Passkey is just a different password manager. Stop trying to kill the password

8 points by srevenant 3 years ago | 4 comments

My assertion below. Prove me wrong :)

It's clear that a lot of people don't understand the basic tenets of strong authentication, which is best done with at least:

1. Something you know 2. Something you have

This is the heart of MFA. The problem with passwords is around point #1 — "something you know". For so long this has been the ONLY thing to authenticate, and that's a serious problem, because people don't do the #1 very well.

So for years people tried to strengthen #1, which has been a fruitless battle. People continue to write down passwords, they continue to make them insecure, and not rotate them.

But that's the whole point of MFA.

The crusade should be about getting to MFA, not abolishing #1.

The problem with Passkey, is it just swaps #1 with #2, and if anything, gives a very large false sense of security, because most people I know who do actually do MFA also do it on their phone, which is also the same device doing their passkey.

Infact some people think that Passkey is a replacement for having MFA!

But it really isn't much different than just using a password manager.

Because most people use their phone for their MFA (right or wrong), now we are just at:

1. Something you have. 2. The same thing you have.

And folks, that's no longer MFA!

I'm not saying Passkey is bad, I'm saying this crusade to kill the password is completely misaligned, it's confusing people, and it's really better to focus on explaining to people the point of MFA (the above two things).

Passkey is, at best, a QOL thing.

It's BETTER than weak passwords that are never changed. It's BETTER than even strong passwords that are never changed.

But it's really not any different than strong passwords with rotation, and a password manager.

compressedgas 3 years ago |

But there is a fundamental difference. Password fishing is impossible with passkeys. You may authenticate to a site that you didn't mean to with a key you meant to use elsewhere but this does not allow that site to impersonate you on that other site.

rektide 3 years ago |

I don't think you grasp how many different options a site can make when asking for passkeys.

Passkeys definitely retain something you know / something you have restrictions, if the site asks for it.

aborsy 3 years ago |

You didn’t get it. Passkeys are public key cryptography. It’s like SSH authentication with public keys versus password.

hayst4ck 3 years ago |

Instead of framing your opinion through a philosophical theoretical lens, instead frame it through a practical lens or an actual real life security threat assessment based lens. Think about things like phishing, password re-use, sucking data out of the system clipboard, or keylogging.

Passwords are symmetric in nature while keys are asymmetric. This property defeats a very large number of attacks without really increasing the attack surface.

The 2nd factor is not just something you have, but also something you have right now. Time is not an irrelevant factor. You are correct that it is bad for these to co-exist on the same device. Being on different devices boosts security considerably. Yubikeys and secure enclaves are both good things.

> 1. Something you know 2. Something you have

I think you are stumbling over this statement. You are treating it as a-priori truth, when it is not derived from mathematic truth. "Something you know and something you have" is the result of a practical and economic processes of generating better systems of authentication.

> which has been a fruitless battle

This is false, password managers and salted hashed passwords as well as more advanced hashing algorithms have boosted security significantly. Security teams at large companies have done significant work around forcing password changes against people suspected of being compromised. Password managers themselves have started to warn people about password re-use which is also very positive.

> never changed.

Password rotation is not really considered a security practice of value at least among people I know. I think most people who work in security would consider it security theater. Password rotation is a band-aid for the problem of password re-use. Changing a password only matters if the password has already been compromised. So password rotation is a mitigation technique more than a security technique.

> But it's really not any different than strong passwords with rotation, and a password manager.

It's also important to consider that passkeys are behind your phones password or your systems password. So there is still generally a password protecting these items, but the password is a local check rather than a check against a remote machine.

Summary of my response to you:

  The difference between symmetric and asymmetric encryption is real and of value.
  Passkeys still require "something you know" to get loaded into memory.
  You are right to not want multiple factors on the same device.
  Password rotation is a red herring.
  Think of things in terms of the attacker, not in terms of how things "are supposed to be."

Blind adherence to rules that you don't understand how they are made is called cargo-culting and people in security hate cargo-culting. You made a post because you understand that there are things you don't know you don't know, and that is a good instinct. What you don't know is the properties of asymmetric encryption and potentially standard techniques for compromising authentication.

You took the correct idea that multiple factors of authentication being on the same device is bad and turned that into the (IMHO) false idea that passwords have better security properties than passkeys.