219
Passkeys are a trap. Do not use them (nonfunctional.substack.com)
submitted 1 day ago by to c/privacy@lemmy.ml
160 comments fedilink hide all child comments
 

cross-posted from: https://lemmy.bestiver.se/post/1390699

Comments

you are viewing a single comment's thread
view the rest of the comments
[–] 11 points 23 hours ago* (last edited 22 hours ago) (9 children)

So in order to log into most websites, you need your username/email address and a password.

You can save your username/password in your web browser or in the cloud.

Sometimes people get lazy and reuse passwords, sometimes people forget their passwords.

Passkey is a replacement for usernames/passwords. It does require that the passkey is saved somewhere, often on your device (in the cloud is possible, but non-standard).

When you "create" a passkey, this passkey is used only at a single place. For example, you'd have a passkey for your bank, another one for your email, another one for Lemmy. You have no say in the matter, that's just how it works.

When you log into a website that has passkey enabled, your passkey/password manager pops up, you click on the passkey and that's it. There is no email address, there is no password, no MFA.

edit: oh, you also asked about the difference between passwords.

It's all about improved security.

You go to certain websites, and they'll only allow a-zA-Z0-9, others require a minimum length of 8 characters, needs 3 symbols (except ! for whatever reason ;)

Then you have no idea how the website is storing your password. Are they encrypting it? Did they do it correctly?

If you look at the number of "breached/leaked" passwords on the internet, it's because it's hard to securely store passwords.

Passkey solves all this. Websites are just given "a public key" and it can be "just stored", no special treatment necessary.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 9 child comments
    •
  • [–] 1 point 22 hours ago (8 children)

    This is still fuzzy. What would this look like in BASIC?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 8 child comments
    •
  • [–] 15 points 18 hours ago (3 children) 
    10 PRINT "So in order to log into most websites, you need your username/email address and a password."
20 PRINT ""
30 PRINT "You can save your username/password in your web browser or in the cloud."
40 PRINT ""
50 PRINT "Sometimes people get lazy and reuse passwords, sometimes people forget their passwords."
60 PRINT ""
70 PRINT "Passkey is a replacement for usernames/passwords. It does require that the passkey is saved somewhere, often on your device (in the cloud is possible, but non-standard)."
80 PRINT ""
90 PRINT "When you "; CHR$(34); "create"; CHR$(34); " a passkey, this passkey is used only at a single place. For example, you"; CHR$(39); "d have a passkey for your bank, another one for your email, another one for Lemmy. You have no say in the matter, that"; CHR$(39); "s just how it works."
100 PRINT ""
110 PRINT "When you log into a website that has passkey enabled, your passkey/password manager pops up, you click on the passkey and that"; CHR$(39); "s it. There is no email address, there is no password, no MFA."
120 PRINT ""
130 PRINT "edit: oh, you also asked about the difference between passwords."
140 PRINT ""
150 PRINT "It"; CHR$(39); "s all about improved security."
160 PRINT ""
170 PRINT "You go to certain websites, and they"; CHR$(39); "ll only allow a-zA-Z0-9, others require a minimum length of 8 characters, needs 3 symbols (except ! for whatever reason ;)"
180 PRINT ""
190 PRINT "Then you have no idea how the website is storing your password. Are they encrypting it? Did they do it correctly?"
200 PRINT ""
210 PRINT "If you look at the number of "; CHR$(34); "breached/leaked"; CHR$(34); " passwords on the internet, it"; CHR$(39); "s because it"; CHR$(39); "s hard to securely store passwords."
220 PRINT ""
230 PRINT "Passkey solves all this. Websites are just given "; CHR$(34); "a public key"; CHR$(34); " and it can be "; CHR$(34); "just stored"; CHR$(34); ", no special treatment necessary."
  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 0 points 17 hours ago* (1 child)

    No, I mean the actual code. It's been decades since I've used BASIC but a password programd would look vaguely like this:

    10 x=1234

    20 Print "What is the password?"

    30 If user input equals 1234 goto 60

    40 Print "Incorrect"

    50 Goto 20

    60 Print "Correct"

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 1 point 16 hours ago

    Your 1234 example is stored in plaintext, which is bad practice but still happens sometimes. Usually 1234 will be hashed (irreversible and functionally unique string) and the user input gets hashed with the same algorithm to check against the server's stored hash.

    Passkeys are fundamentally different and work with public-private key pairs. It's not possible for your public key to be "stored incorrectly" because it's meant to be public. Your private key stays private and you never have to send it to the server to be checked against what they have stored. Instead, the server sends you a mathematical challenge that you solve with your private key. The resulting answer is also irreversible and functionally unique, but in such a way that the answer can be checked with the public key to make sure it was solved by the associated private key. It's really clever math that's worth watching or reading up on to understand.

    I don't understand the maths well enough to give you a pseudocode example, but I always found trying to simplify it made it difficult to understand anyway. Every analogy ended up falling short because it was an analogy and not what was actually happening under the hood.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 1 point 19 hours ago (3 children)

    Imagine instead of inventing and storing passwords in your head and typing them in each device. With passkeys each device generates a real, cryptographically strong password for each site and stores it in a secured part of the device. Nothing to memorize.

    Sites must now to let you have many passwords so you can have many devices without needing to sync between devices like a password manager might do.

    No one can guess your password and it is never reused because they are machine generated. They are protected on device by the security of your device (typically behind a pin) so if you trust your OS, it is safe (which, in effect is the same as passwords you type).

    Unfortunately, the experience still sucks and shitty companies might use them to further lock people in if they end up with all their passkeys on one iphone, for example.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 1 point 15 hours ago

    Microsoft has been a major annoyance on me with passkeys. I don't like not knowing for sure that I can get back into an account if any of my devices get fucked (authenticators are nice and I do have some things setup but always worry if my phone is broken or lost out of nowhere). They (Microsoft) have such a dark pattern way of pushing passkeys. When I have to help someone get into their MS account at work (normal consumer PC stuff not IT/corp stuff) which is already hard since the people I try to help already don't tend to realize how important even simple things they don't think about WILL fuck them later. Some examples are stereotypical "boomers" that default to adding their land-line when an account asks for a phone number, or that they were even making an account (another dark pattern from Windows 8 where sooooo many people created @outlook.com accounts without really paying attention).

    Obviously I experience a higher than average amount of tech illiterate folks (that also seem to just not care like shit is still the Windows 7 and earlier times). But Microsoft pushes dialog prompts/boxes for physical security keys and passkeys in a way that at first seems like the person has one of those setup. In some cases trying to sign into an account without a passkey/security key it will do what I expect. Give an extra option to not keep using a password or password+text/email code, or setup passkeys to "not have to worry about remembering passwords". Though I still think they don't really clearly explain how crucially important it is to make sure the person's information for the account is correct and making damn sure to know recovery options if anything happens.

    But I started seeing just a box pop-up that looks like a system prompt that only gives two options. Enter your PIN/insert security key, or to use the authenticator app. No obvious option for picking that neither are setup. The only way for not using those is to click the X on the top-right of the prompt. In some cases I have seen people click on the options and it just acts like they are setup. Pick the authenticator option and it asks for the code on an app/device that doesn't exist. In the cases that it does start the process of setting up passkeys, I still feel like they are trying to trick people into it rather than the users choosing to do it.

    Again I deal with more than average "I'm not a 'techy'!" kinds of people along with older folks. But it really does seem like any level of tech literacy keeps getting worse based on running into more and more people of all ages. Which is what freaks me out about how these things are suddenly seemingly pushed on folks at the worst moments. A lot of people first trying to setup their new device just want to get into it as fast as possible, and really don't understand how they can just lose access to so many things they didn't realize are now tied together. Let alone be aware that they should export those things to something that isn't tied to the OS in the event they for some reason want to get something else (PC to Mac/Mac to PC/Android to iOS/iOS to Android/etc).

  • permalink
  • fedilink
  • source
  • parent