I love passkeys as an additional login method. My stuff is typically locked behind email and/or password+TOTP, but I like to add passkey on top of that because logging in by just touching the fingerprint scanner is less clicks and faster than going through password manager or "login with X".
It's worth emphasizing that disliking passkeys as the exclusive login method is fully compatible with using them for 90% of logins.
Part of the problem with passkeys is that websites do not have a consistent philosophy as to whether they are an additional login method or a required second factor.
A combination of randomly generated passwords stored inside a third-party password manager, paired with an independent TOTP app, gives control to the user without giving up the flexibility of plain text. For users who previously reused passwords across all their sites, passkeys are a huge step-up.
I wish anyone dishing out security system design advice like this have a mandatory consultation with 10 people over 65, and probably 5 people who have managed IT security in any organization above 50 people.
Credential stuffing/reuse is a problem, sure, but these people are targeted on a daily basis by decently sophisticated phishers who will hop on a phone call with you.
Passkeys not being forwardable/MITM'able is a feature, not a bug. "Sir, just give me the OTP to confirm your identity". No amount of "We will never ask you for this code" disclaimers will save people.
Banks/financial institutions should be required to give you a non-forwardable hardware token that authenticates you, and governments should follow suit. In a sense, they already do (with ATM cards and chip passports), we just don't have any good interfaces for these tokens.
I wish anyone dishing out security system design advice like this have a mandatory consultation with 10 people over 65, and probably 5 people who have managed IT security in any organization above 50 people.
I though the author was pretty clear that they weren't recommending that as a solution for everyone, but pointing out why passkeys are a step backwards for individuals who already do something like that.
a poor fit for personal security. To an individual, the greatest risks are instead permanent account lockout, automated account bans, and device loss. By using passkeys, you gain better security against man-in-the-middle attacks but face the higher probability scenario of losing access to your accounts.
He's talking about individuals; maybe implicitly technically-savvy individuals, though, honestly, I think he meant the general public.
permanent account lockout, automated account bans, and device loss.
These are the greatest risks to technically savvy people. People "immune" to phishing.
The biggest "technical bias" dog whistle is device loss. A lot of people are on unencrypted drives that never leave their house. Sure, when their house burns down, they lose pictures and access to some of their accounts, and they have to call support. Or, they have modern devices they renew periodically and their files have just been magically following them through the cloud and a 10$ a month subscription.
A lot of people's lives are also just not that digitized. They use accounts for bills and banking when they have to, and that's where they're being targeted for phishing.
Passkeys solve several attack vectors for real people at the cost of potential marginal friction for the most technical users. Yes, if you have your own key management setup and would never fall for phishing, sure, your rofi autopass bash banging setup works great and you get to backup your keys yourself. For everyone else, the bank can just ship you another key or ask you to come into the branch with 2 pieces of ID.
I like passkeys because I just think of them as yubikeys that live inside your devices, and I’ve long used yubikeys for everything. I don’t mess with all the various sync thingamabobs. I can’t remember the last time I signed into an account on someone else’s computer, or them mine. Not saying it doesn’t happen or it is an invalid use case. But computers have become very very personal things! Almost feels like someone asking to write in your journal.
I have a work computer. My wife has a desktop computer at home. I have a laptop. A tablet. A phone. The whole family have accounts on the desktop. The whole thing is very many-to-many. The ergonomics of passkeys are not appealing to me.
I use my password manager for managing passkeys across devices. The article covers this as Third-party synced passkeys.
For me this works very well in every common case I have. I ALSO want to have a username/password for the edge cases, and I use crazy length random passwords. If my passkeys were tied to my devices I’d hate them, but I don’t have the “fighting the platform” problems of the author - the ergonomics seem to “just work” for me.
The auth mechanism I hate the most is text message or email OTP. Not only do I think it’s insecure in comparison, but it’s inconvenient as hell to have to wait up to 30s many times to pass through the gate.
My wife and I don't need to sign in on each others' machines often, but it does happen. Doing taxes is probably the biggest offender. I'd be unhappy if "downloading the tax form" meant resetting my entire Vanguard account.
Actual yubikeys would be better than passkeys in this case. The device-specific lockout issue isn't a factor.
but yubikeys are passkeys, and you can plug them into anything that has a usb port, no need to worry about syncing, or whether the particular passkey implementation is secure or not (is it TPM? is it a encrypted file on the disk?). i dislike on device passkeys, but i like passkey as a way to login because i can use yubikeys.
I don’t really agree, I maintaining a service with a fancy password-less authentication system using passkeys and one-time passwords sent by email, and I think passkeys are nice in this scenario:
About 50% of the users log in with passkeys, as it’s super fast and convenient
For users using a device that does not support passkey, they sign in with a one-time password sent by email
Users who have lost their passkey or with a brand new device can still sign in by email the same way, and optionally create a new passkey immediately after that
It took me some time to polish it, but so far people don’t complain much. It’s not the most secure authentication system of the world, it is just passwordless and convenient.
IMO, one thing that could be improved in the spec is how passkeys are identified and named. In my case, I can’t easily get the name of the device to give meaningful names to passkeys (anti-fingerprinting measures on the web…) so it’s difficult to know which passkey is installed on which device. Sure, users could rename their passkeys themselves, but in practice almost nobody will do so.
In fact what’s really… interesting with passkeys is that they are very widely used, while I bet that most users have virtually no idea of what’s going on under the hood when they sign in on a website with a fingerprint! And it’s difficult to explain, many people believe the website can actually see their fingerprint, and won’t understand that a passkey is usually linked to one device.
So what you're saying is you suspect users don't understand that their passkey is tied to their hardware and they're going to find out exactly how screwed they are the moment they switch hardware? Because they have no idea what's goin under the hood?
"I got a brand new laptop! ...oh no what happened I can't log into anything whyyyyy", or even just "I got a second laptop/tablet/phone but I can't log in???". Tying passwords to hardware, in a society that constantly cycles hardware, is a really, really weird idea.
Tying passwords to hardware, in a society that constantly cycles hardware, is a really, really weird idea.
Given that the comment you're responding to explicitly mentions having a magic-link backup/recovery method available, and given that all the big passkey implementations now implement cloud-based syncing across devices, this seems like a non sequitur.
It’s a classic OTP: you receive an email with a temporary 6 digit code that you have to enter on the website. It’s more work that a magic link, but it resists against MFA fatigue attacks.
Passkeys really seem like a tool best suited for power users. I don't feel that average people - who largely don't use password managers - are going to understand how to use them.
Average people use passkeys with the password managers their system provides, without even noticing, or knowing that this is what login by TouchID etc means.
I used to be really against passkeys because initially they failed for me too often. I nonetheless returned to trying them (or sometimes a platform like Google manipulated me into setting one up). Where I've started to use them, I have found that they now mostly work fine for me, synced with Bitwarden across GrapheneOS, desktop Linux, and macos.
I agree that being locked out of my accounts is probably the most real failure mode for me as an individual, more so than my credentials being stolen. I'm still suspicious of passkeys for that reason, and am glad that in situations where I lost a passkey (or for some reason it didn't work), I have been able to return to password auth. I hope I will always be able to.
But I did update my priors on them because the ones I saved to Bitwarden seem to work okay.
Exist are why I hate them. I understand the limits of passwords, from a security standpoint, but they're still 1000x convenient than all this pointless menuing. Even stuff like getting my Windows password or the VPN login token requires painfully precise menuing.
IMO Windows support for passkeys is much worse than other OSes... For instance you are required to enable Windows Hello to use passkeys. It does not make any sense, Windows Hello is not even necessarily biometric...
It's because Windows Hello is both the system authenticator and the integration point for third-party authenticators. The "biometric Windows login" feature is one very small part of the system.
„Have 1Password extension enabled in your browser -> click create passkey in the website’s account settings -> confirm 1Password modal” is non-obvious?
matklad | 15 hours ago
I love passkeys as an additional login method. My stuff is typically locked behind email and/or password+TOTP, but I like to add passkey on top of that because logging in by just touching the fingerprint scanner is less clicks and faster than going through password manager or "login with X".
It's worth emphasizing that disliking passkeys as the exclusive login method is fully compatible with using them for 90% of logins.
skobes | 15 hours ago
Part of the problem with passkeys is that websites do not have a consistent philosophy as to whether they are an additional login method or a required second factor.
vpr | 13 hours ago
I wish anyone dishing out security system design advice like this have a mandatory consultation with 10 people over 65, and probably 5 people who have managed IT security in any organization above 50 people.
Credential stuffing/reuse is a problem, sure, but these people are targeted on a daily basis by decently sophisticated phishers who will hop on a phone call with you.
Passkeys not being forwardable/MITM'able is a feature, not a bug. "Sir, just give me the OTP to confirm your identity". No amount of "We will never ask you for this code" disclaimers will save people.
Banks/financial institutions should be required to give you a non-forwardable hardware token that authenticates you, and governments should follow suit. In a sense, they already do (with ATM cards and chip passports), we just don't have any good interfaces for these tokens.
abeyer | 11 hours ago
I though the author was pretty clear that they weren't recommending that as a solution for everyone, but pointing out why passkeys are a step backwards for individuals who already do something like that.
vpr | 8 hours ago
He's talking about individuals; maybe implicitly technically-savvy individuals, though, honestly, I think he meant the general public.
These are the greatest risks to technically savvy people. People "immune" to phishing.
The biggest "technical bias" dog whistle is device loss. A lot of people are on unencrypted drives that never leave their house. Sure, when their house burns down, they lose pictures and access to some of their accounts, and they have to call support. Or, they have modern devices they renew periodically and their files have just been magically following them through the cloud and a 10$ a month subscription.
A lot of people's lives are also just not that digitized. They use accounts for bills and banking when they have to, and that's where they're being targeted for phishing.
Passkeys solve several attack vectors for real people at the cost of potential marginal friction for the most technical users. Yes, if you have your own key management setup and would never fall for phishing, sure, your rofi autopass bash banging setup works great and you get to backup your keys yourself. For everyone else, the bank can just ship you another key or ask you to come into the branch with 2 pieces of ID.
ahelwer | 16 hours ago
I like passkeys because I just think of them as yubikeys that live inside your devices, and I’ve long used yubikeys for everything. I don’t mess with all the various sync thingamabobs. I can’t remember the last time I signed into an account on someone else’s computer, or them mine. Not saying it doesn’t happen or it is an invalid use case. But computers have become very very personal things! Almost feels like someone asking to write in your journal.
recursive | 16 hours ago
I have a work computer. My wife has a desktop computer at home. I have a laptop. A tablet. A phone. The whole family have accounts on the desktop. The whole thing is very many-to-many. The ergonomics of passkeys are not appealing to me.
soulcutter | 15 hours ago
I use my password manager for managing passkeys across devices. The article covers this as Third-party synced passkeys.
For me this works very well in every common case I have. I ALSO want to have a username/password for the edge cases, and I use crazy length random passwords. If my passkeys were tied to my devices I’d hate them, but I don’t have the “fighting the platform” problems of the author - the ergonomics seem to “just work” for me.
The auth mechanism I hate the most is text message or email OTP. Not only do I think it’s insecure in comparison, but it’s inconvenient as hell to have to wait up to 30s many times to pass through the gate.
elephantium | 11 hours ago
My wife and I don't need to sign in on each others' machines often, but it does happen. Doing taxes is probably the biggest offender. I'd be unhappy if "downloading the tax form" meant resetting my entire Vanguard account.
Actual yubikeys would be better than passkeys in this case. The device-specific lockout issue isn't a factor.
yshui | 13 hours ago
but yubikeys are passkeys, and you can plug them into anything that has a usb port, no need to worry about syncing, or whether the particular passkey implementation is secure or not (is it TPM? is it a encrypted file on the disk?). i dislike on device passkeys, but i like passkey as a way to login because i can use yubikeys.
TheGreatGazebo | 15 hours ago
I hate on device passkeys, but I love yubikey
motet-a | 14 hours ago
I don’t really agree, I maintaining a service with a fancy password-less authentication system using passkeys and one-time passwords sent by email, and I think passkeys are nice in this scenario:
It took me some time to polish it, but so far people don’t complain much. It’s not the most secure authentication system of the world, it is just passwordless and convenient.
IMO, one thing that could be improved in the spec is how passkeys are identified and named. In my case, I can’t easily get the name of the device to give meaningful names to passkeys (anti-fingerprinting measures on the web…) so it’s difficult to know which passkey is installed on which device. Sure, users could rename their passkeys themselves, but in practice almost nobody will do so.
In fact what’s really… interesting with passkeys is that they are very widely used, while I bet that most users have virtually no idea of what’s going on under the hood when they sign in on a website with a fingerprint! And it’s difficult to explain, many people believe the website can actually see their fingerprint, and won’t understand that a passkey is usually linked to one device.
Pomax | 12 hours ago
So what you're saying is you suspect users don't understand that their passkey is tied to their hardware and they're going to find out exactly how screwed they are the moment they switch hardware? Because they have no idea what's goin under the hood?
"I got a brand new laptop! ...oh no what happened I can't log into anything whyyyyy", or even just "I got a second laptop/tablet/phone but I can't log in???". Tying passwords to hardware, in a society that constantly cycles hardware, is a really, really weird idea.
ubernostrum | 11 hours ago
Given that the comment you're responding to explicitly mentions having a magic-link backup/recovery method available, and given that all the big passkey implementations now implement cloud-based syncing across devices, this seems like a non sequitur.
motet-a | 10 hours ago
Exactly!
motet-a | 10 hours ago
It definitely happens sometimes, but with my application, they just have to login with an OTP sent by email.
Yes but quite often, it’s not actually tied to hardware but to your password manager. At least that’s how it works with iCloud. So it’s not that bad.
orib | 3 hours ago
How do you log in to your email that way?
motet-a | 2 hours ago
It’s a classic OTP: you receive an email with a temporary 6 digit code that you have to enter on the website. It’s more work that a magic link, but it resists against MFA fatigue attacks.
matt-y | 13 hours ago
Passkeys really seem like a tool best suited for power users. I don't feel that average people - who largely don't use password managers - are going to understand how to use them.
diktomat | an hour ago
Average people use passkeys with the password managers their system provides, without even noticing, or knowing that this is what login by TouchID etc means.
lake | 15 hours ago
I used to be really against passkeys because initially they failed for me too often. I nonetheless returned to trying them (or sometimes a platform like Google manipulated me into setting one up). Where I've started to use them, I have found that they now mostly work fine for me, synced with Bitwarden across GrapheneOS, desktop Linux, and macos.
I agree that being locked out of my accounts is probably the most real failure mode for me as an individual, more so than my credentials being stolen. I'm still suspicious of passkeys for that reason, and am glad that in situations where I lost a passkey (or for some reason it didn't work), I have been able to return to password auth. I hope I will always be able to.
But I did update my priors on them because the ones I saved to Bitwarden seem to work okay.
prussian | 14 hours ago
I only use fido/passkeys/whatever at work and the fact that things like
https://github.com/Aldaviva/AuthenticatorChooser
Exist are why I hate them. I understand the limits of passwords, from a security standpoint, but they're still 1000x convenient than all this pointless menuing. Even stuff like getting my Windows password or the VPN login token requires painfully precise menuing.
motet-a | 14 hours ago
IMO Windows support for passkeys is much worse than other OSes... For instance you are required to enable Windows Hello to use passkeys. It does not make any sense, Windows Hello is not even necessarily biometric...
tad | 13 hours ago
It's because Windows Hello is both the system authenticator and the integration point for third-party authenticators. The "biometric Windows login" feature is one very small part of the system.
alper | 11 hours ago
I tried to add a passkey to 1Password and the entire process is very much non-obvious. Almost as if nobody really wants this to work well.
diktomat | an hour ago
„Have 1Password extension enabled in your browser -> click create passkey in the website’s account settings -> confirm 1Password modal” is non-obvious?
samcat116 | 9 hours ago
I love passkeys. Any new web service I make is passkeys and OIDC only