A rebuttal to an anti-passkey, pro-TOTP post that has made the rounds on Lemmy as well.
You must log in or register to comment.
- kepix@lemmy.worldEnglish1 day
“TOTP is phishable.”
i can safely say both articles were made by insane people. all i can say is, to keep using generated passwords and offline 2fa codes. dont click on the naked lady in the spam folder.
have a good night, kids.
- 1 day
Let’s just go ahead and add a third, fourth, AND fifth authentication factor so maybe I’ll kill myself first thing every morning
- rumba@lemmy.zipEnglish1 day
Passkeys are 100% not a trap, but they’ve been fucked over by being allowed to be portable. Now your passkey is only as good as the portable password solution you’re using to store it. They’re meant to be 1:1 computer->service. Then there’s the issue that most of the sites that accept passkeys let you bypass them with passwords or TOTP anyway.
TOTP, however, is REALLY fucked. Even a rudimentary phishing email can get your time-based key, get in and fuck your account over in real time.
Passkeys are extremely phishing-resistant. They are the best thing we have short of a YubiKey at the moment.
Yubikeys are amazing, But they’re not meant to be permanently carried, just used to stitch your securred devices together.
- 2 days
The biggest problem I have with passkeys is big companies aren’t implementing them to improve your security - they’re implementing them because it absolves them of liability and responsibility for implementing good security on THEIR end and allows them to implement whatever the fuck vibe-coded bullshit nonsense they want without any knowledgeable or skilled staff, and even if it’s good for me too, I’m not inclined to do these assholes any favors. It’ll just make them sloppier and lazier on other elements of security and they’ll turn around and put the blame on the user, and courts will go right along with it because nobody in the legal system can find their asses with both hands.
- 23 hours
Exactly, people keep focusing on whether passkeys are secure as a concept, and they are. However, what we actually need to talk about is how they’re going to be used in the wild, and what companies are likely to do with them. That’s what’s going to affect vast majority of the people.
Using established and tested security implementations instead of rolling your own has been considered good practice since forever. It’s not a bad thing.
- 2 days
It’s not about the implementation - it’s about what passkeys do and don’t do.
Passkeys prevent someone from stealing hashed passwords from the SERVER, but if the server is already compromised badly enough to let someone in, all of the data stored on that server is compromised already anyway. Companies want to use passkeys because there is less involved in implementing secure login credentials, but that is only ONE tiny part of overall end to end security, and I do not for a SECOND believe that they are going to keep on highly skilled, security-minded developers at real salaries when the C-suite says “We’re using passkeys. We’re secure. Fire the high priced developers and get me some interns who can use Claude.”
TLDR: Passkeys are not a magic bullet and they aren’t a game changer, and the false sense of security they push is dangerous.
- 2 days
I realy dont think that’s a thing. End-user login security is a tiny footnote on page 729 of the 2000+ page security document of a large company’s cyber security department. Switching that to passkeys will not change anything about how the company handles security. AI will. But not passkeys.
And as we have seen many times, companies have been bad with security already and many password databases have been breached. Having a tool that limits the impact of bad security is a good thing.
- 1 day
I use hardware keys to connect to my own self-hosted services and login on (some of) my devices. There is no 3rd party involved.
Some of them like NitroKey are even open hardware. I have backup hardware keys.
It’s amazing. I can’t believe it took me so long to rely on them.
So… IMHO if you don’t like (hardware) passkey it’s because you dislike services relying on them, no the keys themselves.
- hirihit640@sh.itjust.worksEnglish2 days
Attestation for passkeys (software-based, syncable credentials) is antithetical to their mass market goals, and would freeze out independent, non-corporate-backed credential managers. It’s an explicit non-goal of the designers of passkeys, who work together in a forum anyone can join.
The web wasn’t supposed to be controlled by corps either, and look where we are now.
If passkeys were to follow the same path as the web, here’s what it would look like. Corporate passkeys get the most users because of OS integration and convenience. Now that they have all the users they can commandeer the standards, and make them so complex and evolve so quickly that non-corporate implementations can’t keep up (think Firefox vs Chrome). Corporations convince websites to drop support for outdated passkeys, citing security issues. Non-corporate implementations are locked out. Monopoly is established.
And now that passkeys are centralized to corps, the government can exert power on them, mandating hardware attestation for things like hardware-backed id and age verification. They push for backdoors, so they can log into anybody’s account. Bye bye privacy.
- 2 days
Question: Why did these corps implement TOTP? You should be able to answer this from an economic perspective of them trying to save money.
Another question: why aren’t these corporations locking down TOTP to restrict them to their own validator apps, in the same way you’re proposing that they might do for passkeys?
- hirihit640@sh.itjust.worksEnglish2 days
Why did these corps implement TOTP?
To reduce support load from people getting their accounts hacked and asking support to get them re-instated. I don’t doubt that these incentives also drive the push for passkeys, but passkeys are much more opaque and tightly integrated with the OS, and is thus more vulnerable to centralization.
why aren’t these corporations locking down TOTP to restrict them to their own validator apps
They are. Authy is the biggest offender I know.
Edit: some info about how Authy locks you in: https://www.bentasker.co.uk/posts/blog/general/switching-to-aegis-for-totp-codes.html. Note that some websites integrate directly with Authy and force you to use Authy to set up the TOTP. The only way out is to use a rooted phone to transfer the codes to another app like Aegis.
- 1 day
I don’t doubt that these incentives also drive the push for passkeys, but passkeys are much more opaque and tightly integrated with the OS, and is thus more vulnerable to centralization.
I’m not sure what you mean by integrated into the OS. I use a FOSS password manager on android (keepassdx), storing passkeys both for apps and websites. When the browser or an app asks for a passkey, android uses the password filling service you’ve chosen (in my case keepass), and it loads up, no differently from when there’s a password prompt. I’m not sure how it works on other platforms like iOS, windows, or linux, but at least on android, you can use a FOSS password manager not integrated into the OS.
They are. Authy is the biggest offender I know.
Specific sites aren’t locking down TOTP, this seems to be an EEE scheme of Authy specifically, since as you say the TOTP codes provided by sites still work with other authenticators. I’m referring to the case where say, amazon forces you to use their app to login, or creates their own custom TOTP or passkey app, and won’t let you log into their site without it, and then you have no control over your login method or codes.
- 2 days
why aren’t these corporations locking down TOTP to restrict them to their own validator apps
But they do. There are TOTP implementations that have been intentionally modified to prevent using standard apps. I don’t remember other examples right now, but I think Steam Guard is one.
- 2 days
what makes passkeys any different from all the other times they have embrace, extend, extinguished? what, fundamentally, stops them from using attestation in the exact way the user described? specifically, what stops the following scenario from playing out?
- passkey support becomes commonplace across the web
- many websites stop using passwords due to their inherent security issues
- most users (for brevity, say 90% or more) just use their OS to store passkeys because it’s easier
- apple provides attestation for passkeys stored in the Secure Enclave
- google provides attestation for whatever their business goals are
- google refuses passkeys that aren’t attested due to their “security issues”
- apple does the same, which has the added benefit of killing devices without a Secure Enclave
- maybe PCI-DSS requires attested passkeys because of “security issues”
- maybe financial institutions require attestation (similar to the ctsProfileMatch issue with GrapheneOS)
- 90% or more of users don’t notice or care about steps 4-9
- most of the 10% or less need to use at least one account that requires such an attested passkey
- idk what happens with firefox but i’m sure many firefox users (including me) have encountered a website that could work with firefox but chooses not to (based on User-Agent or similar)
obviously that isn’t the only scenario one could envision but i don’t really see what makes this one unreasonable to expect
- 2 days
Once you can correctly answer the question you responded to, you’ll see why its against their material interests to EEE logins, whether its TOTP or passkeys.
- 3 days
Not much of a rebuttal imho. We still have the problem that passkeys are ok in theory, but in practice they’re being pushed as a way to increase lock-in and don’t offer compelling advantages over well-managed passwords.
- 3 days
But most people don’t have well managed passwords. And me having good password hygiene doesn’t stop my data being hacked when someone working at a subcontracting firm to a company I use leaks all my data.
It also is annoying to have to log in over many steps with 2fa, often forced to email or SMS.
Collectively improving security benefits us all.
- 3 days
I think the point about lusers not being able to manage passwords has been argued to death elsewhere, so I won’t take issue with that.
me having good password hygiene doesn’t stop my data being hacked when someone working at a subcontracting firm to a company I use leaks all my data
What has this to do with passkeys? Are you sending your password in plaintext to the contractor who stores it that way, unencrypted? That’s a separate problem entirely. The only benefit I see with just sending them your public key is that they can’t leak your private key, whereas if you used one password for everything, and sent it to them, they could leak it.
Am I missing something? Would passkeys offer an advantage over a password manager? What if the website assigns you a password via DH so that users can’t pick bad ones or reuse them, would it have the same advantages?
2FA can be super annoying, but again I think it’s a separate issue. If I get control of your phone or laptop then 2FA might save you, but passkeys won’t.
- BeMoreCareful@lemmy.worldEnglish2 days
It sounds like they’re saying that if you can manage your passwords then do so yourself and avoid passkeys, but if you can’t/don’t want to then use passkeys.
And they are pointing out that the company is far more likely to lose your password than you are.
Convenience vs security, but the weakest link is probably not the user.
I think you’re mixing up compromise of an account with compromise of the data associated with that account.
If a particular piece of data is accessible to people of a dozen accounts, compromise of any of those accounts potentially compromises the data. That’s a legitimate concern for people who want certain data secured, whether other accounts with access are also secure. In some cases, it may be best to have an authentication policy that provides a baseline level of protection even for the most clueless users, rather than a system where you’re able to secure your own account.
- 2 days
I follow you, but if we can impose passkeys on the security-inept people we are forced to give our sensitive data to, couldn’t we instead force them to use good security?
It’s been like 25 years since the security world basically moved on from assuming that users could be trusted to act securely. We gotta design processes and protocols that keep things secure even with people who have bad habits.
I can secure my email, but every email I send or receive touches at least one other mailbox I don’t control, of some other user. Same with text messages, social media posts, etc. The digital world we use has a billion overlapping people, some with escalated privileges as employees or admins or mods or whatever. We can’t make them perfect, so we should design systems that work well even with imperfect people.
- 2 days
But that’s exactly the problem. Those that were the target audience for the article do not have well managed passwords. For them the passkeys arguably do increase security, while having a bit more “lock-in”.
For those that have well managed passwords (like probably most in this community), they are perfectly fine to use because they don’t have lock-in either. I have full control over my used passkeys.
Basically you’re not getting the “normies” to use proper password management, and for them they do provide additional security and convenience. They can always add more passkeys on different vendors, you’re not limited to just 1 per service. Yes, adding them is a hassle, but so it’s managing passwords and following higher security standards in general.
Passwords are protected (for now) by the first amendment. You can’t be compelled to tell what it is. Passkeys can be seized with a warrant. This only matters in the US but it does matter and I literally never see that addressed.
2 daysFirst time I am reading people orate their passwords🤣😂🤣😂🤣
Now you’re going to tell me the US has free press🤣😂🤣😂🤣🤣😂
- 2 days
After reading both of the posts, I’m kind of back where I started with passkeys: neutral. I’m pretty happy with my current setup of a self-hosted password manager, diceware master passphrase and strong, unique passwords for every account, along with an open source app for TOTP. I only ever see passkeys pushed on me for work-related accounts anyway, but I’m not using them there either. I do have a question though if someone can answer: are passkey protected logins also vulnerable to stolen session cookies?
- 2 days
are passkey protected logins also vulnerable to stolen session cookies?
Yes. 100% unchanged.
- Cricket [he/him]@lemmy.zipEnglish2 days
Hmmm, for someone complaining that another post makes logical leaps, this one has a pretty glaring contradiction that severely undermines their own argument:
The post is predicated on the idea that a feature of WebAuthn called “attestation”, which is only used in high-assurance and usually corporate scenarios, and usually with physical hardware security keys, will be leveraged to hurt people, somehow. The post posits that a website like X will bait and switch users: first, you get a passkey. Then, later, scary “attested” passkeys! This simply isn’t possible to do because attestation isn’t supported on the web for mass market, consumer authentication. Attestation for passkeys (software-based, syncable credentials) is antithetical to their mass market goals, and would freeze out independent, non-corporate-backed credential managers. It’s an explicit non-goal of the designers of passkeys, who work together in a forum anyone can join. And trust me, websites and apps like banks repeatedly asked for attestation at the beginning of the industry’s passkey journey. The platforms, browsers, and credential management apps have held firm that the goal of passkeys is reducing phishing and not some kind of trusted computing scheme. (And I will note: over my dead body!)
In other words, “attestation is bad and everyone is against it, but it’s a feature of the standard.” What they are really claiming is that there is something that for now is stopping governments and corporations from pushing attestation, but how long will that hold? I didn’t have a horse in this race when I first started reading these posts, but this counter-argument is flawed and it makes me lean toward the camp against passkeys.
- 2 days
It reminds me of when Netflix was big and I told everyone they’d have commercials eventually. Sure you can still buy a plan without commercials, but I suspect that eventually, when money gets really tight for them, will go away.
Same thing here. Right now passkeys are “open”, but who is to say my bank won’t require a Apple/Google managed passkey in the future. Hell, I can’t run the bank app without running a Apple/Google approved apk.
- 2 days
I’m telling you why passkeys are garbage:
Case 1
- Login to website
- Maybe use 2FA device
- Website creates session cookie
Never have to login again for the next few months
Case 2
- Go to website
- Use password manager to auto fill credentials
Click like 2 buttons and you’re done
Case 3
- Create passkey
- Passkey is stored on propietary, trust me bro, “we will never share this with the NSA or FBI” Apple or something account where you can’t export them
- User becomes dependent on cloud provider
- User will easier forget their real login data because they don’t use them
- User is fucked if account get’s locked/deleted
- User can still be hacked by simply compromising machine
- No 2FA
- 2 days
Passkey is stored on propietary, trust me bro, “we will never share this with the NSA or FBI” Apple or something account where you can’t export them
No. Most FOSS password managers support them, even keepass and bitwarden. You control them, you can export them as you wish, and even use them across multiple devices. I know because I do this.
- 2 days
Do you really believe your average Apple, Google/Android or Microsoft/Windows user use these?
- 2 days
passkeys can perfectly be used with third party password managers. everything you say here can apply to passwords if you use the Os provided manager.
you can absolutely have 2fa with passkeys. most platforms don’t do it since it adds little value
- 2 days
Os provided password manager
That’s the neat point. You don’t have to use one when you enter your normal login credentials and the average user like does not use one.
But with passkeys you are forced to use one and the average user will use the default one of their vendor.
most platforms don’t do it since it adds little value
Yeah because they obviously don’t care about security (like machine compromise - that’s why there is 2FA in the first place), which contradicts all advantages of passkeys.
- 2 days
I have a basic question, I learned that MFA should draw from multiples of “things you have” (totp) and “things you know” (passwords). There’s all this talk of passkeys replacing passwords, but aren’t passkeys in the “thing you have” category, not the “thing you know” category? My worry is that an unlocked computer or unlocked phone will let someone access ALL of a person’s accounts because now they have the thing and don’t need you at all. Putting access to my entire digital life behind my 4-9 point lock symbol? Or worse, a fingerprint?
- 2 days
Those two categories aren’t really meaningful, but even if you consider them to be, passwords (apart from a master password for your password manager) also should never be in the “things you know” category, because then it means you’ve memorized them, and are not using a password manager to generate completely random ones.
And unless you’ve got an incredible memory that can memorize unique passwords like “+28x@!8eaEak!” for 10+ sites, then you’re likely using a pattern or single password than can be compromised.
- 2 days
I do consider the master password to my password manager as my “thing I know”, and not the randomly generated passwords it stores. But you’re saying that have-vs-know is not really important in the security space, that was mostly just a handy shorthand?
so are passkeys just a simplified workflow version of the complicated dance I have to do on windows to get git commits to push easily with the public key from putty-gen? But also the private key is sometimes locked to the device it was generated on? I guess I should read some actual technical docs on em.
- 2 days
Passkeys have inherent advantages over passwords. They are more secure.
- Public-private cryptography vs shared secret
- They can be stored in an authenticator that can never leak your private key.
- You can have many passkeys for the same account and they are all unique and can be revoked individually.
- Can be put in a password manager. (less secure, but still better than password. see point 1)
The standard requiring the authenticator to report attestation if asked, opens up for abuse though.
Even if the standard allows them asking for attestation; the nice thing is that they can’t force the passkey in to protected storage, as long as there is a browser like firefox in between you and them. (don’t use non free apps) So store all your passkeys how you wish and the day they start asking you to replace those passkeys with their better storage options, you just don’t. If they lock you out of your account, then stop using their service. Don’t use shitty services when they abuse you.
They are turning off passwords before they start asking for attested authenticators anyway. So might as well enjoy the convenience of passkeys while they are working like you want them to.
- 2 days
Let’s get back to after 10 years because this was the same debate about drm in browsers and now we have this https://www.w3.org/TR/encrypted-media-2/
- 1 day
FWIW I don’t have DRM enabled and I can don’t even remember what part of the Web I can’t browse.
Before you ask, no I don’t use Netflix, or Disney+ or audio streaming service nor do I plan nor want to.
- 1 day
When you use librewolf it pops up when websites try to access drm, ex. finance.yahoo.com wants to access it. It’s not streaming services but lots of news webistes that also serve video.
- 1 day
Right, I’ve also seen warnings too from time to time and yet I didn’t seem to miss enough content to even notice.
