I’ve seen the argument that passkeys solve a lot of problems with passwords, but I havent heard a good explanation on how you set up on a new device? At some point you need some way to authenticate that is not a passkey and so you end up back to square one passwords/MFA.
So now we’ve created a whole additional layer of security while not solving the initial problem. Not to mention how do you access an account if you lose your phone/don’t have it on you if it’s only accessible via passkey.
A) log in with passkey prior to device replacement, remove passkey temporarily, then re-add with new device
B) Set up multiple valid passkeys using separate devices, so that a single device failure does not prevent access
C) Use a portable passkey store like a Yubikey that is portable to any computing device
Personally I own two yubikeys; one stays on my person at all times, the other stays at my home at all times. I always add both when creating new passkeys for a service
Some password managers, like bitwarden, allow you to save Passkeys in them, and use them on multiple devices. That’s the only practicable way I’ve found of using them. I need to use most services on multiple devices.
Syncable passkeys do make it easier to handle new devices, but break one of the key values of passkeys - device atteststion. Syncable passkeys are effectively just long passwords as they aren’t tied to a device, meaning anyone who gets ahold of the passkey can access your accounts.
At least with syncable passkeys you can’t have a website leak your passkey (as they asymmetric keys), but with password+MFA a leaked password doesn’t give direct access to your accounts.
Too many services don’t allow multiple passkeys per account. If they are supposed to be device level attestation, you need to be able to enroll one per device. I know that there are some frameworks to connect an enrolled device to attest, but that a) plain doesn’t work well for some configs, and b) is annoying. I understand having a hardware security key for some stuff, but I feel like having that be a random ass phone for most people isn’t really that desirable.
I feel like syncable passkeys are a band aid on top of most services having no idea how to implement passkeys well.
That’s good to know, I’ve honestly been avoiding them as I find the rollout and concept from to be questionable at best.
Given those issues I’ll be curious to see if passkeys keep up their momentum. It sounds a lot like a solution that solves some problems while creating other problems.
I’ve seen the argument that passkeys solve a lot of problems with passwords, but I havent heard a good explanation on how you set up on a new device? At some point you need some way to authenticate that is not a passkey and so you end up back to square one passwords/MFA.
So now we’ve created a whole additional layer of security while not solving the initial problem. Not to mention how do you access an account if you lose your phone/don’t have it on you if it’s only accessible via passkey.
A) log in with passkey prior to device replacement, remove passkey temporarily, then re-add with new device
B) Set up multiple valid passkeys using separate devices, so that a single device failure does not prevent access
C) Use a portable passkey store like a Yubikey that is portable to any computing device
Personally I own two yubikeys; one stays on my person at all times, the other stays at my home at all times. I always add both when creating new passkeys for a service
Some password managers, like bitwarden, allow you to save Passkeys in them, and use them on multiple devices. That’s the only practicable way I’ve found of using them. I need to use most services on multiple devices.
Syncable passkeys do make it easier to handle new devices, but break one of the key values of passkeys - device atteststion. Syncable passkeys are effectively just long passwords as they aren’t tied to a device, meaning anyone who gets ahold of the passkey can access your accounts.
At least with syncable passkeys you can’t have a website leak your passkey (as they asymmetric keys), but with password+MFA a leaked password doesn’t give direct access to your accounts.
Too many services don’t allow multiple passkeys per account. If they are supposed to be device level attestation, you need to be able to enroll one per device. I know that there are some frameworks to connect an enrolled device to attest, but that a) plain doesn’t work well for some configs, and b) is annoying. I understand having a hardware security key for some stuff, but I feel like having that be a random ass phone for most people isn’t really that desirable.
I feel like syncable passkeys are a band aid on top of most services having no idea how to implement passkeys well.
That’s good to know, I’ve honestly been avoiding them as I find the rollout and concept from to be questionable at best.
Given those issues I’ll be curious to see if passkeys keep up their momentum. It sounds a lot like a solution that solves some problems while creating other problems.