I just did some reading myself. Apparently the private key part of the passkey is stored securely on your device and/or in the iCloud Keychain. So if it stored in the latter location, it can be accessed by all of one’s devices using biometrics, etc. on the device to authenticate the user.
That’s exactly what I just read. Assuming the iCloud keychain is secure, I don’t see any appreciable risk with that. I’m unsure of that level of security, but IMO I trust Apple more than Google or Microsoft for example. On its face, this seems reasonably secure, as opposed to say a browser sharing passkeys across devices. Next time I have lunch with my colleagues in infosec I’ll have some questions.
IME, a passkey is something used to make logging into a site a complete PITA. 1) Try to log in. 2) Go get my phone. 3) Try to log in. 4) Lock my phone (enter PIN to lock). 5) Authenticate. 6) Log in and use the site. 7) Log out. 8) Unlock the phone (enter PIN to unlock). 9) Get up and put the phone back to where it was. What if I don’t have my phone?
I take every opportunity to not opt for a passkey. It’s much easier to use a username and password, plus a one-time passcode.
That’s how 2FA works, not passkeys. Passkeys are stored on the device you are using to log in.
When I tried to log into a site (medical, I think, but I don’t remember) it said I was setting up a passkey. I had to go through the described rigmarole. And every time I wanted to use the site, I had to go get my phone to log in, then switch to the computer. It wouldn’t let me just log on on the computer. Not going through that again. Oh, and when I revisit the site, I have to lock and unlock my phone and do the whole thing over again. PITA.
2FA is much simpler. You log in, you get a text with a code. I don’t have to have my phone; I just open Messages (and there’s an option to auto-fill the code). Passcodes require a phone and a computer. PITA.
After 18 years in the security space, I’ve been nonplussed (in the original sense) by passkeys because they’ve been poorly described beyond “This here new thingy, it be good, arr bye, use it”.
It’s not that I necessarily need to grok the inner workings (as, indeed, most folks won’t)–and of course that I can find online–but that it’s never been clear to me just what the risks are in terms of being locked out because the passkey is on some other device that I don’t have handy. Again, I could surely find that information online, but as others have noted, when I’m just trying to log on and get something done, I’m not about to go research it. And then I’m not trying to log on, I have other things to do.
The post below was sent by a friend recently, seems trenchant:
That is an example of an improperly implemented passkey (or it wasn’t set up correctly). If it’s done correctly you should only have to authenticate on the device you are using.
Normally yeah, but some particularly obnoxious implementations (like parts of Google) specifically want you to authenticate on your phone (presumably because Google controls it) rather than the computer you’re trying to log in on.
It’s part of the spec, and the website can choose to ask you to “use a passkey from another device”.
It’s just yet another vendor-centric part of that design that hurts the end-user UX…
Passkeys can be tied to hardware. They don’t have to be. They can be in the cloud or on another device on the same account too. It’s just extra confusing all around.
We’re in agreement here.
But how do you do that? If you have multiple devices that you use regularly, (e.g. a desktop, a laptop and phone). Do each of them have to have a special program that can store the passkey? Or do I now have to subscribe to some kind of service that can store them in such a way that they are accessible from whatever device I use? What happens if you travel and need to use someone else’s device to login. What do you then? Ask them to install something on their device so that you can create a key to then access something you need?
I have yet to see any real benefit to a passkey over other authentication schemes. Maybe there are some security benefits, and if it is tied to hardware, I can see how it would be useful in places where the hardware is locked down, but for a regular user, I can’t see how it is better than well implemented authentication.
//i\\
In those situations, you can either add one passkey per device, or use your browser or operating system’s built-in sync across devices.
Passkeys are normally an addition to a password, not a replacement, but I wouldn’t be surprised if there were some really stupid implementation out there that does lock you out if you lose it…
Short answer - it depends on the passkeys and what devices you are using.
I have an iPhone, several Windows PCs and a Linux PC. My passkeys (mostly work related) are stored on the devices I use them on and none require a second device to use. YMMV.
And that, in a nutshell, is what’s so horribly broken about the design.
How does a password work? You remember it or write it down in a password manager.
How does a passkey work? Well, it depends on a secret arrangement between the website, the browser, the password manager, the operating system, the operating system vendor account, your phone, your phone’s operating system, your phone’s password manager, and any additional USB hardware you might have. Simple, isn’t it? Usually it only takes ten or twenty tries to get it working.
Fair points all
Right it is something that is making a lot of assumptions about people’s hardware and online habits. I do not have a browser I log into, nor an operating system that is tied to an online account, so the synchronization is not going to happen in either of these ways. Also, I travel and can encounter wonky network or cell coverage scenarios which most of these new login implementations seem to believe is not something that happens.
//i\\
I use Edge on a Windows laptop and Chrome or native apps on an Android phone. On my laptop/Edge, it defaults to Windows Password Manager (“Windows Hello”). On my phone, it’s Google Password Manager. I don’t bother trying to share passkeys between devices, it’s just one more third-party app to keep track of. And setting up a passkey on each device isn’t onerous.
I’m guessing this is a problem with the credential manager, not passkeys themselves. The passkey doesn’t require a phone, but unlocking the passkey does. So theoretically, @Thumper668 could use a different credential manager that would allow passkey use without authenticating on the phone. But in reality, that’s probably an even bigger pain in the ass.
If it doesn’t lock you out if you lose it, then it’s not adding any extra security.
That’s me exactly. But I use Bitwarden to keep all my PWs stored and synced between the heterogenous devices. Not interested in Hello or Google’s PWM.
I used to have a lot more and more varied devices. So my “5 devices” up thread is historical, not current.
The main advantage to a passkey that I see is that it ensures that you are not logging into a spoofed website, and it doesn’t expose your password to a “man-in-the-middle” attack.
In general, though, I have two fears with cybersecurity:
-
An attacker will hack my credentials, break into my account(s), and lock me out. Large organizations like Apple, Microsoft, and Google are not very helpful if this happens. Their typical reaction seems to be “sucks to be you.”
-
Absent an attack, I will lose access to my account(s) because of a lost/forgotten password or authentication method.
Thanks for posting, this was very informative. I encourage everyone who is interested in passkeys and has at least a moderate technical bent to read it.
For those who don’t want to, here are what I take away as the key points:
-
As alluded to already, “passkeys” are a pretty broad category with different implementations, and such a wide array of possible options that it perhaps doesn’t make sense to call them all the same thing. At the very least, it makes for confusing discussions.
-
The consortium in change of defining passkey standards (FIDO Alliance) is made up of “Big Tech, little tech, national governments, intelligence agencies, banks, various public institutions, and even a handful of nonprofits like Mozilla.” Notably, there are no consumer advocacy groups, in contrast to something like the WWW Consortium that decides on standards on the web. So everything is being driven by business and government needs.
-
The biggest sticking point for the author is a not-yet-implemented standard for remote attestation that could be used to limit user choice around passkeys, the devices you can use, the apps you can run on those devices, or what apps and features you can disable (e.g., trackers or other surveillance tools). By supporting passkeys now, the author thinks we give the FIDO Alliance the green light to move forward with these kinds of restrictions.
-
The author actually really likes passkeys for their security and ease of use. But because of future privacy and freedom of choice concerns, they can’t recommend them.
Reading between the lines, I also think the author has a strong techie bias that maybe isn’t appropriate or applicable for the typical user. Their preferred authentication options are Time-Based One-Time Passwords (TOTS, or authenticator apps) or physical security keys. I prefer an authenticator app over SMS any day, but I can’t imagine forcing all my non-tech friends and parents to use one.