Log in to a website that supports passkeys, go to the account security page, press add passkey. Your browser looks for connected security keys to add the passkey to or if you have an extension installed, it might start your password manager. in the security key case; It asks for your pin and it's done. If you use a password manager to store it, it will ask you where to put it. Once done; you can repeat and add any number of passkeys to your security keys or database. You should do at least two, for redundancy.

I would not tie my passkey to windows/ios/android or whatever. I won't let a third party manage or sync them. Only on a security key I own or my password database.

Password is a shared secret: When you want me to prove myself, i repeat the password we both know. Both of us could loose that password and it happens every day. Can't go a day without a major data breach news.

passkeys use public-private keys. Anyone can posses the public key, so that is ok to leak. The private key you keep to yourself. When you ask me to prove myself, you hand me a challange which i manipulate with my private key and hand back to you. You check it with the public key and conclude that i am indeed the one that posseses the private key. Mathematical magic! The private key was never shared.

For the user, the password is replaced with a file stored somewhere. Either in your usb security key or in your password manager of choice. Stored in a security key (aka authenticator), the private key never leaves the
authenticator and all cryptographic operations are done inside it. The private key can't leak. Amazing! Passkes in a security key are called hardware bound, very secure and nice. The security key, you can plug out and take with you. There are built in hardware like this in phones and computers. But you can't take that with you. That sucks. They only authenticate that device. But you can make any number of passkes for all your devices.

The bad part is that some big corporatins would like to control where and how you can store the passkeys and preferably make it harder for you to escape them. The solution is to not use the services of these malicious corpos.

The main concern is that attested passkey requirement will now be the easiest way to force specific software and hardware upon user. The GraphenOS example is a good one.

Exactly, and it doesn't take any effort to come up with software that will make it impossible for most people to even consider doing things a different way than big tech wants them to. Download the wrong app, use the wrong OS, attempt in any way to reclaim your privacy, and all of a sudden you can't be authorized to open your own banking app because of some bullshit "security" message. What option does that leave you? Either become a hermit and reject all technology with whatever cost that has for you, especially in a decade or two as technology transitions to something completely mandatory for everyone, or fall in line and use everything the way they intend you to.

No, I mean the actual code. It's been decades since I've used BASIC but a password programd would look vaguely like this:

10 x=1234

20 Print "What is the password?"

30 If user input equals 1234 goto 60

40 Print "Incorrect"

50 Goto 20

60 Print "Correct"

The only area I could really see this taking off is with internal company stuff. Like forcing employees to use a very specific and weird way to do 2FA is already a thing in a lot of companies. They won't let you just use any old authenticator app. You need the "special" one that sucks ass. So maybe they'll do the same to passkeys, but for normal users I don't think they'd do that. Users are way too bad at doing things. It would cause too much of a tech support burden or just user bleed.

Your 1234 example is stored in plaintext, which is bad practice but still happens sometimes. Usually 1234 will be hashed (irreversible and functionally unique string) and the user input gets hashed with the same algorithm to check against the server's stored hash.

Passkeys are fundamentally different and work with public-private key pairs. It's not possible for your public key to be "stored incorrectly" because it's meant to be public. Your private key stays private and you never have to send it to the server to be checked against what they have stored. Instead, the server sends you a mathematical challenge that you solve with your private key. The resulting answer is also irreversible and functionally unique, but in such a way that the answer can be checked with the public key to make sure it was solved by the associated private key. It's really clever math that's worth watching or reading up on to understand.

I don't understand the maths well enough to give you a pseudocode example, but I always found trying to simplify it made it difficult to understand anyway. Every analogy ended up falling short because it was an analogy and not what was actually happening under the hood.

I wish I could give more than one upvote for the commitment to the bit on this.

Even if the password box accepts the full string, some sites truncate it in the backend. A good test for this is to try logging in with your full password except for the last character. If that works, keep deleting characters until you can't log in anymore, and then you'll know how many characters it really supports.

Hopefully nobody still does this, though with the rise of vibecoding, who knows…

Microsoft has been a major annoyance on me with passkeys. I don't like not knowing for sure that I can get back into an account if any of my devices get fucked (authenticators are nice and I do have some things setup but always worry if my phone is broken or lost out of nowhere). They (Microsoft) have such a dark pattern way of pushing passkeys. When I have to help someone get into their MS account at work (normal consumer PC stuff not IT/corp stuff) which is already hard since the people I try to help already don't tend to realize how important even simple things they don't think about WILL fuck them later. Some examples are stereotypical "boomers" that default to adding their land-line when an account asks for a phone number, or that they were even making an account (another dark pattern from Windows 8 where sooooo many people created @outlook.com accounts without really paying attention).

Obviously I experience a higher than average amount of tech illiterate folks (that also seem to just not care like shit is still the Windows 7 and earlier times). But Microsoft pushes dialog prompts/boxes for physical security keys and passkeys in a way that at first seems like the person has one of those setup. In some cases trying to sign into an account without a passkey/security key it will do what I expect. Give an extra option to not keep using a password or password+text/email code, or setup passkeys to "not have to worry about remembering passwords". Though I still think they don't really clearly explain how crucially important it is to make sure the person's information for the account is correct and making damn sure to know recovery options if anything happens.

But I started seeing just a box pop-up that looks like a system prompt that only gives two options. Enter your PIN/insert security key, or to use the authenticator app. No obvious option for picking that neither are setup. The only way for not using those is to click the X on the top-right of the prompt. In some cases I have seen people click on the options and it just acts like they are setup. Pick the authenticator option and it asks for the code on an app/device that doesn't exist. In the cases that it does start the process of setting up passkeys, I still feel like they are trying to trick people into it rather than the users choosing to do it.

Again I deal with more than average "I'm not a 'techy'!" kinds of people along with older folks. But it really does seem like any level of tech literacy keeps getting worse based on running into more and more people of all ages. Which is what freaks me out about how these things are suddenly seemingly pushed on folks at the worst moments. A lot of people first trying to setup their new device just want to get into it as fast as possible, and really don't understand how they can just lose access to so many things they didn't realize are now tied together. Let alone be aware that they should export those things to something that isn't tied to the OS in the event they for some reason want to get something else (PC to Mac/Mac to PC/Android to iOS/iOS to Android/etc).

Limiting password length is a red flag they are storing your password in plaintext. I'd be wary of using any service like that

I had to work with keepass and the Firefox fork I'm using to have them speak together correctly. From memory it had to do with an incorrect directory / socket being used.

This is the feature that means you no longer get to make the calls about your passkeys. Fortunately, attested passkeys are not yet required on most websites. But the FIDO Alliance standard makes attestation a part of the passkey ecosystem, whether you want it or not. And even if the website doesn’t require attestation now, simply by using passkeys you indicate to the website that your setup supports the FIDO Alliance’s passkey standard and that you as a user are capable of using passkeys.9 This means that once Twitter (formally X) is satisfied that the overwhelming majority of its users would be unaffected, they can flip the switch – perhaps not all at once, perhaps just for ten thousand users at a time so as not to cause a fuss – and start rejecting non-attested passkeys.

Critically, remote attestation requires the co-operation of your cryptoprocessor, your passkey manager software, your device’s operating system, and your device’s firmware to all pass the remote attestation check. After all, your phone’s operating system has total access to all the 0s and 1s in every app that’s ever run, so it’s not enough for Twitter (formally X) to trust your passkey manager if it can’t even trust your phone’s underlying operating system. If any single one of those things were to fail – say, because your phone stopped receiving security updates so you installed a custom operating system like LineageOS to keep yourself safe without having to buy a new device – then Twitter (formally X) will be able to notice and prevent you from logging in.

Remote attestation can allow them to verify that your device is not capable of, say, sending and receiving encrypted messages, or running a competitor’s app, or using social media without verifying your ID. They don’t want you to be able to turn off the mandatory built-in AI image scanner on your phone that scans everything your phone sees for nudity. (Yes, I’m serious.)

The convenience of using passkeys is a double-edged sword.

This is also one of the ways Playstation stops you from installing Linux and other unauthorised software on the PS5.

It's wild seeing people spaz out over passkeys, clearly venting at something that isn't passkeys.

Ooohh, don’t think corpos and banks won’t go for that hypothetical. A lot of apps already turn haywire if you have developer options enabled, accessibility options enabled, have a specific installed or using a custom ROM. If the optional attestation is enforced by your bank that they only accept passkeys from google’s password manager or apple passwords, then using something like Keepass or Bitwarden isn’t an option.

Look… I love passkeys. They are convenient and more secure. But if a service cares about on what device and software it was created then it is pointless and just an ecosystem lockdown mechanism.

Consumers are pent up and lashing out at passkeys. It's wild. Like, you all still want to use the dictatorial software that is YouTube, Google and Microsoft, but passkeys are the hill to die on? lmao "No! How dare you provide cryptographic security!"

This is already the reality without passkeys. The correct response is to bank with a bank that isn't enabling Google's monopoly. Pretend passkeys don't exist--nothing's changed. You still can't use your bank's app without a Google Account if your bank is an enabler of Google's monopoly. So... again, myopic dimwits are getting angry at something, but don't know what. They've latched onto passkeys though. Amusing.

Nice explanation!

Can you elaborate on this part?

some big corporatins would like to control where and how you can store the passkeys

Yeah I'm confused. I also don't remember ever using a site tha would force use of passkeys. I always have standard TOTP alongside those.

problem that has better, simpler, and easier to understand solutions.

Can you give an example?

I suspected as much, being shoved on us like AI.

You think an everyday user will think this way?

I didn't even know what they were until now. And still don't. Every explanation sounds like a long convoluted MLM pitch. They smell fishy as hell. They may need more grameters to prevent side fumbling.

Oops, I lost my device or bricked it, now what? Login with passsword? Password reset?

That's how they work, regardless of how users think. Though you're correct: the majority of computer users don't understand what they're doing and do feel threatened by change, even if that change is positive by any measure other than "I feel uneasy about changing something I have no grasp on".

it’s absolutely possible to reduce the number of tries to hits to a manageable level for a distributed botnet that can’t easily be blocked.

This is very hard for me to imagine. Even if the people running the website are incredibly incompetent, they would have to be intentionally moronic about passkey generation for what you are envisioning to be realistic.
You are right that passkeys enable brute forcing on a scale regular passwords don't, but it doesn't matter, because normal passkeys are just too long for this to be a worry.

I'll summarize the disagreement between the two of you in one sentence: what's good for locked down highly secure enterprise is not good for public access services.

It's understandable your factory has cops. We don't want to have cops at home.

Please just stop using a service when it gets unbearable. There is no online service you -need- except maybe bank and tax stuff.

Personal anecdote to illustrate: the last time I tried creating and using passkeys for my Google account, I got the impression they (Google) would only accept keys coming from either Google Authenticator (their 2fa smartphone app) or something like macos's built-in keychain. No way to give them a key generated using a local, offline service that I could store however I want - it needed to be accessible using, basically, a big corpo['s software] as the intermediary. This coming from how their website would request the keys from my browser (which means mozilla seem to be in on it as well :/).

Given that I currently use a pure file-based password manager that I can move around and switch the keys for as I please, the current state of passkeys feels like a step back in terms of allowing me to control my digital identities.

Here’s what I don’t get. When I posted this, you were posting every 10 minutes at most defending passkeys. How do you have so much energy and time to defend them so vehemently? Are you heavily invested in a passkey business? Are you an LLM that’s been instructed to defend LLMs at all costs?

I’m not sure the latter is possible since you wrote a large paragraph starting with “it’s easy to say passwords are sufficient” when that has absolutely nothing to do with my opinion on passwords. I suspect an LLM would’ve stuck a little closer to my own words.

No, I'm just a professional software engineer that has been in security and privacy for the last ~9 years (unrelated to passkeys). But I am also head of security for my company and rolled out updated hardware keys in the last year, so am somewhat more familiar with the topic as of recent.

I also generally enjoy discussing privacy topics. Even more so when I feel the community's understanding is off /shrug. Was chilling on my phone while the kids were crashed this afternoon.

dude speaks about not being able to write down his passkey, then he acts like it can only be saved in bigtech clouds, then some random ai rumbling starts about ads being show to us? can you guys stop posting these god damn fearmongering password articles written by ai?

Password reset, and your mail account used for that is secured by a passkey 😬

Please send a blood sample to Google Gemini to confirm your identity.

I am using Bitwarden client with self-hosted vaultwarden and answers to all of those are: my server, yes, yes, if I lose all my devices and the server at the same time I lose access to my passkeys, and all my passwords for that matter. If I have my server, or at least one of my other devices, they are all on my device.

And would you look at that suddenly we have TOTP that I can’t write myself and I’m forced to use some shitty app.

I think our definition of what TOTP is, differs. When I say TOTP, I mean TOTP as defined as a standard in RFC 6238.

The behaviour you're describing with duo is something else, something proprietary. In my mind, duo would be an One Time Password (OTP).

sidenote: TOTP is a specific/narrow implementation of the larger umbrella OTP.

It’s about open standard compliance.

Maybe I'm getting hung-up on semantics, but attestation is an open standard, like gpg is. With gpg you can implement your own encryption/decryption according to the gpg specification and your encrypted data will still be safe because you're trusting the math behind the Asymmetrical Encryption.

Attestation is identical, but at the hardware level. The public/private keys are created by the hardware manufacturer. The private key is (often) isolated and stored in the CPU (or in a dedicated chip). The public key is freely published, so OS/application vendors know how to validate that an attestation response wasn't faked. The private key is not exposed and even if it were, the public key could be revoked by the OS/application.

Attestation is great for device level security, but makes it nearly impossible to create backups/clones. :(

Attestation means that whatever code runs on your authenticator has been submitted to the FIDO Alliance (google and buddies) and they signed off on it. After that it can't be changed.

Security keys like the Solokey Hacker (the superior version), is not signed and never will be, cause I can tinker with it in any way I wish. It's truly mine.

Like the article highlights, attestation is part of the standard. The remote service can ask for cryptographic proof that your authenticator, where you stored your passkey, is attested. I have not seen any service doing that so far. IT managers are doing that internally, for their employees for sure. They don't trust bobs homemade solution, only their chosen vendors. From that standpoint it's reasonable.

This gives the service the power to deny you freedom of choice of where to store your passkey. They might say only yubikeys allowed or only microsoft hello or only IOS secure enclave or whatever they wish. It might become a scenario where they don't allow any passkey solution that can run outside their platform. Running LineagOS or Linux? Google and microsoft will say it's "not secure enough".

They will abuse that power to make your decision for you and lock you in. "Password manager not allowed, Use our cloud insted".

Ideally it's not part of the standard and they don't get the option of knowing anything about your authenticator. It's none of their bussines how i choose to store my secrets.

Any sane service will just not ask about the attestation. They don't have to ask. I would not ask my users on my webpage. You can store your passkeys on printed paper for all i care. Although, storing them on a usb/nfc key is pretty damn secure and cool!

Imagine if a romantic partner said "I will send you a unique string, probably exactly 8 characters" to verify that I am your partner. You would laugh and remind them it takes less than a second to generate every 8 character combination possible.

Instead, your SO makes a key and keeps it with them at all times, and you promise to talk to them using a machine that makes secret messages only their key can decipher. For fun, they give you a key and make a machine too... Explaining this shit is complicated I'm sorry for what you're about to read.

They send "heyy",
You send "whatup",
They send "send pics",
You take one, encrypt and send the pic,
They say "huh? Wtf?",
You remind them about the secret key,
They have no idea what you're talking about -fail
OR
they send something in return back (which you decrypt) -success

That's basically the same thing as authentication with a passkey oversimplified and only slightly wrong but good enough. There's shitloads of devices that do it, yubikeys, authenticator apps, but they're all doing that.

It's something you pass around--like a word, but a key instead. If you're familiar with passwords--instead of a word--imagine a key: a passkey. That's what passkeys are. The issue with passkeys is--as you pass them around they begin to open more and more stuff; everyone is opening stuff with your key as it's passed. So they need to be sanitized every now and then. Deposit them into a furnace and buy a new passkey. Every two to three days. If you have more questions please feel free to ask!

sorry, not OP but I'm not following your logic.

Are you assuming everyone's using a Google wallet or something (what's tying one's bank to Google?).

Fuck that - that's why we have credit cards...

No, I'm not assuming people are using a Google wallet.

Most businesses only release an android package via Google's PlayStore. ("Download our app via PlayStore.")There's no reason a bank couldn't host their .apks on their website (if you're unfamiliar with the .apk extension imagine it's a .exe: you click on it and a program runs; an .apk is to Android what an .exe is to Windows). To download packages from Google's PlayStore requires a Google account. Google demands a few things from these two parties: publishers need to pay Google a fee to have their .apk hosted by Google and users need to run Google's spyware in order to access those .apks hosted by Google.

It's often stated that if you want digital-freedom/privacy use GrapheneOS (if you have a compatible Android-device) or use a linux mobile-phone. To which most users respond: but my bank app doesn't work on those platforms, therefore I won't use either GrapheneOS or a linux-phone.

The bank app won't work, because Google's spyware is not included in GrapheneOS (a point of GrapheneOS is to avoid such spyware). Because GrapheneOS (or linux) doesn't include Google's spyware Google will do its best to block such devices from accessing Google's PlayStore. Such computers are violating Google's demands: if you want access to the PlayStore you have to run Google's spyware.

Even if you were to get the appropriate .apk by avoiding Google directly (perhaps a friend who got it from Google then passed it to you) the bank's .apk would fail to run on a device free of Google's spyware, because you're not capitulating to Google's demand: you didn't get it from Google's PlayStore and the 'app' knows that by the lack of Google spyware. (Google's spyware and the bank 'app' talk to each other. If the app can't talk to Google's spyware it will halt.)

Therefore if a bank only has an 'app' to interact with that bank is saying: you have to download it via Google's PlayStore--which necessitates a Google account and running Google's spyware. Therefore if you want to use banking 'apps' you need to enable Google's monopolistic, spyware practices (you have to enable the corporations to practice surveillance-capitalism). Google defends this practice often with security-theater ("Google says it must be done this way for security.") when in reality it's about entrenching a market monopoly.

This is absolutely removed and I do deride users who say they want computing-liberty and -privacy, because there are banks who still have usable websites. You don't have to bank via an app. If you do bank via an app you do so with full acknowledgment that:
a) you're rewarding anti-competitive behavior;
b) you're entrenching Google's monopoly over Android;
c) you don't actually want computing-liberty or -privacy.

It's piss easy to change banks. It's impossible to stop Google. If you want privacy you have to ditch Google, which means banking with a bank that allows you to bank via a desktop-computer (via a website) or in-person through bank-branches. If the only way to bank with your chosen bank is via an app that then means the only way to bank with your chosen bank is by enshrining Google's monopoly into your life.

Passkeys are a completely separate thing. They're an increase in security for all users. Users are frustrated by 'big tech's' increasingly monopolistic practices and instead of doing anything practical (like not running those particular pieces of software) they've latched on to decrying passkeys, which the majority of the commentators are actually clueless about. They're just seeing those 'big tech' companies forcing yet another change onto them. They're lashing out against their lack of power. They're lashing out against their subjugation by 'big tech'. That they're being forced to use "passkeys" when they don't even know what a passkey is.

Passkeys are an open standard. They're not entrenching anyone's monopoly. Increased security is desirable by all parties (corporations, governments and individuals). Passkeys enable that. You're not locked into Google's Android, or Microsoft or Apple. People are under the assumption they are however.

I could host my own website using passkeys as the method for authentication. No big-corp involved. Offline. Spooky. Big-passkey is coming for you.

That probably left you with more questions than answers...

As far as I know using a password manager such as KeePassXC or Bitwarden solves all of these problems?

An attempt to make an image describing where passkeys live:

Regardless of if a regular user will think this way or not, it is good to have options, precisely for providing them as an option to a regular user, even if they end up not implementing them. The other option is NOT having the option. Which one do you think is more beneficial across the board?

Very cool, I didn't know about Solokey.

Thanks for mentioning it.

Make that question mark a period, good sir/ma'am!

The way i understand it is that remote attestation (main point of this article) makes it possible for services to deny unapproved software. They can deny off market devices, operating systems, or certain password managers. So even if you use password managers you mentioned, if you're using off market OS (e.x lineageos) they can deny access. Here's a quote from the article "Remote attestation lets a website demand cryptographic proof that your device, operating system, firmware, and passkey manager are all on an approved list."

So it’s HDMI for login? Thanks, I hate it.

That seems to miss the main point of the article, which is that Passkey standard has attestation procedure built in. A site that uses Passkey can verify the flags you set and deny your access if you use unapproved device, operating system, old kind of secure chip or, say, allow your passkey to be shared between devices.

Passkeys give me anxiety because it's like "Hope you can go the rest of your life without a phone or USB drive getting lost or stolen LMAO"

And for the bank, you can always switch to a better bank.

Hm, so similar to websites blocking user agents now.