Passkey is some sort of specific unique key to a device allowing to use a pin on a device instead of the password. But which won’t work on another device.
Now I don’t know if that key can be stolen or not, or if it’s really more secure or not, as people have really unsecure pins.
deleted by creator
The fact is that I fail to see something obviously wrong with outrageously long/complicated passwords managed by e.g. Bitwarden or the likes.
Long passwords can still be phished. Passkeys cannot. It’s a huge upgrade.
I don’t think so, but whatever.
What do you mean? Do you not believe the anti-phishing features will work as described for a reason?
deleted by creator
It would probably be better for you to explain what’s wrong and not just call them a boomer as if that explains it.
deleted by creator
“It’s old so it’s bad” is not a very convincing argument.
I think he was wondering how technically the new solution is better, especially compared to password database solutions where complex password and password reuse isn’t an issue.
Webauthn has domain bindings and single use challenges which prevents MITM credential stealing, etc
deleted by creator
You’re mentioning how it’s an old solution as if that was some sort of argument. If you’re not using it as an argument then it seems kinda pointless to bring it up.
I’m not sure if you even realize you’re doing it but you’re doing it again, implying that it’s better because it’s newer. That’s not a very solid argument.
I know you’ve mentioned some aspects but I’m still wondering, in your opinion, what would be the technical reason that the password database model with long and complicated passwords would be worse than the passkey setup. Or is it that they’re as good but passkey might be a lot simpler to some folk?
deleted by creator
It kinda sounds like you dont actually know whats wrong, and are just blindly following the trends.
Doesnt that make you the boomer?
deleted by creator
oh man. so I am a boomer. good to know.
Removed by mod
What do you see that’s wrong with it that we don’t if I may ask?
Mostly phishing. Passkeys can’t be phished. And really, passwords are awful in general for security purposes. You don’t have to use your phone or google or apple or whatever.
I actually have a physical usb key that I use as a passkey. Its just a more secure login implementation and will likely be the only option in the future.
Passkeys can be phished, it’s just much more difficult than with passwords, TOTP MFA, SMS MFA, other OTPs, or push notification-based MFA (e.g., Duo or the way Microsoft, Apple, and Google push a notification to their app and you confirm and/or enter the key).
Passkey is extremely phishing resistant in the same as Webauthn MFA and U2F MFA are, in that origin checks by the browser prevent attackers from initiating the auth process. But it can still be attacked in these ways:
From memory, passkeys, webauthn, and u2f should prevent over 99% of phishing attacks that are successful without them in place.
There’s also the risk of the passkey itself being compromised, though that level of risk is dependent on your device / how you’re storing your passkeys and isn’t a “phishing” risk.
The main point is all those attacks need to attack the local software or hardware implementation on one of the two ends (or a cert issuer), and even then it’s replay protected so for example an XSS attack lasts only for one session, so it’s more robust.
Correct, but that doesn’t change the fact that “Passkeys can’t be phished” is not true.