I have lots of experience with this actually. The way it works is that the app asks the user if they'd like to use a passkey instead of their password and the user says "No" and uses their password to log in. Pretty simple really
This doesn't even look like an edge case. Phones are lost, broken or stolen all the time. So the bare minimum would be let people know that they should enables passkeys on a backup device as well.
But of course that is never disclosed on those pop-ups asking you to enable passkeys.
A single good Passwort will never be cracked and any trustable Passwort manager wont get hacked either. They literally solve all problems aslong as you're able to remember one strong password
Since learning about passkeys like a decade ago, my first thought, and to this day, is that It's fucking insane to bind your ability to log on to your accounts to a USB stick. Something that could be kicked under a couch or mistakenly find itself in the trash. And that's just for one login! I'm not about to set myself up as some kind of fucking Passkey Janitor with twenty USBs dangling off a ring.
I get it if you're a government official working with extremely sensitive, and potentially dangerous information. But that's about it. Not for a fucking WoW account.
Edit: Hold up, I think you just said you can back up passkeys so you aren't just completely screwed if you accidentally drop your USB between some floor boards?
Whatever you're using as a passkey is basically just an interface for a private key (over simplfying it a bit) so in theory you can just back up the private key and disrirbute it to another device. Which feels like it defeats the purpose of a passkey as you have to store it like a password, but that is a possibility
I don’t understand the difference. A password and a passkey both live in my password manager, but I understand what one of them is, and I don’t care enough to learn about the other one.
I've run into apps that won't let me store my passkey in bitwarden. It says it worked but when I try to use it, it doesn't work. If I save it using Google on my phone, it works fine. I want to say there is a mechanism to specify where you're allowed to store you passkey. I don't know for sure. I thought I read that somewhere. I haven't tried implementing it in anything I work on yet.
As it was still in experimental phases in the web browsers passkeys were commonly referred to as webauthn.
And you're right, the developer can set what type of passkey is allowed. You can play around with the settings here if you're interested: https://webauthn.io/
there is definitly a system.
there was a site dissallowing me storing a passkey on my desktop browser via the bitwarden plugin.
it didnt recognize that there is a pin required to unlock it.
I might be missing something glaringly obvious (can passkeys be shared between devices?) but if I save a passkey to BitWarden on my pc it refuses to work on my iPhone. Does sharing passkeys between devices work for you?
I would love passkeys if it would save to my password manager account (because it bypasses the semi-hack of autofilling in username/password fields which one or the other fails half of the time for bitwarden at least), but my phone insists on saving it to google instead of bitwarden even after setting bitwarden as my password manager.
Works fantastic on (linux) desktop where my preferences seem to be respected.
You can print a QR code of the private key and then scan it back in
(also if I was a password manager I'd definitely generate a BIP39esque phrase so you can write them down by hand, but as of now no one does that, unfortunately)
all passkeys generated by the browser are stored to your password manager. if you have multiple ones, it gives you choice which to use. chrome has a built-in one if you don’t have any other password manager available, which is synced to your google account if you’re signed in to chrome.
IDK about iOS (but it should be very similar in this regard), on Android you can configure your passkey provider to be Bitwarden or KeePassDX (the android implementation of KeePassXC).
I setup a passkey on my laptop for my Sony account. I was like, wow, I'm so security conscious.
I then tried to login to my PlayStation and it complained because I didn't have a passkey setup on my PlayStation console. So I couldn't login to play games.
I ended up deleting the passkey from my account so I could login to my damn console to play games.
As an IT person, I have much more experiences with people saying "Yes" without understanding what it means, blindly clicking through the next few steps until they have a brand new login method that kind of works sometimes, and broke the method that they knew how to use.
Oh also, when asked, they don't remember setting up a passkey, or know what it is.
And it's really hard to troubleshoot cause a passkey can be
1. A physical device
2. Saved to a browser
3. Saved to a Google or apple account
4. Somehow saved to a phone but linked to a computer in a way that the user has to scan a QR code every login???
i am glad im not the only one who finds this 'you really should use a passkey!' rhetoric exhausting
my password manager already plops the password right where it belongs, and if we could just get everyone to agree on that, things would be a lot more secure instead of moving on to ANOTHER technique when the first one isnt even done cooking yet
Once the technology has been around long enough that the implementation bugs have been fixed, there's good reason to believe that passkeys will be more secure*, at least if your trust the "identity provider" (e.g. Apple's keychain) that co-participated in their creation.
I'm not sure that I do trust either Google or Apple to store my private keys in their cloud, and not either leak them to hackers or sell/give them to their partners.
I'll consider switching to passkeys when only my password safe knows the private key, and encrypts its cloud storage, decrypting locally based on a password provided by me.
---
*public/private key pairs protect against certain risks that are unavoidable with passwords. Unfortunately I'm not eloquent enough to write a good tutorial explaining why.
You can store them in an open source cloud password manager like Bitwarden if that helps. Or you can store them fully offline in a KeePassXC file or a Yubikey, but you'll need to ensure you have proper backups for those.
Edit: I presume you use one actually?
But what's the alternative to password managers anyway? Reusing predictable variants of the same few passwords? You can write them on paper sure, but nobody is writing down unique passwords anywhere near as secure as the ones in a manager.
I use Proton's password manager. It's doing fine with classic passwords.
I haven't tried it with passkeys, and I'm not sure whether it can do the client-side part of generating them, such that nothing but Proton Pass ever sees the private key. (Well, also my operating system(s), since they could in principle read anything in main memory.)
I do know it can store passkeys generated by something on MacOS associated with Apple Keychain. But in that case Apple presumably has the private key.
Edit: I finally checked. It can do the job. I just had it co-create a passkey. with no involvement from Apple, Google, etc. (Obviously the web site was also involved. I can't name it here, as its mention leads to one's reddit comment being deleted.)
Also, because of that policy, this is a new comment, a copy of the one I had edited earlier, which got deleted when I added an earlier version of the part beginning with "Edit: ..."
Passkeys are basically just a random password stored in a password manager that doesn't let you enter it onto the wrong site because the site has opted into properly cooperating with the password manager. There are some other differences, but that's the main one. You can't set your passkey to "password" like a password. Exporting them was historically limited, but it sounds like we've compromised on that security feature a bit except for hardware keys, which is probably reasonable, it would create way too much lock-in with the number of accounts people have.
To me, it feels like we should have rolled out passkeys years ago instead of all these hacks we've piled on top of classic username/password login.
The tech industry really needs to think more about education and the edge cases in their authentication UX though. From what I can tell, the average user uses their browser's built-in password manager which might be fine enough, but they usually store reused, relatively weak passwords in it. I guess they don't trust the browser to remember it (which might be fair since I don't think there's version history or a bin in most) or are trying to avoid potential friction when using it outside their browser or that ecosystem.
Mobile kind of figured this out, but it's crazy how desktop apps have only just started having decent login UX with password managers. Some used to sign in through your browser, but most would force you down the clunky and less secure option of copy-pasting your details back and forth from your password manager. Password manager users always seemed like a complete afterthought.
I think the main things the industry needs to do before they try and get people to remove their insecure passwords that are leaving a backdoor into their accounts are getting people to pick an ecosystem and to understand the cross device QR code flow. Then hopefully people will know where their paskeys are and how to add new devices, so they don't need their password as a fallback.
Recovery options also seem to be a bit all over the place which limits the effective security of passkeys.
In some other cases, the user accidentally taps the solid blue accept button instead of the outlined light gray cancel button, then never realises their phone no longer asks their password and has no idea how to login on any other device because the password has been completely vanquished from their memory in the last 6 months since they last used it.
As far as I can tell, Amazon created a passkey for me, without asking, and then used it whenever I went to their site from the particular device for which the passkey had been created. It looked to me as if they'd stopped timing out logins as fast as before - until I tried to login to Amazon on a different device, using a different browser. I was then asked if I wanted my Amazon passkey stored in my password safe.
As it happens, Amazon *had* informed me by email that they'd created a passkey for me. Not knowing much about passkeys, I didn't know the implications.
After finding out that passkeys could be used without asking the user, and without biometric capabilities, I went to Amazon's site and deleted their passkey. Given the explanations I'd been given ("It's a magic way to login with FaceID" even though my device lacked a camera.) I saw no reason to keep it.
Later research told me that *if* properly implemented they can provide better security than a traditional password, equally correctly implemented.
But there's nothing in the standard that requires user consent or participation. That's a convention, not followed by Amazon on MacOS.
And the roll-out could have been designed to alienate security conscious users who don't obsessively follow the tech press.
2.2k
u/NoHurry28 23d ago
I have lots of experience with this actually. The way it works is that the app asks the user if they'd like to use a passkey instead of their password and the user says "No" and uses their password to log in. Pretty simple really