Comment by cvadict

8 days ago

> using a passkey in a flexible password manager (Bitwarden, keepass, 1Password, etc) really does continue to give the user control.

Sure, but if you read the article you would know that deal can (and will undoubtedly) be altered. The passkey issuer can demand that the passkey be hardware-backed, and I've already run into passkeys that cannot be stored in bitwarden out in the wild (i.e. they REQUIRE that I use a TPM-backed store in my computer). Eventually it will be a particular TPM-backed store running on an attested platform. Now that's not generally the case today, but make no mistake, that IS the ultimate goal... You will only access valuable services from devices that you fundamentally have no control over (e.g. locked down OS's with attestation before you can access X,Y,Z), so that you can't steal from netflix, skip the sponsor segments on youtube, block ads in your web browser, etc. etc. etc. If you want a preview of how this might all work from the technical side, just look into how TEE works for large-scale GPU deployments right now.

5 comments

cvadict

Reply
elcritch  8 days ago

Unfortunately I can see Apple eventually getting onboard too. As in "Sorry your device is no longer secure for using passkeys. Please update to a newer device!" Nice little incentive to boost flagging iphone sells.

cyberax  8 days ago

Except that banks can (and do) already require proprietary apps to generate one-time passwords, often requiring official iOS and Android phones. It's not some nebulous future, it's happening now.

And you can't really blame them. A TOTP 2FA from your password manager is not secure. It WILL be hacked sooner rather than later. And SMS is horrible, expensive, and unreliable.

So far, only FIDO keys provide hardware-backed security ("resident keys", not passkeys) that is nicely segregated into self-contained hardware module. And it does not require you to run a full end-to-end DRM-ed stack.

If you _want_ true privacy and security, that's pretty much the best case you can hope for.

  • crote  8 days ago

    Except that those "self-contained hardware modules" are actually rarely "self-contained" but usually an integral part of a smartphone running a huge bunch of mostly-untrusted code and that the containment keeps getting breached, of course.

    The only difference is that banks will now blame you for any losses caused by hacked devices because it is on paper "unhackable" with a well-updated device, so it is now your fault that their crappy bank app's security was broken.

    And you still don't get to use Passkeys with banks, of course.

    • cyberax  8 days ago

      I'm using a Yubikey that is permanently plugged into a USB-C port on my laptop and another one in my dock at home.

      > Except that those "self-contained hardware modules" are actually rarely "self-contained" but usually an integral part of a smartphone running a huge bunch of mostly-untrusted code and that the containment keeps getting breached, of course.

      And it actually doesn't matter if the secure device is designed correctly. Providing a secure channel over untrusted networks is something that we can do easily.

      > And you still don't get to use Passkeys with banks, of course.

      I can. I'm using US Bank and it supports my Yubikey-bound WebAuthn credential just fine.