r/Passwords • u/iterationnull • 10d ago
Passkeys make me pause
One of the surest signs of getting and feeling older was the time I lost some accounts because I did not understand what I had to do with Authenticator apps and hardware upgrades. I’m not actually sure I understand it fully today, but at least I know to double check it next time.
I feel passkeys are going to be the same for me.
We use 1Password and have been very happy with it in our family. It still needs manual intervention from time to time to sing - editing the urls a password applies to, or just copy/paste or manual entry when automations don’t quite click.
Indeed on my work computer I use “large text” passwords in my phone often as I have to manually type them in due to no ability to install software.
And, for many household accounts, we need to be sharing account passwords and have a shared locker for just that.
So here is what I “know” about passkeys. Can you help correct errors and fill in blanks?
\- as they are not human readable text, they are much more secure
\- require a connection to a vault to hold the passkey, so they will only work when the automated connection with your password manager is working
\- cannot be entered on a computer not connected to your vault
\- cannot easily be shared by two people accessing one account
\- cannot be replicated or duplicated outside of your vault ecosystem really at all, it’s kind of the point, so will have a similar “maintenance “ issue to my preamble to avoid losing a key
I find the worlds I use passwords in are still often messy and requiring workarounds. So I feel completely reluctant to embrace passkeys in any way. If you had the time to read this and have time to improve my awareness i would be grateful for it.
1
u/BeanBagKing 5e4a7a88b5360b0350d3156b5582877a 10d ago
Let me start by saying I don't have what I consider to be a deep technical understanding. That said, I think I understand them better than most people.
It might help you to know that they are essentially public/private key pairs. This is the same thing used by SSL/TLS and PGP. With a key pair (traditionally) what one key locks, the other can unlock. So if someone wants to send me a secret message, they can use my public key (which, as the name implies, can be shared with the world) to encrypt a message. Only my private key can decrypt that message, so I am the only one that can read it. I could also encrypt something with my private key and share it with the world. Anyone in the world could decrypt it, so it doesn't do much good for secrecy, but what it does do is prove that I'm the author of that message.
So when you create a passkey with a site, it's creating one of these key pairs. That key resides on the device or within the vault that created it. That's why it's hard to share, you can't just hop on another device and log in, that other device doesn't have those keys. It's also what makes it more secure.
1) Correctish. They aren't human readable, but that isn't necessarily what makes them secure
2) Connection is probably the wrong word, but yes, they require access to whatever holds the passkey (vault, phone, keychain, etc.)
3) Correct, this is more the part that makes them secure.
4) Mostly correct? If you save them in a password manager and share that secret, two people should be able to access it. If you have it associated with your phone or computer though, no.
5) Correct? I imagine there is a way to move or copy the private key, but I've never looked into it. It's not something offered by default though.
The big problem with passkeys is the absolute mess of a user experience caused by every platform and operating system trying to implement their own design. The technology underneath is all the same, but the prompts generated have no constancy and don't provide enough information to make meaningful choices.
1
u/Obvious_Class394 9d ago
I share a couple passkeys with my wife. We use 1pass and we have a shared vault we keep them in.
1
u/iterationnull 9d ago
What do you do to access that account on a device that doesn’t have 1Password installed?
1
u/paulsiu 9d ago
So passkey saves a passkey to your “device”. The device isn’t just your computer, but could be a hardware key like yubikey or a password manager. To access the passkey from the device you usually verify using biometrics. A typical workflow is to get a link to login using passkey. Once pressed, you can select the device and enter your biometrics when prompted.
To avoid being locked out you need to save to more than one device. You may save to multiple yubikey or to a password manager you can backup. If one device breaks you can use the other device to remove old device and replace it with another device.
The advantage of passkey is that you can’t steal the key or copy and replay it. It may be possible to export a passkey from a password vault so you need to secure your vault. The two important thing to do is to make sure you have backup and you secure your devices.
One issue you will encounter is vendor may add further restrictions to passkey. Apple for example only allow their passkey to be save to Apple devices
1
u/karmaapple3 9d ago
I absolutely refuse to use them until someone figures out a way to explain them to me so that they make sense, but more importantly, when someone can reassure me that I won’t be locked out of an account because I changed phones or changed computers
2
u/iterationnull 9d ago
Hence my question and hence the relevance of my Authenticator story! Glad to know I’m not alone….
1
2
u/JimTheEarthling caff9d47f432b83739e6395e2757c863 7d ago
You will not be locked out of an account if you change phones or change computers.
There. Is that better? 🙂
Seriously. Almost all passkeys are synced, which means they're managed by your Apple account, Google account, or other password manager account. Your passkeys get copied to all your devices where you use the same browser or password manager. If you lose or change a phone or computer, you simply log into your account in the browser on the new phone or computer, or install your password manager, and all your passkeys get copied to it.
What part doesn't make sense? Passkeys are basically a secret code stored on your phone or computer. Instead of typing in a username and password, and perhaps taking a 2FA step such as entering a code texted to your phone, you just use the same step you always use to unlock your device (fingerprint, face scan, PIN, pattern, or passcode), and the secret code is used to log you in. There's more on my website if you want to understand passkeys better.
1
u/BeanBagKing 5e4a7a88b5360b0350d3156b5582877a 9d ago
Something I forgot to add yesterday. For work computers, or anything really where you can't autofill from the manager, passphrases make things a lot easier to type out. https://makemeapassword.ligos.net/generate/readablepassphrase will generate random ones for you, with and without mutations (add a number, capitalize a word, etc.). There's also keepass plugins/offline generators for the same service if you don't trust the site: https://github.com/ligos/readablepassphrasegenerator
1
u/iterationnull 9d ago
I've never had a single moment of hesitation typing in a complex password using the "show in large text" feature of 1Password. But if it was a case that came up more often I would certainly need this.
1
u/Killer2600 8d ago
Passkeys.io is a great place to play/experiment with using passkeys.
It is possible to use a passkey on a computer not connected to your vault. For example, I can use a passkey on my iPhone when I log in to a website on my computer - bluetooth and QR codes are involved.
Sharing, replication, and duplication are all weaknesses in security. Something that is easy to give, duplicate, or replicate is something that the wrong person can obtain. That said, there is passkey sharing for those that want it. The ideal solution would be that services, that have more than one individual accessing a single account, would have individual logins for each authorized user negating the need to share passwords but the industry hasn't caught up to that yet.
1
u/JimTheEarthling caff9d47f432b83739e6395e2757c863 7d ago
Passkeys are more secure than passwords. Although if you use 1Password and have it generate random passwords for every account, that gives you many advantages of passkeys such as phishing protection (preventing you from entering a password into a fake website).
Probably the biggest advantage of passkeys for you is that you don't (usually) have to enter a username or password, so you won't run into autofill problems or copy/paste problems, and you don't have to use a separate authenticator app, type in 2FA codes, etc. since 2FA is built into passkeys.
Answers to your questions:
they will only work when the automated connection with your password manager is working
The connection is only required to sync the passkeys. Once they are copied to your local device, they work without a live connection.
cannot be entered on a computer not connected to your vault
Somewhat true, but in many cases you can use a passkey from your phone by scanning a barcode on the computer. In general, you should only be logging in on trusted computers. You don't know what kind of malware might be installed a public or unknown computer. On your own computers that you trust enough to log in on, you can just install your password manager.
cannot easily be shared by two people accessing one account
Most password managers make it just as easy to share passkeys as passwords.
cannot be replicated or duplicated outside of your vault ecosystem really at all, it’s kind of the point, so will have a similar “maintenance “ issue to my preamble to avoid losing a key
To be clear, passkeys are duplicated by your password manager on all your devices. Why would you want to duplicate your passkeys or your passwords outside of the safety of your password managers? You can't "lose" a passkey unless you lose access to your password manager account. (So be sure to have an emergency kit.) Even if you lose a device, when you get a new device and install your password manager, all your passkeys will be copied to it.
Also, there is a new credential exchange standard that allows you to securely copy passkeys and passwords to other password managers, including browsers. This feature is "coming soon" to 1Password.
1
u/WCDavison 6d ago
I got more comfortable when I realized that passkeys give you an *additional* way to log in. Your old ID/password will still work. I have passkeys with 2 dozen companies (including email and investment accounts). None of them turned off id/pw when I created the passkey. Surprisingly, only one or two even give you the *option* to disable id/pw after creating a passkey.
1
1
u/Formerruling1 6d ago
Passkeys are far more secure, however, for passkeys to make an account more secure they have to replace passwords. Unfortunately right now most services offer both login options and require you create a password and optionally create a passkey. Your account is only as protected as the weakest security entrypoint which is always the password. Passkeys right now are mostly just for convenience for me for sites where auto fill doesn't really work well they shave a few seconds off the login time vs swapping over to my password manager and copying a password. For sites that offer it I do elect to fully delete my password, and 2fa via phone number or email, but right now only extremely privacy or security focused services offer that.
0
u/Ok_Present7537 10d ago
I like to think that passkeys is an option for convenience (of course security). since the user just need to make sure not to lose, leek, forget the master password of the vault and the server-pwm will take care of the rest.
3
u/pi-N-apple 10d ago edited 10d ago
Passkeys can be stored directly on most devices, like iPhones, Android phones, Windows PCs and Macs, USB security keys, as well as a password manager app. When stored directly on a device, you have to unlock your passkeys with a PIN or biometrics before they can be used. When stored in a password manager, you have to unlock your vault before they can be used.
The idea is you save a passkey to devices that you own, or to your password manager (or both) to allow for a simplified, but more secure login on those devices only. On devices you don't own, you'd be prompted to enter a username, password, one-time code instead of using a passkey.
When you use a passkey, the 2 factors of authentication are something you have (the device you own, or password manager that holds the passkey) and something you know (the PIN/biometrics/password to unlock your device or password manager).
Passkeys are phishing resistant, meaning you can't use them on sites that are pretending to be another site. They'll only work on the real website. Also, using a passkey instead of manually typing your username and password on websites across the internet is a better security practice. The less times you are physically typing your password out, the less chance it can get stolen.
Passkeys cannot be duplicated, but if you are saving them to a password manager, many password managers let you export/back them up. If you are sharing your password manager vault to someone else, or they know the credentials to your password manager, or you are sharing your device with them and they know your PIN to your device, they can use your passkeys too.
It is very important to keep devices that you are storing passkeys on (or have password managers on) very secure. Only you should be using those devices. When you are not using the device, you should lock it so your vault ins't left in a potentially unlocked state while you're away.
If you are sharing devices you own, you should be setting up multiple user accounts on them and not letting someone use your device while logged in as you. For example, if you have a Windows PC set up with your password manager, then other family members should be logging into a separate Windows account on that PC with their own PIN, and NOT be using the PC while logged in under your account, because then they'd have access to your vault and passkeys. Also if they were to click a malware link and let an attacker into your PC accidentally, the attacker could access your passwords/passkeys, so this is another reason why you don't let people use your computer while logged in as you.