What is up with passkeys?

[Nermal]

I have to agree with that. A while ago Github started aggressively pushing two-factor authentication and had a bare-bones "how to set it up" page, which lacked any information whatsoever around how to get it going in the "corporate standard" world of a Windows PC. The recommended software didn't run on Windows, and the alternative given required a direct-dial phone number (a lot of corporate employees only have an extension).

 

[Rkuda]

isn;t this an overkill? i don't want to use yubi key everytime I log in to youtube, and how would I use it if I wanted to log in via apple tv or android phone?



1) so can I export those keys as plain text?

2) how can I use those passkeys if I am using a different device like logging in through my smart tv app ?

3) If passkeys are stored in the vault of a password manager, how will I unlock the password manager itself?

1) With Apple's password app you cannot export the Passkeys. Only Airdrop to a mutual user in your Address Book. The passkey goes directly to their passwords app and not to Files or somewhere else where the passkey could be viewed or copied.

2) The smart tv app should show a QR code which you can with your phone. After you authenticate with FaceID then it should complete the login on the tv.

3) Using whatever method you currently use to unlock the password manager. With iCloud Keychain of course if your device password or biometric auth.

This is what worries me. So if development stops on my password manager of choice, how do i move my passkeys to a new password manager? or am I locked in that password manager vendor forever?

or do I have to go back into my accounts and de-activate all passkeys and setup all new passkeys with the new password manager?

It's early days I assume as the feature rolls out there will be some kind of way to sync between password managers.

For me the question just makes the case to stick with iCloud Keychain because it's not the kind of thing that will ever go away.

 

[romanof]

For me the question just makes the case to stick with iCloud Keychain because it's not the kind of thing that will ever go away.

Same for me. Finally said the heck with it. I use iCloud Keychain for any website, which is some worrisome since even though it might not go away, Apple loves to change things. So I keep a manual backup in a small sqlite file protected by putting it in a GPG local file with a monstrous password. That works for me because I seldom need to add a new site/password.

 

[ericwn]

My experience with 1Password and passkeys has been pretty positive so far.

 

[MacBH928]

OMG! What a mess.

Prediction - Passcodes and hardware tokens will fail and be abandoned or not even implimented by most websites.

Got a pair of Yubikeys, intending to migrate them to sites that use hardware tokens. (Actually, I have been intending to do so for a year, at least, but just now finally got around to it.)

They will be fine for nerds and techies - those who already know about long passwords and no reuse and don't click on that "You won't believe..." email. In other words, for those who need protection the least.

The setup for every site is different, always confusing and often non-existent. For example, both Yubikey and Ebay brag about the utter safety of using a hardware token on the site, but nowhere in Ebay (that I have found, as yet) are tokens, Yubikey or the setup of such even mentioned. However, the backup default of a passkey went pretty easily.

Even Yubikey itself has pages and pages of how important it is to use hardware 2Fa. But, "Learn how" buttons lead to other sub-pages that say nothing but, "Easy to Setup. Which one do you want to buy?" Eventually, again if you are really really persistant, (and a nerd) you will find a technical document, in a locked cabinet drawer in a dark basement behind a door that says, "Beware of the Leopard."

For whatever reason, website programmers just cannot get the idea of

"Are you new to (xxx)?"
1. do this.
2. do that.
3. check that this is...
4. and so forth.

The Yubikeys work great once they are set up, but there is not the slightest chance of my neighbors or family making one work.

Passkeys are great when they work, but those are not at all consistent. I log on with one, then go to another area of the site, and I get "Name and Password please." And what is really strange, is for the exact same URL asking for a passkey one day and a password the next.

Doomed, I say!

This is too much trouble for so little gain.

I have been using passwords for like 30 years, and as long as you do not use "hello123" you are good , so far no attacks. If its good for banking, should be good for everything.

 

[erihp]

This is too much trouble for so little gain.

I have been using passwords for like 30 years, and as long as you do not use "hello123" you are good , so far no attacks. If its good for banking, should be good for everything.

The problem isnt that passwords dont work. The problem attempting to be solved is if (really, when) that password falls into the wrong hands, they cant simply use the password to gain access.

MFA enables additional security, because even with the password, it's not enough to access to account. This is extremely valuable and a good security practice that shouldn't be thrown out with the bathwater.


But I agree, the implementation of this concept by the industry has left a lot to be desired...

 

[MacBH928]

The problem isnt that passwords dont work. The problem attempting to be solved is if (really, when) that password falls into the wrong hands, they cant simply use the password to gain access.

MFA enables additional security, because even with the password, it's not enough to access to account. This is extremely valuable and a good security practice that shouldn't be thrown out with the bathwater.


But I agree, the implementation of this concept by the industry has left a lot to be desired...

with how passkeys are implemented, I can see more people getting locked out of their accounts than losing their accounts to hackers.

 

[erihp]

with how passkeys are implemented, I can see more people getting locked out of their accounts than losing their accounts to hackers.

Well you'd be wrong.

Go have a gander at haveibeenpwned to understand the breadth and sheer volume of password dumps and password spraying attacks.

'Hackers' exploit these password lists every single day, constantly looking for accounts to break onto. They are generally very successful because people dont use 2FA, and they often reuse passwords.

This is exactly what MFA is designed to combat.

If you ignore all of the warnings of backup codes, backup keys, backup email address, security questions, or other specific means of account recovery... you had it coming.

 

[goldmac2006]

Well you'd be wrong.

Go have a gander at haveibeenpwned to understand the breadth and sheer volume of password dumps and password spraying attacks.

'Hackers' exploit these password lists every single day, constantly looking for accounts to break onto. They are generally very successful because people dont use 2FA, and they often reuse passwords.

This is exactly what MFA is designed to combat.

If you ignore all of the warnings of backup codes, backup keys, backup email address, security questions, or other specific means of account recovery... you had it coming.

Dude I remember hearing about this website when I learned about cybersecurity in my computer science class back in the day. It is surprisingly mind blowing 🤯 how much breaches an email address can be used.

 

[MacBH928]

Well you'd be wrong.

Go have a gander at haveibeenpwned to understand the breadth and sheer volume of password dumps and password spraying attacks.

'Hackers' exploit these password lists every single day, constantly looking for accounts to break onto. They are generally very successful because people dont use 2FA, and they often reuse passwords.

This is exactly what MFA is designed to combat.

If you ignore all of the warnings of backup codes, backup keys, backup email address, security questions, or other specific means of account recovery... you had it coming.

and you think people will manage better with their passkey is "hidden" somewhere on their device? which they need another device that has authenticated 2FA authenticator? its getting pretty ridiculous.

 

[erihp]

and you think people will manage better with their passkey is "hidden" somewhere on their device? which they need another device that has authenticated 2FA authenticator? its getting pretty ridiculous.

people in the united states get a physical paper card issued ONCE with a 9 digit number printed on it.

people manage to keep this piece of paper and remember this number their entire lives. the backup codes to important accounts could be managed much the same way. if you can hang on to that card for 80 years, you can write your backup codes on the back of the damn thing if you have to.

all i was saying is way more people get hacked -today- because of lack of 2fa than 2fa users are permanently locked out of their accounts. you didnt seem to address my response, you just doubled down on 'its hard to remember/write stuff down'


how else do you suppose one would prove the account was actually theirs?

one would need to save the 'secret' that only they were provided when the account was opened. if you dont, or dont have 2fa capability, anyone with -just the password- can say it's rightfully their account.

jot down some numbers once to prove you own the account, or have no protection at all... i know what im going to choose. I cant help someone who doesn't follow the instructions provided to not get locked out.

 

[MacBH928]

people in the united states get a physical paper card issued ONCE with a 9 digit number printed on it.

people manage to keep this piece of paper and remember this number their entire lives. the backup codes to important accounts could be managed much the same way. if you can hang on to that card for 80 years, you can write your backup codes on the back of the damn thing if you have to.

all i was saying is way more people get hacked -today- because of lack of 2fa than 2fa users are permanently locked out of their accounts. you didnt seem to address my response, you just doubled down on 'its hard to remember/write stuff down'


how else do you suppose one would prove the account was actually theirs?

one would need to save the 'secret' that only they were provided when the account was opened. if you dont, or dont have 2fa capability, anyone with -just the password- can say it's rightfully their account.

jot down some numbers once to prove you own the account, or have no protection at all... i know what im going to choose. I cant help someone who doesn't follow the instructions provided to not get locked out.

I just checked and it seems you can sync passkeys. Its called scalable passkeys as it seems. We will see how it goes in the future.

 

[Adora]

Is it normal that sometimes the passkey is that I am just logged in to my Mac and sometimes for the same site I have to use TouchID and can't even choose the Yubikeys that are also installed.

In Firefox logging in to Apple anywhere with my main account suddenly doesn't work anymore. It normally wanted TouchID, now one of the Yubikeys and then I get that and nothing happens when I do it:

For other sites they work. IF they are requested, but most of the time I can't choose and have to use touch ID and when I turn the keyboard of, the login to my Mac is enough. Very strange. But I have to enter the password anyway before everywhere, it's just a second or third factor.