Comment by stmw
5 days ago
Look, at best, Passkeys shift your logins from your head to OS-supplied keychain management. Whether they do attestation today or not, they big, industry-wide effort to move away from "what you know" (i.e. username/password) + "what you have" (2FA) towards "platform-authenticates-you-to-website automatically" has both security benefits and lock-in risks.
Maybe it was too strong to say the were a "trap", but it is also too strong to say there is no worries here.
TFA's author has also explicitly precluded the "platform-authenticates-you-to-website automatically" workflow, in a separate blog post [0]:
> This one can be tricky because I've seen many sites using passkeys to replace passwords, but that's not something we've done on Report URI, passkeys are used as a 2FA mechanism.
[0]: https://scotthelme.co.uk/xss-is-deadly-for-passkeys-the-hidd...
Well, they can (and likely will be) used in both modes. Either these things are just a different way of generating a password for a password manager (itself a big target of attacks), or they are a way "to move beyond password with TPM-level security". If it's the former, the security benefits are limited. If it's the latter, the "it's a trap" logic applies at least in part.
> Well, they can (and likely will be) used in both modes.
I agree - and that makes me wish that the messaging was more clear from passkey supporters. Some may be genuinely confused and talking about one or the other mode (or not even realize that multiple modes exist), and some may be trying to claim the benefits of one mode while/or handwaving away the tradeoffs of the other mode.
> OS-supplied keychain management
That is your choice as the user. You can use the default credential manager that is offered out of box, or you can use your own.
https://whatarepasskeys.info
No, you can't just use whatever passkey manager that you want.
I use Safari, Chrome, MacOS, a Google Pixel phone, and 1Password. I have passkeys in 1Password, but it's a crap shoot if I'm able to login on a device.
Chrome wants me to use Google Password Manager. There's no option in chrome://settings to set 1Password as my passkey manager. If I try to use a passkey to login to GitHub Chrome pops up a modal that lets me choose between iCloud Keychain, Use a phone or tablet, or USB security key. There's no option to use a different credential manager.
Safari wants to use my iCloud Keychain. There's no option in MacOS Settings to set 1Password as my passkey manager. If I try to login to GitHub I get an option to Scan QR Code or Use Security key. There's no option to use a different credential manager.
My Pixel wants to use Google Password Manager. There *is* an option in Pixel Settings to set 1Password as my passkey manager, but it doesn't work in Chrome. All I can do it select "use another device" and it shows a QR code. There's no option to use a different credential manager.
Essentially every OS and browser thinks I want to use a phone for my passkey, and this is exactly the situation that I and everyone else is bothered by. I do not want to tie my login credentials to a phone that can be lost/stolen/bricked and will be replaced in several years.
So no, you can not use your own credential manager.
Great examples, exactly what I'm saying. And every one of these (browsers, OSes, phones, etc) has strong incentives to only offer its own password manager.
You wont' typically see a setting in your browser, because credential managers are designed to operate at the system level, so that your credentials aren't "stuck" in your browser. This is why you don't see an option in Chrome settings. You can, however, disable Google Password Manager in Chrome settings, as it is a Chrome feature.
macOS: Settings > General > Autofill & Passwords. Turn on 1Password. https://support.1password.com/macos-autofill/
What are you talking about, I use the bitwarden extension in chrome and chrome never asks me to store a passkey, bitwarden does.
It's notable that several of the claims on that page conflict with the other info in both the OP article and the follow-on.
As for choice as the user, it's a choice "for now"... and only for users who understand all of these details (which seems unlikely).
Personally, my observation is that if one tries to properly configure 2FA with any major website lately (no, I don't mean AWS console), the level of "your choice" and properly implemented security has actually gotten worse...
> It's notable that several of the claims on that page conflict with the other info in both the OP article and the follow-on.
Create GH issues or use the feedback form if you believe there are issues with the content!
Much like you could use any AOSP fork to run banking applications... until you couldn't. But hey, at least there's an explainer website[0] that completely glosses over this detail.
[0]: One great bit of environmental storytelling is the "Made with <3 by the passkey community" in the footer. "Passkey community" of course means timcappalli with minor contributions from two others. You might remember him from https://github.com/keepassxreboot/keepassxc/issues/10407#iss....