I think that’s the wrong message to take. Passwords and MFA have a lot of issues too, and a good passkey implementation is generally more secure. L
I don’t share passkeys between devices, so I don’t run into the challenges @Reply describes. I have one set of passkeys on my laptop and one on my phone. I’ve never had a conflicts with multiple providers trying to store or serve passkeys.
A Yubikey or similar dongle should be able to do that.
It seems that not that long ago we were hearing warnings about not using biometrics because (to site a semi-paranoid example) someone could, under certain circumstances, compell you to provide your fingerprint, or forcefully “use” your face.
I am not enamoured of biometrics yet. I prefer not to trust them on my device. My phone could be stolen while unlocked. My PC has no camera or fingerprint reader. I don’t have, or particularly want, to carry a Yubi key that could also be lost.
I’m pretty sure I have a basic understanding of their benefits, but until they can make it as convenient as my password manager I’m not ready to get on board.
^ This.
My place of work wants us to clock in and out using our personal phone and their software (which I’m already VERY unhappy about - they would never let me load software of my choosing on their machines but they demand I load their software on my personal phone). So, I go to clock in from lunch one day and all of a sudden it’s demanding a passkey! It didn’t need one that morning when I arrived at work. WTF? What is this? And it wants biometrics? My phone is not currently set up for biometrics. No, I don’t use my face or fingerprint to sign into my phone. Standing in a busy store getting jostled by passing customers already past the time I’m supposed to clock back in is NOT when I’m going to set up that sort of thing.
Fortunately there is an alternate means for us to clock in and out, intended for if the wifi is down and pretty much everyone was using it for the rest of the day.
Talk about a bad implementation! Turned out it had been released three days early, the day before everyone was supposed to be notified of the change so they could set up a passkey. Instead, no one had one set up and everyone was unable to access the timeclock.
As a result, very, very, very few people are setting up passkeys for this. Bad taste all around. Also, why the F am I having to set up a whole new thing on MY PHONE because THEY are too f’ing cheap to provide hardware they own?
Again, I am not allowed to load software on THEIR equipment, but they are demanding that I load their software on mine!
So… yes, I do know what a passkey is and how one is supposed to work. Yes, I know my phone could use biometrics but I don’t. Why? Because in the event of my incapacitation I want my designated representative to be able to use my phone, computer, and access my accounts in order to act on my behalf and since they don’t have my face or fingerprint attached to their body that means passwords.
At this point, my “introduction” to the passkey thing has been largely what I went through at work - sudden, unexpected, unannounced in advance and demanding I change the way I do things without regard to my concerns or needs or preferences.
I don’t see where I get additional benefit. I am capable of memorizing a 12 or 15 digit complex password, or using a long pass phrase. I am cautious about what I do on line. I even do a certain amount of things in “meatspace” rather than the so-called convenience of on-line.
And, regardless of what I, personally, do companies and corporations and banks will continue to be hacked.
With AI I fully expect at some point biometrics will be hacked - it will be able to imitate your face or finger sufficiently to fool the average biometric scanner on a phone. In which case anyone using biometrics is F’d because you can change a password. You can’t change your face or fingerprint or iris scan or whatever it’s using.
May I ask what variety of devices, browsers, and PW/PK storage apps you use?
Not doubting your experience. I may want to emulate it if my situation is already close enough to yours.
Interesting concern. And not one I’d put much thought into.
As to the incapacitation thing, typically you’ll have authentication set up as one or more of face, fingerprint, and old fashioned password. Not face or fingerprint instead if password.
So you can use the face or fingerprint for day to day convenience, but retain the PW for backup use. If you’re incapacitated and your rep already has the password, they can login that way and proceed normally. Whether they choose to then disable face and/or fingerprint or leave them live but unused is up to them.
The password backup only works if you set it up that way. My information (which may not be accurate or complete) is that you can set up access with just a passkey for some programs and sites, with no password backup.
Admittedly, some of this is my old fart stubbornness kicking in, but I’ve been working with computers since the mid-1970’s and I’m tired of change for the sake of change. If passkeys are still around in 5 years and functioning as advertised maybe I’ll bother with them.
I share your attitude. I’m getting a bit tired of tech churn for what seems like just churn’s sake.
AFAICT a passkey is basically just a second password.
I work with one system that requires a passkey, the system that I use to prescribe controlled substances. It’s supposedly part of a “two factor authentication”, which I put in quotes because in reality it’s a six factor authentication. There’s my username to log into the electronic health record, the password for the electronic health record, then a 6 digit code that gets texted to me which I have to enter within 30 seconds. Then to prescribe a controlled substance, I need another password, then a passkey along with another 6 digit code from a code generating app.
I’m joining the ‘don’t know what a passkey is’ chorus.
I do know what they are and how they work and I use them whenever possible. They are much more secure than passwords, even with 2FA in some cases. They use public key cryptography in both directions so the private key is never sent and can’t be intercepted. In layman’s terms - as long as your means of authentication with your device (phone or computer) is secure, the passkey is secure.
If it’s a properly implemented passkey, you can’t share them between devices.
So do all competent password systems. They use them a little bit differently, but the effect is the same: The secret key itself is never actually transmitted in a way that can be intercepted.
And if the system you’re accessing wasn’t competent enough to implement passwords correctly, what makes you think they’ll be competent enough to implement passkeys correctly?
Far too many systems (including banks) use SMS for 2FA. I have more faith in passkeys simply because there are fewer points of failure, irrespective of the competence of the implementer.
There are exactly as many points of failure for passkeys as for any other security system: Some incompetent developer completely misunderstands how it’s supposed to work, implements something horribly insecure, and calls it a passkey.
If passkeys eliminate websites’ desires for 2FA via SMS I’m now all for them.
Not because I’m worried about the insecurity of SMS. But becase I’m tired of the irritation of the extra authentication step.
That is unlikely to happen, largely because of user confusion and their general unpopularity. Authenticator apps are a more likely possibility, but the challenge there is universality. I have 3 of them on my phone because I can’t use a single app for everything that supports it. It would please me if it happened, but I’m not holding my breath.
For what it’s worth, on an Apple iPhone or iPad, the backup for biometrics is the passcode by default. It’s also possible to enter a second biometric (Face ID or fingerprint) so that two people can open a device. I maintain my mom’s devices, so I’ve set up a second biometric on all her devices so I can easily open them.
Now I’m confused. If passkeys aren’t shared between devices, then how is it that a password manager like Apple Passwords is supposedly sharing them? (I have a section in that app labeled “Passkeys”, and they show up on all of my devices: iPhone, iPad, and MacBook.)
I’m not sure. I’m relatively unfamiliar with the Apple ecosystem and I only have one Apple device. Perhaps Apple implements them differently. I’ll have to do some reading.