restarts, you must unlock your phone with your PIN(or swipe pattern) before you can use your finger again. The same is true with the 24 hour timer. Android also has a feature that if you hit the power button a set amount of times, it requires the PIN/Pattern too. So if my phone and my finger print have been separate for more than 24 hours, my fingerprint is useless. If I have any warning at all, my fingerprint is useless. Also, after a set number of failed biometric attempts it requires PIN as well. Which means the law better get the finger print right in only a few tries or they lose their chance.

                Yes, it is technically possible that law enforcement may steal my phone, duplicate my finger print(in a way that works on my phone’s finger print reader), and use that to unlock my phone while they have a chance, then suck everything out of my phone. But for anything government, that’s moving pretty swift for anything they might want to book me for.

                I’m guessing you could reduce that to a lower number of hours if you really felt the need.

          • alvvayson@lemmy.world
            link
            fedilink
            English
            arrow-up
            2
            arrow-down
            1
            ·
            1 year ago

            You can still use a 37 character password to protect your passkeys in your pw vault, so it’s not like anyone is forcing you to change.

            It’s still a single factor though. The number of times I have had to lecture IT admins that their 64 character passwords was compromised by a keylogger and that they need to move towards MFA is too damn high.

            As for your phone, if that’s sufficient for you, go for it.

            There are better phones out there.

            • V0lD@lemmy.world
              link
              fedilink
              English
              arrow-up
              1
              ·
              1 year ago

              I have MFA in addition to that pw, yes

              There are better phones out there.

              That’s news to me. Which other mobile authentication is there besides pin, pattern, facial and fingerprint?

            • hedgehog@ttrpg.network
              link
              fedilink
              English
              arrow-up
              1
              ·
              1 year ago

              Even FIDO2 MFA doesn’t protect you from attacks that involve malware running on your machine. If there was a keylogger on their machine then that machine is likely compromised in other ways, and any credentials entered or stored on it should be considered compromised and should be reset.