Comment by WorldMaker
5 days ago
The threat models here are often very similar to existing Password Manager threat models. If an attacker gets access to your Password Manager they get access to every password you have stored there and can do what they like with that information. The same applies to your Passkey Manager, which in many cases (including for your own peace of mind) is/should be the same app/vault as your Password Manager for other types of passwords.
A lot of the same Password Manager requirements and best practices apply to Passkey Management such as using strong master passwords or biometric unlocks or device PINs. Using Password Managers that support device bound hardware security enclaves, etc.
But even more so than average Password Management, because Passkeys are public key infrastructure the benefits you get out of the box exceed those of ordinary passwords. One of the factors in most Passkey implementations here is that sites (defined by hostname) all get different public keys. (Users are suggested to use different passwords for every site, but are not required to. Passkeys do that technically and are generally enforced in that effort by browsers and Operating Systems.) Leaking those public keys is no longer an issue (they truly are public keys), and leaked public keys aren't generally useful to other sites and apps. (Passwords that leak and even sometimes salted and hashed passwords that leak are liabilities and can be useful for rainbow table attacks or social engineering attacks or password reuse attacks.)
There are certainly edge cases to Passkey Management but in general the threat models follow Password Management threats: does someone have physical access to your device? Do they have access to your biometrics or device PINs?
But also the blast radius is reduced compared to usual Password Management threats: a single leaked private key generally only impacts a single website/app. Being able to sign a Passkey challenge once doesn't mean unlimited access (a password can be used forever after finding it), because challenges have timestamps and random entropy and generally don't support replay at all.
Passkeys also open up other use cases like using a mobile device or hardware security token to log into sites from public computers, which, while not risk-free (targeted malware could still hijack your session while you're logged in), is still significantly safer than giving the public computer a password.
This is roughly analogous to the difference between swiped/card not present and chip/NFC credit card payments. While a hacked chip/NFC credit card terminal could display a different amount than actually charged, it can't subsequently make additional charges after the card or device is withdrawn.
Though obnoxiously, the public computer login method doesn’t rely solely on the QR code it shows, but also uses Bluetooth. So if you want to log in on a VM or computer without Bluetooth, or a physically distant computer being accessed remotely, you have no choice but to install your password manager on that computer. Which is a lot less secure than copying a single password and one-time code.
VMs and remote access can implement passthrough for passkeys, just as passthrough has been implemented for smart cards (CCID).
I am less interested in the threat models than the accidental denial of service models. I've avoided passkeys because of that. It seems like there are real problems if you use multiple devices not somehow symced.
I have started using Passkeys everywhere that I can. One of my "requirements" is "do they support multiple key enrollment". Most do, it's sort of required by the spec and semi-required in practice by the giant number of consumers in the US with iOS or Android phones and Windows PCs. The open source libraries certainly push you in the direction of implementing it properly multi-key per user. (I've also implemented Passkey-Only website login.)
I generally add keys from two very different Password Managers to every site/app I use Passkeys with. Both Password Managers also sync between multiple devices I own.
Redundancy is already an option. Choice in Password Managers to use for your Passkeys is an option.
I understand that accidental denial of service fear, but the tools exist technically to deal with that fear if you wanted to try to deal with it.