- cross-posted to:
- [email protected]
- cross-posted to:
- [email protected]
A rebuttal to an anti-passkey, pro-TOTP post that has made the rounds on Lemmy as well.
You must log in or register to comment.
“TOTP is phishable.”
i can safely say both articles were made by insane people. all i can say is, to keep using generated passwords and offline 2fa codes. dont click on the naked lady in the spam folder.
have a good night, kids.
Passkeys are 100% not a trap, but they’ve been fucked over by being allowed to be portable. Now your passkey is only as good as the portable password solution you’re using to store it. They’re meant to be 1:1 computer->service. Then there’s the issue that most of the sites that accept passkeys let you bypass them with passwords or TOTP anyway.
TOTP, however, is REALLY fucked. Even a rudimentary phishing email can get your time-based key, get in and fuck your account over in real time.
Passkeys are extremely phishing-resistant. They are the best thing we have short of a YubiKey at the moment.
Yubikeys are amazing, But they’re not meant to be permanently carried, just used to stitch your securred devices together.
Let’s just go ahead and add a third, fourth, AND fifth authentication factor so maybe I’ll kill myself first thing every morning
I use hardware keys to connect to my own self-hosted services and login on (some of) my devices. There is no 3rd party involved.
Some of them like NitroKey are even open hardware. I have backup hardware keys.
It’s amazing. I can’t believe it took me so long to rely on them.
So… IMHO if you don’t like (hardware) passkey it’s because you dislike services relying on them, no the keys themselves.
Passkeys have inherent advantages over passwords. They are more secure.
- Public-private cryptography vs shared secret
- They can be stored in an authenticator that can never leak your private key.
- You can have many passkeys for the same account and they are all unique and can be revoked individually.
- Can be put in a password manager. (less secure, but still better than password. see point 1)
The standard requiring the authenticator to report attestation if asked, opens up for abuse though.
Even if the standard allows them asking for attestation; the nice thing is that they can’t force the passkey in to protected storage, as long as there is a browser like firefox in between you and them. (don’t use non free apps) So store all your passkeys how you wish and the day they start asking you to replace those passkeys with their better storage options, you just don’t. If they lock you out of your account, then stop using their service. Don’t use shitty services when they abuse you.
They are turning off passwords before they start asking for attested authenticators anyway. So might as well enjoy the convenience of passkeys while they are working like you want them to.
they can’t force the passkey in to protected storage, as long as there is a browser like firefox in between you and them.
You also need to not use Windows Hello, or Apple Touch ID / Face ID (which actually is the default in Windows & Apple, even if you are using Firefox). Otherwise the browser will relay the request through them and provide the attestation.
The problem is when the mainstream people do use those methods because it’s the default, they don’t know, or it’s simply more convenient since it’s bundled in their proprietary OS that they (stupidly) trust.
If having your own non-attested custom method of providing your passkeys becomes something niche amongst the users of passkeys, then I would not be surprised if many places flip the switch and start requiring attested methods.
Of course one can always switch to more consumer-friendly alternatives even if they are more niche, but as long as they remain niche it won’t stop the big services from pushing for anti-consumer practices.
I get the anti-phishing notion, but they are buggy pieces of shit so you can’t use them even if you wanted to
Passkeys are not perfectly implemented on every service and not exactly widely available. I use passkeys on a handful of places. Where they work, they are nice. I want my accounts passwordless and no multi-hassle-authentication any more.
They should stop pushing them since they don’t work. It takes more clicks now to get to the regular password options because they try the non working passkeys first now. You have to click “show more options to log in” .
That’s why it is So frustrating.
You don’t need passkeys if you don’t have anything important to steal, or any accounts on anything you would feel sad to lose. Just cancel all your subscriptions and sail the high seas! Nobody likes you anyway!
The author of this post works in Apple, Passwords team. They do not deny that there’s attestation; they argue that it’s only used to prevent bad actors.
Cool, we’ll trust corporations then!
Agreed. Even if you trust her words, she’s only one person and Apple could override any decisions she makes.
It makes me wonder about the people in Google who worked for, maintained, and advocated the openness of Android. Only now for Google to continually lock it down.
Corporations never, ever, act badly!
It is not like they are treated as people with rights but fewer consequences for their actions, right? Right, guys?
and they would never violate your trust and later force this onto you because the love their users.
the more apologetics for this shit i see, the less i trust it.
- Describing TOTP as a “great solution” for adding security to a password-based account. When the most common threat model on the web is phishing (a word the post never mentions!), TOTP hardly buys you anything. TOTP is phishable.
If (after decades of awareness) you manage to get phished while using TOTP, you shouldn’t be trusted with a phone or any digital information at all
I know someone who works at a fairly large public university where TOTP is required. People (mostly students) are still constantly getting phished, despite TOTP. I guess young people don’t have the decades of awareness that some of us have.
Phished doesn’t mean just a plain old phone call or email these days. It can still happen, and does. But there are now reverse proxy systems that clone legit web pages to steal TOTP by appearing legit, and they’re highly successful.
I didn’t know of this, I still prefer the control TOTP gives you but yeah, that makes an argument for the passkeys I guess.
TOTP tokens are often distributed as QR codes, where you can store in more than one place, store/copy/transfer in plaintext between people or places. Compromise of that token gives permanent access to all TOTP codes generated.
I’m not a fan of how most TOTP apps and implementations actually work right now.
Granted. But there are plenty of users who probably shouldn’t be trusted with any digital accounts, but they still have to use them for daily life. If we can make it harder for them to mess up we should.
The problem is that if they’re getting phished with TOTPs then they’ll walk through a scammer over the phone to let them access their accounts other ways.
You can put all the security in place all you want but 99% of breaches aren’t coming from red team actors “hacking” into a system. It’s way easier (and even moreso now with LLMs able to do robo calls with human sounding voices) and get Brian from accounting to give up his shit…or even the CEO to give up his.
I’ve seen it all, they willfully will give over their access because they’re dumb as fuck.
Can we Not Act like only idiots can get phished? Nobody is Safe, especially when the phishing attempt is incredibly convincing
Most of the people who get phished, are not educated enough to avoid it. They don’t want to be, because computers are just supposed to work and not be something they need to learn.
If you’re educated and ask questions vs just assuming everything is legit and giving away everything they ask for then you realize quickly that phishing is not as convincing as you’re making it out to be.
What is the difference from two factor with aegis + random generated password with keepassxc, and passkey saved on keepassxc.
The passkey won’t work on a lookalike phishing site, but the password and totp can be inputted into it
There isn’t one. That’s exactly the point. The original article had issues with vendor-specific passkeys (Google, Apple) that essentially are only accessible through their ecosystem.
no, fuck passkeys. they will lock everyone in with their proprietary bullshit.
use a good generated password in a manager if you will. don’t trust anything but corps are pushing.
What propietary bs? It’s an open standard.
the www is also an open standard, and google controls it through chrome.
that’s quite a leap.
Yes google does have a lot of control over the HTML and HTTP specs because they control the most popular web browser. Whether people are or will in the future be “locked in” to google for that reason is debatable.
Regardless, the potential for a company to dominate the implementation of a specification is not a reason not to create said specification.
Regardless, the potential for a company to dominate the implementation of a specification is not a reason not to create said specification
yes it is
So we shouldn’t have created HTTP because Google might appear?
Imagine if HTTP explicitly documented as part of the standard that the “User-Agent” header, when provided, must include a tamper-proof cryptographic signature that allows to securely identify which browser version the user has (with a consortium maintaining a list of registered browsers) so that websites can reject access if you are not using a browser they trust or they don’t like that your browser is too old…
Considering how much abuse there has been with the User-Agent header… I can’t imagine it being a good idea to include such a thing in the standard.
If on creation HTTP had included things like that, then I think Gopher and other competitors at the time might not have been a bad option, honestly.
I don’t see your point I’m sorry. This would make it easier for Google to exclude small competitors.
we should have learned our lesson after they did and done our damndest to create protocols immune to capture. there were excuses in 1989, there aren’t now
How do you create protocols immune to capture?
Is this the new “killing baby Hitler”?
Honestly not sure what’s going on in this thread.
Don’t invent the internet because then you will have internet companies.
google will also control the moat popular passkey manager. is that not obvious by how they already control the most popular password manager, browser, search engine and more?
I’m really struggling to follow your logic here. You’re saying they already have the most popular password manager so we shouldn’t support a next gen, more secure, open standard because Google will have the most popular client for that also?
The obvious problem with this reasoning is that… there will be alternatives of you don’t wish to use googles implementation.
unless google finds a way to lock you in (or out), like they’ve done pretty much everywhere else. me and you using foss won’t change what’s coming for society at large.
i mean how can you not see how they have been hoovering up everything on the internet for the last couple of decades and think they won’t find a way to to capture this too and run it their way, like all before it?
I do see Google’s behavior and I’m certain that they will do their best to capture this as they have everything else.
However, it’s an absurdity to suggest that we should not develop new protocols because google will act to ensure they have the largest market share.
What are you talking about? I’m locked in with all my passkeys that are stored in my open source self hosted password manager that syncs across all my devices?
Like, I’m confused on what you mean
people self-hosting their open-source password managers are in the vast minority. most people will use whatever is pushed to them, which is gonna be vendor lock-in.
Sure but that’s not an inherent issue with passkeys.
You can use whatever proprietary password manager you’d like. Sure that often means people are using the device built in ones…
But why should that stop me personally from using passkeys?
True story … take it as you like,
my 8 months old reddit account was filter flagged as a bot after commenting the following
“death to the Epstein class and fuck Israel the genocide state”
The only way to get it back according to reddit was if i used IOS authentication passkey.
Not the normal password manager i use on Firefox but no it must be passkey on ios.
Now i am convinced that 8200 unit of the Zionist regime have my facial biometrics.
A passkey is just traditional PKI in a trench coat, your biometrics are A) not even required as you can just use a PIN and B) are not sent from iOS when unlocking the passkey.
I love how you provided no rebuttal to my two points. The EFF even goes into detail on how it works. The beauty of an open standard is that you can verify these assumptions of yours.
I don’t need to, if you read my comment again you would understand my point.
But let me try to breakdown what i mean; you need to wake up from your lala land, if you truly think and believe corporations that are actively participating in genocide and killing children will really care about “policies and terms of usage”.
Your statement reads like someone who used to believe the “don’t be evil“ google policy citing it as evidence in his head.
If that is how you stand, then good for you, but i don’t, actually i view such corporations as a dangerous entities to humanity.
Hope its clear for you now.
You can use a foss alternative like keepassxc to set up a passkey so you control the file instead of trusting it to Apple.
I misread your second sentence as “my 8 month old’s reddit account” and was confused when there was no payoff to the premise of the shitpost.
This ^
the idea is that there will be a ‘central repository of trust’ and it ain’t you. the step of moving that to ‘verifying you’ is short. the next step of monitoring you comes for free. the next step of managing you is the plan.
I’ve had trouble with them with my gear.
I intend to continue with keepassxc wherever possible until compatibility is built out.
I’m using GNU pass, it doesn’t support passkeys. I’m using Arch with Firefox. When a site requesting a passkey, Firefox says touch the key. I don’t know what to do so I cancel the process and search for a workaround.
For example npmjs.org, they require passkey for publishing packages, so I rather have to create an API token which supposed to be for CICDs and publish the package with that instead.
It’s f*cking awkward. I have a secure password manager, offline, nowhere shared, even the passwords are encrypted. Don’t force passkeys on me for no reason, I was secure before as well. And even if you do, at least it should work. As always Linux users left behind.
Without browser extensions, Firefox only supports hardware passkeys, so it’s waiting for you to plug one in and touch the “attentive” button.
“Even the passwords are encrypted” I would certainly hope so! Seems like the bare minimum for a password manager 😄
Yeah but most of them are just opened up and stays like that, e.g. I open an app and it can read my gnome keyring passwords
I have a secure password manager, offline, nowhere shared, even the passwords are encrypted.
How can the service provider tell, though?
The point of passkeys is to create an authentication flow that is easier for users to keep secure. The question, then, becomes whether a service provider should make user authentication decisions based on the worst case scenario, best case scenario, or average case scenario. Passkeys are a reasonable way to make sure almost all of your users have secure login credentials, even if the best of the best users would have just as secure login credentials with traditional passphrases.
I’m another gnu pass user, made a similar complaint in one of the other threads. I see dessalines claiming here that they use passkeys just fine with a 'FOSS" password manager. I guess that means it’s up to us to contribute an implementation of some kind.
There’s a discussion/issue on the codeberg hosting of the passff extension that seems to lay out what is needed: https://codeberg.org/PassFF/passff/issues/581
I’m quite confused about all the suspicion about passkeys. I just add a passkey to my password manager whenever the service offers it. I don’t understand the “lock-in” concern because I can just import + export my passwords between managers
You can, maybe, have you actually imported or exported all of your passkeys before?
The concern is that in order to solve a technical problem, trusting the user, a system of actions and technologies called remote attestation was added to the passkey design. It allows for the service being authenticated into to figure out if it even wants to accept the supposed users attempt. One way remote attestation can be done is by client. Not using a client the service accepts? No way in even if you have the right credentials!
This is really powerful technology that lets me ensure my own services won’t even allow connection to insecure clients or just clients I don’t wanna talk to.
But of course we’re not talking about me using passkeys to gate access to my own services I control, we’re talking about Google, Microsoft and Apple doing it. So built into the passkey standard is the capacity for the service to simply stop allowing you to access it with a passkey if you don’t have the right thingy (or any other suite of remote attestation technologies, client is just one example).
Do you know if your passkeys do this? Do you know how to get in to your accounts if passkeys are suddenly not working?
People are mostly afraid of lock in, control, etc here but the real problem is that most users don’t understand how passkeys work. How can you comply with a regime of passkey use if you don’t know how they work?
There is no reason for you to be using a passkey if it’s in your manager already
passkeys are more phishing resistant than passwords, even with password managers
Passkeys use public-private cryptography and password use shared secret. So regardless if the key is stored in a password manager, the passkey is still more secure. It would be impervious if stored in a security key. But it is still more secure than a password, even when handeled the same way.
Right up until you attempt to log in on an less trusted device. Password+TOTP fixes this.
