Do you know what a passkey is and how one works?

In My Humble Opinion
1

Pop quiz: WITHOUT looking it up or asking an AI, do you know what a passkey is (as in website & app security)? Do you know how it works? How is it different from a password manager, a USB security key, a fingerprint scanner, or a 2FA one-time password?

I’m just curious about how confusing (or not) they are to others. Do you ever use them?

I used to know how they work, I think, and might’ve even explained it in another post on the SDMB long ago. But time passes, memories fade, and now I’m left wondering if they were just a bygone fad. There was a real big push for them a while ago, but not so much these days. I think I still have a few saved somewhere, but I’m no longer clear on how they’re supposed to be stored and used…

2

My understanding (which may be out dated) is that a passkey differs from a password in that for a passkey, only one side knows the secret key.
For a password, both the side asking for it and the side providing it have to know the actual password. So if a third party discovers the password (phishing, hack, etc), it can gain access to the goods.

With a passkey, the secret key is never shared with both sides. The asking side doesn’t ask directly for a password, it asks for a verification that you know the secret key, so you do a face scan, or fingerprint reader or something and your local device says “yeah, they check out” and you gain access. More difficult (but not impossible) for third parties to look at the exchange and discover how to hack in.

But I haven’t worked in cyber security for over a decade so I suspect it may be more complicated than that these days.

3

My understanding is that a passkey is generally device-dependent, but that Apple Passwords and Google Password Manager are somehow able to exchange them between your devices.

4

No, I don’t know what passkeys are but every time I log into some websites, I’m prompted to set one up. It’s kind of annoying.

5

Heh, it’s even worse than that. I already have one set up for that website (Google), but… it refuses to let me use it until I click cancel, and then try the exact same thing again. Apparently the first time it only asks my operating system. Only the second time onwards does it let me use my password manager (still to send a passkey).

In the IT world there’s a discussion going on right now with “Did we fuck up with passkeys? Is it just super-confusing to everyone because of the shitty way it was implemented?” (Spoiler: Yes.)

6

I agree that it’s confusing. I’m a relatively sophisticated user and I don’t understand them. Other people, like my 89-year-old mother, have no chance.

7

A properly-implemented passkey is the same thing as a properly-implemented password. A poorly-implemented passkey is the same thing as a poorly-implemented password.

They got popular because, before they started being widely used, computer science folks were looking at the official standard for how passkeys should be implemented, and comparing that to actual real-world experience of how passwords were actually implemented, and saw that the former was far superior to the latter. But now that everyone’s gotten the message that they should be calling whatever it is they’re doing a “passkey”, actual passkeys are just as poorly implemented as actual passwords, and so it doesn’t matter what you call it.

8

To me, the major thing with passkeys that makes them much, much more secure than passwords is that a passkey verifies both sides of the connection.

Do you know that you’re typing your password into your bank? It looks like your bank’s website, or at least it has the bank’s name and logo on it.

Passkeys use cryptography so that each side posses a secret, and each side can verify that other’s secret is the same now as it was when the passkey was created. I don’t have to know if that is my bank’s website, because unless that site possess my bank’s secret key, I’m not going to show them my passkey. (And if hackers have my bank’s secret key, then it’s all over for the bank anyway.)

I’m still seeing passkeys get rolled out. Fidelity just rolled them out in the last month or so, and they do them correctly. I can click on the passkey option to login, I unlock my passkey, send it to Fidelity, and then I’m logged in. No need to enter my password first, and then my passkey, or cancel the password and then get a passkey prompt, or (I’m looking at you, Microsoft) store the passkey in your app instead of the passkey manager I want to use.

So to answer the OP, yes and yes (with limitations, I can’t explain the detailed math of the cryptography, but I have a general sense of what’s going on).

9

When I’m trying to connect to a website is not the time to introduce me to a new idea like a passkey; at that point I just want to get to the website and make a transaction or whatever.

10

That’s about where I stand. I’ll add in that the little I understand of it suggests I wouldn’t be able to use it on PC/laptop with no camera or fingerprint reader.

That’s one of the advantages, I think, unless I’m mistaken, of having something autofill your username/password. Be it your browser or an extension. I always figure if it autofills, it’s the correct URL and not one that looks the same but isn’t.

11

Yes, I know what they are and could give a layman’s explanation of how they work and how they differ from password managers, biometrics, 2FA, etc. I’m fairly technical – used to be a software developer but haven’t done much coding in the last 15 years, and never did much with security.

Interestingly, while you say they seem to be falling out of favor, I’ve been noticing an increase in their usage for the past few months. I probably have a half-dozen websites that started offering to let me use a passkey since this summer (two banks, a health care provider, and a few others).

The Google issue you mention sounds miserable. I haven’t experienced anything like that, so I’m pretty happy with them. What kind of confusion do you see from users?

12

Kind of. If the passkey is stored on your laptop or credential manager, you some way need to authenticate to that in order to “unlock” the passkey. Without any biometric options, that probably means a password or security code. So you’re still using a passkey, but it doesn’t really feel like it.

13

This.

I see more, not fewer websites bugging me to set up passkeys. I want to click “No thank you” once per lifetime dammit, not once per login.

One question I’ve not seen well-addressed in any help or documentation or even layman’s explanation on a website: If I have e.g. five devices and I use all five to access e.g. Amazon with my one Amazon account, does each device have a separate passkey to that same Amazon account? Or do they all have the same passkey and if so, how to I propagate that from one device to another. They’re all different tech, different OSes, some have no TPM, no fingerprint, no camera.

And how does security work when that means anyone who has my phone has all its passkeys? What else do I need to do to authenticate me to my e.g. phone so it can authenticate itself, and me indirectly, to e.g. Amazon?

14

Passkeys can either be local or shared across devices with a credential manager. That could be based on your OS (e.g., Apple iCloud Keychain, Google Password Manager, Microsoft Password Manager) or some third-party tool that you can use on a variety of devices.

If you have a passkey on your phone and someone can authenticate to your phone, then yes, they have access to it. If they can’t get past whatever authentication you are using on your phone, then physical possession of the phone does not compromise your passkey.

And to emphasize one point specifically:

Passkeys are not related to the means by which you authenticate to your phone or laptop. You use that authentication to unlock the passkey, which is then used to authenticate to the website. You can have a single passkey shared across devices with a credential manager, and you might use a completely different authentication method on each of those devices, but it’s all the same passkey.

15

A passkey is what the staff uses to access your hotel room.

I would call that a zero-knowledge proof, which may involve a password.

There is also public-key cryptography where you have what I would call a “secret key” which is not shared and may be used to authenticate yourself to multiple parties.

16

I think the “multiple devices on different platforms” question is the most confusing user-facing part of the whole passkey design. Different software will “compete” to hold & serve passkeys:

  • Your password manager(s)
  • Your web browser, especially Google Chrome
  • Your operating system, via its own sync mechanism (like iCloud Keychain or Windows Hello)
  • Your operating system, delegating to a separate hardware device like a USB YubiKey

Even worse, each of these can decide how well they work with the other handlers… your password manager, for example, may or may not decide to ask you “Do you want to use the passkey I have, or check the web browser or OS one on your own?” (then passes it on)

If you don’t really remember where you saved it, there is no easy way to find it again either, except to keep passing through from one layer to the next in the hopes that one of them answers with “Oh yeah, I have a passkey for this site!” before the prompt times out. If you forget to unlock your password manager, for example, it might not even show you that and the OS will just go “nope, no idea” and make it look like you have no passkey for that site at all.

These different vendors are incentivized to not play nice with the other ones, because each one creates an opportunity to strengthen vendor lock-in. Apple wants you to keep using iCloud Keychain, because it works well between Macs and iPhones and iPads and such, especially if you’re in Safari. Once you add other companies into the mix… it gets a whole lot more fiddly and unpredictable. I use 1password between Android, Windows, and Mac, and my passkeys are something like 70% reliable. But every week or so, I need to fall back to passwords because the setup just didn’t work right for some app or site.

Different websites can also choose whether they accept the syncable kind of passkey, or only the hardware-tied ones, or only the USB security-key ones. So even if you like your password manager or Windows Hello, you might not be allowed to use it for some specific passkeys, even if it works for most of them.

I wasn’t sure about any of this, myself, and I did eventually ask AI for an explainer: Claude’s Passkey Field Guide

Honestly, it’s all really confusing… good for the companies (website owners) who want stronger security, but horrible user experience for any normal person who isn’t all-in on a single-vendor ecosystem (e.g. all Apple).

17

Having read through the thread this far, I’ve concluded that I want nothing to do with passkeys.

18

I believe the idea is that your trusted device, typically your phone, is supposed to certify to the website that you are you. So it may ask for a fingerprint or a face print, but it may be less strict if your smart watch is nearby or if you’re on your home Wi-Fi. If you’ve chosen to disable all passwords and biometrics on your phone, all bets are off.

19

That’s now my bottom line too. I had my suspicions before, but they’ve all been confirmed.

And thanks to the several knowledgeable folks who’ve cut so ably through the clutter and marketing speak.

I’ll keep using cross-platform BitWarden for storing old fashioned but very long passwords until they pry it away from me.

20

Passkeys are built on public key cryptography.

Basically when you create a passkey, you are creating a key pair for that account. The public key goes to the site, the private key is kept locally.

When you log in, the site sends a challenge. Your device unlocks the private key with whatever verification method you’ve chosen, then signs the challenge using it.

The site then receives the signature, and verifies it using the public key. The signature is also domain-bound, which makes phishing harder.

The real secret sauce is that the stuff passing over the network is all public, and even if someone hacks the site, they only get public keys.

So the weak link is typically what you use on your side as your verification method to allow your side to create the signature with the private key.