Misleading headline. Appropriate one:
FIDO Alliance’s implementation of passkeys maybe a slippery slope. Beware.
Passkeys are a trap. Do not use them.
Submitted 3 hours ago by cm0002@toast.ooo to cybersecurity@infosec.pub
https://nonfunctional.substack.com/p/passkeys-are-a-trap-do-not-use-them
Comments
waltersf@bookwyr.me 2 hours ago
adespoton@lemmy.ca 2 hours ago
The article has some good points, but is also reductivist.
Passkeys can indeed be abused, but they solve a security issue that was being abused in the wild that TOTP doesn’t solve. They essentially close a security gap connected to shared secrets that ensures they can’t be abused by caching attacks in the same way as TOTP. They do this by exchanging some of your personal privacy for third party trust — and this in turn means that the third party is no longer storing your password in active memory, making it less prone to data leaks.
But the big secret here is that passkeys aren’t exactly the thing companies like Google, Microsoft and Apple are telling you they are: that’s a single (or two, really, as MS uses a different implementation) of passkeys that slave your side of the shared secret to a mobile device or browser.
Passkeys work fine in software (1Password works as a passkey vault, for example) or in hardware (Yubikeys are fully FIDO compliant and so implement everything but the transport mechanism). So it’s perfectly possible to use a safe and secure passkey that isn’t leaking data to the second party.
The problem with passkeys is that it’s also possible to tie them to a TPM, which is controlled by the second party, not you. And this is the default method that Google, Apple and MS default to presenting when a passkey creation prompt comes up on “their” devices.
So passkeys aren’t the trap; the pushed implementation is.
Get a Yubikey or a password manager that properly implements them and they’re significantly more secure than TOTP. It’s essentially the same technology that Apple uses for Apple Pay.
Oh, and of course, passkeys don’t get rid of passwords; they get rid of indiscriminate password use. You still need a shared secret to back the passkey; it just tends to be a longer “token,” “key,” or passphrase. At the end of the day, that’s no different from a traditional password except for the accepted length and how often it is used.
TheButtonJustSpins@infosec.pub 31 minutes ago
So, if Bitwarden, all good?
4am@lemmy.zip 2 minutes ago
Well…for now? Bitwarden looking to enshittify lately. But yes right now Bitwarden passkeys work great across multiple devices desktop and mobile. Been using them for a number of years now.