My opinion about passkeys is they can fuck off already. I spent a good bit of time setting up a password manager to auto-fill my passwords and thanks to passkeys a shit-ton of sites and apps don’t work smoothly with it anymore. The only app I trust to store passkeys on both my Windows and Android devices is 1Password. Not fucking microsoft, not fucking samsung (is there a three fuck limit in IMHO? oops.) But 1Password doesn’t reliably detect and store passkeys from different websites, so all it does is create extra steps for me when I want to log in.
Don’t even get me started on all the motherfuckers now who don’t even let you opt for a password but instead either send you an e-mail or demand your mobile number so they can text you a code. I have FIVE damned MFA tools on my phone because interoperability is just not a thing with certain companies. Using my cell phone number should not be a stinking option, nor do I want you to call my phone to read out a number to me.
Why is this? I have a single authenticator app that I use for any site that needs it. Just because Google suggests you use their app, doesn’t mean you have to. It’s an open spec that most sites follow.
I’ve heard some gaming sites use their own proprietary app. Are there others you use that force you to use something?
There is something about passkeys that concerns me greatly.
If someone can get access to your account, they may be set up their own passkey. If they do, then they have full access to that account even if you change passwords. And the only way to know that they are there is to check to see what passkeys are enabled.
Even if you have never set up a passkey, the attackers could have one or more set up for themselves to access your account. And if you have never set one up, why would you think about checking to see if someone else set one up on your account?
I use the ProtonAuthenticator for MFA. The nice thing about it is that it is synced between various accounts. Once I set it up using the cell phone to capture the QR code, I can use it from my desktops as well as from my virtual machines.
On my servers, secure shell is set up to require three separate ssh keys. In some cases using a jump account, it can take six separate ssh keys if the jump account itself is set up to use a separate set of three ssh keys then the other accounts.
I have been tempted to get a hardware key and use them whenever practical. I haven’t checked to see if I can use them for secure shell (ssh) connections.
The thing is that in a passkey system, only your side ever has the private password/key. All the other side has is the public key.
Password systems by definition have to have the password on both sides, even if only a hash is stored.
Fundamentally different. Password systems have the password (or a hash of the password) on both sides. Passkey systems are based on public key encryption, which means that the private key (the verification method) is only kept on your computer and isn’t sent anywhere.
It’s all handled automatically by your device (i.e. phone, tablet, or computer). You basically give your device permission to send the passkey to the website. This is typically a biometric (like Face ID or fingerprint), but could also be a device password or passcode.
Essentially you have to identify yourself to your device by some method in order to give your device permission to send the passkey.
As it happens I’m an Android user so I’m not sure that’s an option for us, but I have several close people who are in the iPhone world and might want to know that. I’ll pass it on.
I’m a consultant. Some client VPNs require their particular MFA software, like RSA or Microsoft Authenticator. If you don’t use it, at the very least it can’t do a “push” to your phone for easy authentication, and sometimes it flat out will not work unless you use it.
Androids (at least Samsungs) can accept multiple fingerprints. I have 4 stored so whichever hand is free can open the phone no matter how I’m holding it. There’s nothing that says those prints all have to be attached to one person. In fact there’s no way the phone could know whether they are are aren’t the same person.
I haven’t tried multiple faces so I can’t vouch for that. Easy experiment to make though.