Passkeys are a fantastic technology. Since they are bound to the site they are created for, they cannot be phished by a hacker’s fake login screen. If a site suffers a data breach, passkeys are asymmetric and cannot be recovered from the server-side details.
This leads to passkeys being the perfect fit for a corporate environment, but a poor fit for personal security. To an individual, the greatest risks are instead permanent account lockout, automated account bans, and device loss. By using passkeys, you gain better security against man-in-the-middle attacks but face the higher probability scenario of losing access to your accounts.
Phishing through the standard login flow is eliminated by passkeys, but it creates a false sense of security. An account’s security is still dictated by the weakest recovery method: SMS, email links, security questions, and so on. If these recovery methods aren’t enabled, then the risk of permanent lockout remains for the user.
↫ Ethan Hawksley
I’ve always felt something was off about passkeys, and have never used them. They’ve become – or were always intended to be – tools for further lock-in by especially Google and Apple, tying their entire usage flow to their respective operating systems. They also don’t seem to work well if you often work on devices not your own, which is a major hassle. None of these shortcomings come into play when using a traditional password manager, even if they require more manual work.
Just let me use a password manager with random password generation, instead of trying to force passkeys down my throat.
This is almost word for word how I feel about them. I’m okay with fingerprint security on my phone for a few specific apps, but for everything else they are indeed just a hassle. We use traditional desktop workstations almost exclusively at work, and the few laptops in regular use aren’t Surface or Mac devices so they don’t have cameras “good enough” for facial recognition passkeys. We use SMS and email based 2FA for the accounts that require it, and only four of us — the company owner/president, her managing partner, our online sales manager, and myself — are set up for 2FA. If a regular employee needs to log in to a 2FA enabled service, she will have to get the code from one of us. As for passwords, I keep all of those on my phone, with a backup vault on my workstation that my bosses know how to access if they can’t reach me for any reason, another vault on our file server, and backed up again at home on a secure flash drive, all synced daily. Archaic? Yes, but it has worked for the past 16 years I’ve been sysadmin at that job. Before I worked there, password resets were a weekly activity because they simply didn’t know what a password manager was.
At home all of my devices run Linux, BSD, or Haiku, and they are all desktops, really old laptops, or SBCs. One laptop in my collection does have a fingerprint reader, but I have it turned off in BIOS settings because even if I wanted to use it for 2FA, it’s annoyingly inaccurate and only has drivers for Windows and Linux.
Hmm you always need a reset method, that’s the same with passwords and passkeys.
I have my passkeys in Bitwarden, very convenient.
Passkeys are basically FIDO2 2FA but with a higher level of “store a unique ID for the device” authentication substituting for the username.
…so if there IS a pro to them, it’s that they generally mean the site will also support using something like https://www.yubico.com/ca/product/security-key-series/security-key-nfc-by-yubico-black/ for 2FA.
That’s complete and utter bullshit.
The whole point of passkeys is to have a secure *and* hassle-free authentication mechanism, and it’s pretty good at this.
Of course, you still need a recovery mechanism in case anything goes wrong, and if this one is fucked up, then the whole account is compromised or locked.
There’s no rocket science here, bad implementation leads to ugly problems.
And of course, if you rely on a big tech company to handle your security for you, so you don’t need to mind about it, it’s going to strike back someday.
The main issue with authentication, as with everything, is education.
Nico57,
https://github.com/bitwarden
I store my passwords, and yes passkeys on BitWarden. Which is open source.
I’ll be honest, I don’t host my own server. But if they ever stop supporting that, that would be my cue to switch
Anyway, here is their PasskeyKeyDataResponseModel
https://github.com/bitwarden/server/blob/main/src/Api/KeyManagement/Models/Responses/PasskeyKeyDataResponseModel.cs
The entire passkey ecosystem is great for being open and cross-vendor compatible, including open source, fully personal hosted ecossytems.
(Edit: Reading your post again, I misunderstood your point. But I’ll keep this here in case anyone is interested in an open solution)
I hugely recommend to everyone adopting Bitwarden for their passkeys and TOTP. Otherwise they are a funnel to being locked in and helpless as an individual when you lose your device or want to change OS or share an account (and yes! This is a legit use case!).
EdgeWiseInAnnArbor,
Agreed
Open source is the way.
Honestly, the entire obsession with security that feels as forced on me as AI. Advertising mandated security feature to me. Same vibe of “Hey, you’ll use this because it’s great, so we’re taking away your other options to make sure you use this feature you definitely want.”
10-15 years into being forced to value security, and I’ve never gotten a failed login alert that wasn’t about me failing to log in, and I _have_ lost around a thousand dollars of digital media to account lockouts.
I just don’t have enough main character energy to believe I’m a target of all these attacks evidence would suggest nobody cares to launch against me, but I damn sure have to waste time protecting against them because otherwise I can’t log in to access my own stuff that’s not worth stealing.
ETA: meanwhile literally everything needs an account now, and using Google/Apple SSO to log in to my microwave doesn’t actually help because then even the password manager can’t tell me which SSO I used
Well, I used to think the same: “I’m not a target worth investing time into.” But now, with AI, the balance will tip and it _will_ be worth for a thief to ‘harvest’ you.
AI will be great, but – at the same time – will also be awful.
And, yes, unique generated passwords for each service in combination with unique email adresses (buy a domain and set a catchall email on in!) is the way.
“They’ve become – or were always intended to be – tools for further lock-in by especially Google and Apple”
Unfortunately, this is too true. Can’t speak about apple, but the way that microsoft and google implemented this technology is clearly designed with the priority to vendor lock-in over true security. The procedures are big-tech-style obfuscated and really non-transparant to the end user. Especially microsoft is bad where they blatantly disabled a usb security key for login without any warnings, and *reverting to plain password login* on the microsoft account in question.
The next-worse thing is, the way these things are set up to “encourage” zero-knowledge trains people to just follow the instructions. That makes them them far more perceptive to old fashioned scams than they should be.
I am in the same boat. I feel like Gollum with my passwords. “It is mine, I tell you. My own. My precious. Yes, my precious.”
If they weren’t a tool for lock-in, they wouldn’t be an auto-create, or mandatory item. If it’s not good enough for people to use voluntarily, and has no path to stop using it, it’s not good enough to use.
Thank you for putting so succinctly how I feel about the rise of mandatory “features” over the past two decades
Passkeys are absolutely not locked into the OS. I have passkeys in both 1Password and (self hosted) vaultwarden and can utilise them via their browser extensions on any platform and mainstream browser.
I have only used hardware passkeys [most popular is the Yubico one but there are multiple cheaper brands available as well]. They work cross sites (supporting sites), not locked to any tech company and increasingly I have noticed multiple forums supporting them as well.
Physical authentication via such keys is definitely a security upgrade.
It is basically just removing the second factor of two factor authentication, and replacing it with the implicit factor of you being logged in on your machine.
https://youtu.be/GVH8X_QOlKg?si=09SkamEzqhFUEMae
I think this talk explains passkeys and why there actually are great.
I love Passkeys. No more fiddling around with barely working autofill in websites. It just works. I save them in my Bitwarden instance and have full control over them.
And for non-technical users I think it is beneficial to have their passkeys stored in their megacorp account (Google, iCloud, etc.) – In my experience, these user often struggle with password management, password re-use and having to recover accounts because of not being able to remember their credentials. It is the same as hosting your own Exchange vs having everything in the M365 cloud – you can do it, but you better be an expert at it. For everyone else, having a managed service with working redundancy and disaster recovery is probably worth the downside of going to the cloud.
There’s no lock in, there are default implementations on each OS but you don’t have to use them. It’s an open standard and you’re free to use a third party system like a yubikey, or a third party password manager etc.
It’s just a user friendly key based auth system, similar to how SSH has supported key based auth for many years.
I’m afraid both authors are a bit clueless.
Hawksley says “the greatest risks are instead permanent account lockout, automated account bans.” Really? Apple, Google, and Microsoft have billions of users, and they shut down a few hundred thousand accounts per year. That’s a risk of less than 0.001%. Compare that to the massively reduced risk of password and 2FA phishing, spraying, stuffing, MitM, etc., and passkeys are a no-brainer improvement. “Device loss” is not a meaningful risk. Almost all passkeys are synced by password managers (built into the browser or OS, or standalone), so if you lose a device, your passwords are automatically copied to the new device, or available on your other devices.
Hawksley says “an account’s security is still dictated by the weakest recovery method: SMS, email links, security questions, and so on.” If an account uses security questions , that’s an account problem, not a passkey problem. Yes, account recovery can be the weakest point, but without account recovery “the risk of permanent lockout remains for the user” with passwords or with passkeys. The solution is to have secure account recovery, not to kvetch about passkeys.
Holwerda says passkeys “were always intended to be – tools for further lock-in by especially Google and Apple.” This is absurd BS spread by people who don’t understand the first thing about the development of the FIDO2 standards, which now include a credential exchange protocol used by … wait for it … Google and Apple, and others, allowing you to move your passkeys to other accounts, including third-party password managers.
Holwerda says “just let me use a password manager.” So a password manager, which maybe locks you into the password manager’s ecosystem, is ok, but somehow using the same password manager with more secure passkeys and built-in 2FA is not ok? Huh?