About Passkey – the password-free tech Apple is betting on(fastcompany.com) |
About Passkey – the password-free tech Apple is betting on(fastcompany.com) |
I'll be using keepassxc and passwords until I'm forced to use passkeys and then I'll use passkeys in keepassxc. No way am I tying my accounts to one of more devices controlled by multinational advertising companies.
If the auth cartel deigns to allow it:
https://github.com/keepassxreboot/keepassxc/issues/10407
https://news.ycombinator.com/item?id=39698502
https://news.ycombinator.com/item?id=39706876
Attestation makes passkeys inherently anti-user, full stop.
Many modern countries have laws that landlords can't just kick you out of their apartment on a whim. Phone companies, Electric Power companies, natural gas companies can't cancel your account on a whim.
Companies that control so much of your life Apple, Google, or that have digital assets that you licensed (Steam, Sony, Amazon, Nintendo) need to not be able to cancel you so easily.
When that happens you just ring your C-suite golf buddy from the offending company and have it fixed within the hour, right? Why would anyone have any issues? /s
Summary: It's a password manager on your phone. You sign into your password manager with something easy like biometrics or a PIN. Then all the 'real' passwords for sites are autogenerated and those are what's sent to sites when you log in.
It's interesting seeing how they're being used for lock-in, though. As mentioned in this thread, attestation in the standard will be abused towards that end.
I’m not sure if the author really understands passkeys well, because this statement seems either illogical or false (depending on which platform, device and passkey app one is using).
Doesn't look harder than proper password implementation with hashing, salting, etc.
https://www.corbado.com/blog/passkey-implementation-pitfalls...
The #1 issue as far as I'm aware is that there's no good story around portability. It sounds like using Passkey equals vendor lock-in right now.
Idk how representative this is, but there's been some criticism recently, and the response from some of the people behind passkeys implementation seem mostly dismissive of the criticism. I base this opinion after watching this 'debunking' video on the criticism of passkeys by some key players:
https://www.linkedin.com/events/debunkingmisconceptionsabout...
I was kind of surprised they sort of looked down on the people with concerns. I didn't really have a strong opinion about Passkeys, before watching this. But after watching, I got the impression they people behind Passkeys are probably smart as hell but perhaps not the best stewards of developing open standards and advocates for the general public.
Is this just public/private keys with apple managing the keys and the security of the keys via their auth stack?
In other words, they'll use Passkeys as a way to deepen the vendor lock-in. It has already started. For example, try to log into your Apple ID account using Safari, and it works via passkeys. No password needed. That's because Apple created a Passkey for apple.com automatically behind your back.
Now try the same from Firefox with BitWarden, and it doesn't work. And of course, there is no way for you to set up the passkey manually.
There's also no API to export it. Wouldn't it be nice if you could install BitWarden desktop client, and then use it migrate your passkeys? Nope. Not an option. The entitlement to interact with the Keychain for passkeys is only given out to browser vendors.
I think my personal biggest learning when developing passkey-based authentication is that there's a bunch of useful WebAuthn libraries for every major language / framework. However, these libraries only cover very basic uses cases to login and create a passkey. In real-life applications though there are so many scenarios (users deleting the private key of a passkey, users using non-passkey-ready devices, etc.) that require substantial work on your own and it's not really obvious when you start developing a passkey-based auth solution. It's something that most devs discover on the journey.
It's not like if you create a passkey on a Google device, you're forever bound to Google.