And would you look at that suddenly we have TOTP that I can’t write myself and I’m forced to use some shitty app.

I think our definition of what TOTP is, differs. When I say TOTP, I mean TOTP as defined as a standard in RFC 6238.

The behaviour you’re describing with duo is something else, something proprietary. In my mind, duo would be an One Time Password (OTP).

sidenote: TOTP is a specific/narrow implementation of the larger umbrella OTP.

It’s about open standard compliance.

Maybe I’m getting hung-up on semantics, but attestation is an open standard, like gpg is. With gpg you can implement your own encryption/decryption according to the gpg specification and your encrypted data will still be safe because you’re trusting the math behind the Asymmetrical Encryption.

Attestation is identical, but at the hardware level. The public/private keys are created by the hardware manufacturer. The private key is (often) isolated and stored in the CPU (or in a dedicated chip). The public key is freely published, so OS/application vendors know how to validate that an attestation response wasn’t faked. The private key is not exposed and even if it were, the public key could be revoked by the OS/application.

Attestation is great for device level security, but makes it nearly impossible to create backups/clones. :(

So in order to log into most websites, you need your username/email address and a password.

You can save your username/password in your web browser or in the cloud.

Sometimes people get lazy and reuse passwords, sometimes people forget their passwords.

Passkey is a replacement for usernames/passwords. It does require that the passkey is saved somewhere, often on your device (in the cloud is possible, but non-standard).

When you “create” a passkey, this passkey is used only at a single place. For example, you’d have a passkey for your bank, another one for your email, another one for Lemmy. You have no say in the matter, that’s just how it works.

When you log into a website that has passkey enabled, your passkey/password manager pops up, you click on the passkey and that’s it. There is no email address, there is no password, no MFA.

edit: oh, you also asked about the difference between passwords.

It’s all about improved security.

You go to certain websites, and they’ll only allow a-zA-Z0-9, others require a minimum length of 8 characters, needs 3 symbols (except ! for whatever reason ;)

Then you have no idea how the website is storing your password. Are they encrypting it? Did they do it correctly?

If you look at the number of “breached/leaked” passwords on the internet, it’s because it’s hard to securely store passwords.

Passkey solves all this. Websites are just given “a public key” and it can be “just stored”, no special treatment necessary.

Both also have the same potential for abuse, any service could require you use their specific app.

That’s not true. TOTP is just a mathematical formula for how you mix a “shared secret/seed” with the current time.

In the authors article, they mention that you could write your own python program to generate the correct rotating numbers.

There is no way Big Tech could force you to use a specific app, because at the end of the day, TOTP is just math. 1+1=2, that could be calculated by you, your cellphone, or me - it doesn’t matter.

According to the article, Passkeys, on the other hand include a bunch of metadata. For example, can this passkey be copied or moved to another device.

The article is also very clear that all those fields can be faked except attestation.

And for those at home, attestation is a cryptographically secure way for an application to be certain that the application, operating system, and hardware are not modified to work in a way that the OS provider, application, and hardware vendor expect it to.

This has been abused by google/android to prevent/limit people from installing applications outside of the google play store, its been uses to force people to only use google-approved os’ (no cfw, no grapheneos). The same technology is a requirement for windows 11 (TPM).

Now, if FIDO agreed to not include attestation as part of the metadata - this would not be a discussion: everyone would love and use passkey, as you (the user) get to decide how to store/backup and (optionally) share this key.

But that’s not what FIDO did, the attestation flag is included in the metadata. And the author speculates that once people accept passkey, Big Tech will turn the screws and then start to force how you store your passkeys.

So, in an apocalyptic future “coming soon”, when you try to log onto your bank, you’ll be greeted with an error:

“We detected that your passkey is stored in the cloud. Your security is important to us. Please, install your new passkey onto your local device using your manufacturers approved Google Android Operating System and Google Approved passkey application.”

I’m curious if they are able (or have any intentions) to access the gsm modem to send/receive phone calls.

Historically, on android, this was a vendor specific binary blob, which really limited what you could do with it “as a phone”.

In vaultwarden, they do appear in the web client. The behavior you’re describing hints that your passkeys are not being stored in bitwarden.

…and tbh, the UX sucks pretty bad: I was trying to store a passkey in bitwarden, but it was failing (unrelated networking error). I had two options: add it to bitwarden (which failed) or cancel. I hit cancel and was prompted for my fingerprint, which I provided – this ended up storing it on my device… no input, no description of what it was doing. The website came back with “passkey now enabled” :facepalm:

In the bitwarden browser extension, settings -> autofill -> “make bitwarden your default password manager”

Is this checked?

I also set a “pin” in settings -> account security -> “unlock with pin”.

(After reading the article: maybe passkey requires bitwarden to be “more secure” - I dunno)

I’ve already been avoiding them because I don’t see how there’s any security advantage over TOTP…

I’m not going to challenge your choice in using passkey or not. However, I do want to set the “technical record straight”: passkey is the successor to TOTP in every technical way*.

TOTP works by having a “shared secret” saved by both you and the place that your authenticating against. This shared secret is then mixed with current time to generate a rotating number that the client shares with the remote server. The remote server does the same calculation, if the rotating numbers match, the user is successfully authenticated.

With TOTP, this means that there are two attack vectors: your device and the remote server. If an attacker is successful in getting the “shared secret” from either, your TOTP is effectively broken.

Passkey works more like ssh-keys. The client generates a public and private keypair. The client only shares the public portion with the remote server and stores the private key locally (or in your password manager).

So the only attack vector (with passkey) is your device (this is often why it’s bundled with attestation). Also passkey is not dependant on both the client and server having their time kept in sync. With TOTP, if you have more than ~30 seconds drift between the client and server, they will be generating different rotating codes and never match (which is confusing when you need to explain this to your Grandma).

• there is one thing TOTP can do, that passkey cannot: TOTP is 2FA, your TOTP can reside on a separate device (ie your phone when logging in using your PC). With passkey, you’d need to enable 2FA on the passkey manager (which varies from manager to manager).

…unless the passkey is the only way to access the account (which would be awful for account recovery).

Recovery options are never going to go away. With TOTP, you often have one-time use backup codes. Email, SMS recovery etc.

I’ve experimented with this and haven’t had a problem. However, I was using the open source fork Vaultwarden and only the browser extension(s).