Passkeys are a trap. Do not use them
Comments
Passkeys are a trap. Do not use them.
Intended audience: non-technical citizens of the webThe Hack (Non-Functional)
Comments
Intended audience: non-technical citizens of the webThe Hack (Non-Functional)
Carlos Solís
in reply to cm0002 • •TaviRider
in reply to cm0002 • • •This is FUD about passkeys. The core issue they have is with attestations. Well servers already have ways to require attestations that don’t involve passkeys.
Maybe there’s some strong arguments against attestations, but I haven’t seen them. All I’ve seen is people arguing that attestations make it hard to violate sites’ terms of use or to evade bans.
IanTwenty
in reply to TaviRider • • •(eventually, via silent ratchet) any website to make demands about the software you run on your hardware. That would be a new thing and a reduction in freedom and privacy.
TaviRider
in reply to IanTwenty • • •It wouldn’t be a silent ratchet though. Attestations require a hardware-backed passkey, which makes them non-transferable. And you can’t convert a software-backed passkey into a hardware-backed passkey. So if your passkey is stored by a password manager that syncs, you’re good.
[Okay, technically it doesn’t have to be hardware-backed to be attested. But if it’s software-backed the attestation becomes of such low quality that it’s not accomplishing the goal anymore. When a device attests that the passkey is coming from device X running OS Y, but that exact same passkey is also synced to other devices running other OSes, the server loses most of the reason to trust that attestation.]
DupaCycki
in reply to TaviRider • • •The second half of your comment is basically what big tech companies do for a living.
What's the point of half of the software standards they proposed, and bribed officials to accept them without addressing issues?
There is no point, other than money.
tatterdemalion
in reply to cm0002 • • •I agree that we should be careful about how we use passkeys, but I don't think "do not use them" is valid advice.
This article only convinces me that a company like Netflix could support passkeys in a non-restrictive form (unattested, copyable, etc) and then ratchet up restrictions slowly as adoption increases. But this is really the same game we play with all other dark patterns like price hikes, pay-to-still-watch-ads, user tracking, etc. The savvy will realize quickly that enshittification is happening, and they will seek alternatives.
To me, this is not adequate justification for boycotting the entire passkey technology. I find them convenient, and I use them in my own homelab identity provider. Only a handful of the services I use even support them properly yet, but I wish more did.
ExperimentalGuy
in reply to cm0002 • • •∃∀λ
in reply to cm0002 • • •Nitpick: the author seems to be under the impression that attestation occurs at login, but what I remember from reading A Tour of WebAuthn is attestation can only happen when a credential is created. In the case where Xitter wants to prevent you from logging in from Lineage OS, the effect is broadly the same. The difference is, instead of Xitter refusing login, either (a) Xitter refuses to create an passkey login option for you if the device does not offer attestation or if the attestation indicates the device could later expose the credential to an "insecure" operating system OR (b) the device simply can't have Lineage OS installed at all or erases the credential or prevents Lineage from accessing the credential while Lineage OS is running.
I'm also not sure if governments or government agencies being members of the FIDO alliance is an indication of nefarious intent. Their intelligence agencies engage in offensive operations, but are also interested in d
... Mostrar másNitpick: the author seems to be under the impression that attestation occurs at login, but what I remember from reading A Tour of WebAuthn is attestation can only happen when a credential is created. In the case where Xitter wants to prevent you from logging in from Lineage OS, the effect is broadly the same. The difference is, instead of Xitter refusing login, either (a) Xitter refuses to create an passkey login option for you if the device does not offer attestation or if the attestation indicates the device could later expose the credential to an "insecure" operating system OR (b) the device simply can't have Lineage OS installed at all or erases the credential or prevents Lineage from accessing the credential while Lineage OS is running.
I'm also not sure if governments or government agencies being members of the FIDO alliance is an indication of nefarious intent. Their intelligence agencies engage in offensive operations, but are also interested in defending their countries against cyberattacks, yes? Moreover, the NSA is not a member. NIST is, but NIST is a standards body, not an intelligence agency.
A Tour of WebAuthn
www.imperialviolet.orgfyzzlefry
in reply to cm0002 • • •