Comment by torstenvl
1 month ago
> To an individual, the greatest risks are instead permanent account lockout, automated account bans, and device loss. By using passkeys, you gain better security against man-in-the-middle attacks but face the higher probability scenario of losing access to your accounts.
I'm glad to see this view becoming more mainstream. Passkeys are grotesquely insecure.
The only possible way to consider them more secure is if phishing attacks were more common and more damaging than lockout, which is so implausible that I reject the idea that someone could take that position in good faith.
> Passkeys are grotesquely insecure.
Lockout is a real risk, but there is nothing insecure about passkeys. Private keys stored on the secure enclave + biometrics or passcode before any signature is produced + origin binding mogs a static string and a 6-digit TOTP (often generated with a secret key outside the secure enclave) that can be phished and entered from anywhere. Also, in many (possibly the majority) of scenarios where someone is locked out of their passkeys, they’d also be locked out of TOTPs and passwords.
> The only possible way to consider them more secure is if phishing attacks were more common and more damaging than lockout
You’d be surprised.
Security as a field would be a lot less obnoxious if it did not neglect availability as an important facet of security. A 'security' system that obstructs legitimate access is also failing at its job.
> Lockout is a real risk, but there is nothing insecure about passkeys.
secure - adjective
se· cure si-ˈkyu̇r -ˈkyər
securer; securest
1
a: free from danger
b: affording safety (a secure hideaway)
c: TRUSTWORTHY, DEPENDABLE (a secure foundation)
d: free from risk of loss
Passkeys as a sole/required method of authentication increase the risk of permanent loss. In any other configuration they do not mitigate phishing risk.
It is not possible to say there is nothing insecure about them.
Reliability != security
If a car breaks down every 50 miles we would call it unreliable. If a car’s doors don’t lock we would call it insecure.
6 replies →
> if phishing attacks were more common and more damaging than lockout
The calculus changes if the service is a bank or your stock broker, which, if you are in any reasonable jurisdiction, if you can prove your identity (in court) they are legally obliged to ensure they give you back your money.
But, for the vast majority of other internet services... I honestly don't think anyone would want to MITM my instagram account for example.
Lockout sucks, but it’s not an indicator of insecurity. If anything it’s the opposite.
I don’t use passkeys because I like BitWarden and two factor
Just sayibg