Privacy@lemmy.mlbyMrKoyun@lemmy.world
10 hours

Passkeys

English

Do you people trust companies with passkeys?

I feel like big tech have started pushing for passkeys really hard lately. Microsoft has been asking me if I want to switch to passkeys pretty consistently. Google just automatically brings up the passkey registration fingerprint scan system dialogue every single time I’ve been signing in on Android. Without even asking if I want a passkey or not, it just does it without saying anything. I think the intention is pretty clear, an unknowing person sees the completely random fingerprint scan dialogue, doesn’t think much of it, scans their fingerprint, a passkey gets created automatically.

Well, I fell for their trick. I’ve been avoiding the passkey dialogue pretty consistently for a while now, but just now I was signing in while distracted and accidentally tapped my finger on the scanner by reflex on the prompt. I guess I have a passkey now. Yay.

I did some digging on my Google account settings and the internet, and I couldnt find a way to completely remove the passkey. It seems you can only disable the use of passkeys, but the passkey itself remains. There is also a setting called “Skip password when possible”, which is clearly what has been causing the non-stop passkey prompts. It’s on by default. It’s a shame I’m only aware of it now that its too late.

Theoretically, the passkey standart itself should be private and secure. Throughout the process, the biometric information used for the cryptographic challenges never leaves the device, and the server only gets access to a signature that has been signed with the client’s private keys that it can use to authenticate but can’t derive the private keys back from because of complicated math I didn’t spend enough energy to understand. Google automatically syncs the passkeys with its private keys with E2EE in the Google Password Manager tied to the account, which is where I start to get uncomfortable because I can’t bring myself to trust Google with E2EE.

What do you people think?

19
    • ☂️-@lemmy.ml
      4 hours

      don’t mention it. back when this was new, i told everyone this was gonna happen and got downvoted and laughed at.

      who is laughing now? well not me because it sucks anyway.

    • Voxel@feddit.uk
      10 hours

      Passkeys themselves are a very good security measure, better than a password plus 2FA via TOTP apps.

      But having your passkey tied to a specific device with a specific operating system or an untrustworthy provider like Google, Microsoft, or Apple is not a good idea. You should avoid those and try to use a hardware key with passkey support or a password manager instead.

      • eldavi@lemmy.mlEnglish
        7 hours

        an untrustworthy provider like Google, Microsoft, or Apple is not a good idea

        amen. lol

      • unitedwithme@lemmy.today
        8 hours

        How is passkey better than PW + MFA? Serious question. Everywhere I read online tells me “it’s better” but doesn’t get into the nitty gritty. Also, I don’t use biometrics of face scans on any device.

        Edit: I should add, doesn’t this make online less anonymous/private? Once a site or browser is uniquely identified, couldn’t that be used for better fingerprinting across other sites, hindering anonymity? I feel like data is still going to be extracted or gathered.

        Aren’t they also stored via cookies? What if your authenticated session is stolen via cookies, what then?

        • kevincox@lemmy.ml
          8 hours

          There are a few main benefits.

          1. For hardware-backed keys they can’t be stolen aside from physically stealing the hardware. So unless your machine has malware there is no way for an attacker to authenticate using them.
          2. Even for software keys the site you authenticate to doesn’t learn enough to impersonate you. For example if for some reason your bank leaked some logs with PW + MFA someone could use that to log in as you (although admittedly short timeouts on MFA validity makes that window very small).
          3. The browser ensures that you only authenticate to the correct domain. So it prevents phishing. (Although a password manager that only fills into the correct domain also accomplishes this.)

          So I think if you are using unique passwords with an automated password manager the effective benefit is quite small. However for the “average computer user” who likely has less than 5 passwords that they use for everything it forces a pretty high base level of security.

        • manualoverride@lemmy.world
          7 hours

          Had this a few weeks ago, my partner had her email hacked, she used the same password on a service that was hacked and email/passwords stollen. They first used a ‘forgot password’ on her phone operator account, reported the SIM as lost/stollen and registered her number to a new SIM. Then they could change the passwords on anything they liked as they had her phone number and got the 2FA calls and SMS. They then went through accounts downloading apps and setting up or re-registering MFA once the passwords were changed.

          • unitedwithme@lemmy.today
            4 hours

            Gotcha. OK so maybe a little less applicable to some more than others.

            I already use mostly unique passwords (like a random root word(s) with varying numbers and special characters mixed in) for accounts, and only have my mfa app allowed, not email or SMS. My PW & MFA apps have unique PINs. I also have multiple email aliases for those varying accounts and rotate through after they’re sold every so often. Helps cut down on spam A LOT vs manually unsubscribing. Retail sites are especially guilty of selling info IMO.

            Mine might be slightly overkill, and maybe less necessary with passkeys, but I’ll wait until there are goods self-hosted apps for that.

            • manualoverride@lemmy.world
              1 hour

              Yeah you are going far beyond most people, but passkeys will be a major step up for the majority of the population who still use the same or similar passwords for everything.

        • psycotica0@lemmy.ca
          7 hours

          These answers will be theoretical, because it’s possible some browser or system will do things stupid and negate these positives:

          It shouldn’t make things less anonymous, because different websites get unique passkeys made for them. This also makes them more secure, because if one site has a complete DB leak, that doesn’t impact other sites at all.

          Also, the passkeys are used for auth, so there’s already no “anonymity” here, you’re logging into a website. They know who you are, at least which user you are, maybe not which human, which is as true as it was before with passwords.

          Also they should require your device to ask you if you want to use the passkey, they’re not supposed to be automatically leaking to every site you visit without your knowledge.

          Also, they are not stored via cookies. Unless you mean the login session, in which case that part is stored via cookies, but just the same way that a password login gets a session key via a cookie to use after you’ve logged in. So if someone can steal your cookies that’s already a huge problem, but they don’t get any extra information with passkeys. The actual secret material for a passkey is stored outside of the browser entirely.

          The biometrics aren’t supposed to leave the device, they’re prompted for by the hardware on the device asking if you’d like to allow the keys to be used. The browser asks the passkey hardware “I’d like to sign this thing please” and then the hardware pops up the biometric thing as part of its decision making process on whether it should do that or not. Crucially this is not the website asking for biometrics, it’s your device. And if you unlock it, then it chooses to sign what it was asked to sign, and all the browser gets back is the signature.

          In theory.

          • unitedwithme@lemmy.today
            4 hours

            Thank you for the more detailed explanation of use and practice. That does help! Gives a little more piece of mind too.

    • manxu@piefed.socialEnglish
      7 hours

      I think the thought process from the site’s perspective is simple: most of the attempts to hack into an account come from devices they have never seen, from places the user has never been. All a passkey does is tie your account to a “logical place,” a device (whether a browser, a phone, or a specific hardware key).

      The passkey itself doesn’t tell the server anything it doesn’t know already, it just confirms it, so there really isn’t a whole lot of privacy implication beyond general concerns.

      The big problem, and it’s a more universal problem, comes when you are trying to log in from a device that has no passkey. Maybe you forgot your phone, or you bought a new computer, or something else. The “forgot password” flow, and the related “I am on a new device” flow are some of the weakest spots for computer security, because they presume that something happened that automatically lowers security credentials.

      What I like about one-time codes like GAuth is that you can transfer the keys from device to device yourself. You are very rarely going to be in a position where you can’t access the keys, and as a result it’s fine to put you through extraordinary measures to reset your security. The issue with passkeys is that it’s pretty common that you’ll be using a new device, and as such you can’t be forced to go through hoops every time you need to register a new one.

    • BakedCatboy@lemmy.mlEnglish
      10 hours

      I don’t which is why I use my selfhosted vaultwarden instance to store mine. I refuse to add passkeys to any service if they don’t properly invoke the standard passkey prompt in a way that’s compatible with bitwarden, otherwise I love passkeys and use them everywhere possible as long as I have complete control over them.

    • nate3d@lemmy.world
      10 hours

      I think your problem is more to do with how shitty google is anymore more than the technology of passkeys. From a cryptography perspective passkeys are much more secure than simple username/password authentication as there’s no effective way to brute force or acquire through tools like key-loggers. Like another commenter said, start looking at self hosting your own services like Vaultwarden or the like and de-Google first and foremost. One other massive benefit with passkeys is the fact that they are cryptographically unique so even if an attacker acquires one, it’s only able to be used to access a single site/account.

    • shortwavesurfer@lemmy.zip
      7 hours

      I have recently started using pass keys, but only because my keepass password manager supports them. Since the database is local to my device, I’m okay with it. I definitely wouldn’t be using any kind of cloud thing for those though.

    • normonator@lemmy.ml
      8 hours

      In theory yes, but in practice no. Most companies have implemented them in the dumbest ways and have not used them to increase security. They can pretty much all be worked around with your phone number or email. It should also be a choice not trying to trick users into using it.

      Amazon can fuck right off with their prompt to save on every single login. Microsoft will still try to save passkeys even when you turn it off in windowsso you can use a password manager. They are just creating a fucking mess.

      Password + Passkey as 2fa would be nice.

    • LadyMeow@lemmy.blahaj.zone
      7 hours

      Because of how passkeys work, they are better by default. The site you are logging into doesn’t get any secrets to keep, the passkey identifies you and the control of it is on your side.

      Where you are correct is that if the company has ‘I forgot my passkey please email me’ that makes the security no better than email, which is a shame.

      The issue of storage of passkeys is also one to consider, like another comment said, pick something like Bitwarden to store them, not something vendor specific like Apple or Google.

    • galoisghost@aussie.zone
      10 hours

      I bought a nitrokey because of this trend. Though I haven’t started using it yet. Just gotta get my head around it.

    • Steve@communick.newsEnglish
      9 hours

      Do you people trust companies with passkeys?

      Not sure what you mean. Passkeys are vastly better than passwords. Who are you giving you’re passkeys to, that you’re worried about trusting them? Do you mean trusting they’ll work, and you won’t be locked out of your account?