You could store them in your password safe if it supports them?

I’m gonna need to find this comment in ten years. Wish me luck

Passkeys are awesome. Developers not following the standard properly are a trap.

Meanwhile, half of the people at every company I've ever worked at:

I think the worry is that if passkey attestation is required it will force people into a narrow set of authenticators controlled by the big orgs.

At this point in time it's not a problem, but how can we know it won't be in future?

This is what people seem to be missing, I haven't seen a rebuttal to this problem.

The web api for fido2/passkeys exposes attestation information.

Warning: Attestation provides a way for a relying party to determine the provenance of an authenticator. Relying parties should not attempt to maintain allowlists of authenticators.

from https://developer.mozilla.org/en-US/docs/Web/API/Web_Authentication_API

Potentially the server can request hardware/software attestation that would limit the choice of password safe to approved ones only. We don't yet know how big/likely this could be, but in theory it's possible.

This is, imo, the bigger issue. No clean way to export and move passkeys around, even between the open source options like Bitwarden and Proton Pass or as plain backups...

Please provide a blood sample to verify your Age. Thank you for using Open FaceGoogazonthropic, we love you.

And also until the committee designing it has it members on it representing the interests of users. The point that this was lacking in the original is-a-trap article is an important one and is also being missed.

It's a very basic principle, that you don't create powers that could be abused. That they haven't been abused yet does not make doing so ok. It like saying it's ok that my government was given the power to lock people up with no reason or due process because they haven't used it yet.

Because of this discussion (and because I hadn't looked at passkeys for quite a while), I did some testing...

And passkeys integrate seamlessly into my keepassXC to get backed up with all my regular passwords. So software- instead of device-based passkeys that can be properly transfered, synced or backed up work...

The problem is that tech-minded people that use password managers and think about security and backups are not the primary target group that passkeys should protect from every-day phishing attempts in the first place. And when it's supposed to protect the common user effectively and conveniently/frictionless but then instantly destroys the effect by advising to set up another login method it makes no sense.

The worst part of the left one is the implication they have only two passwords. The "under the keyboard" part at least requires physical access and (hopefully) means its not something stupid or short like "p@ssw0rd".

I have yet to see a sticky note password that was anywhere near NIST compliant lol.

I'm just not convinced that mandatory hardware attestation is actually a real problem we need to worry about.

Like, yes, people with high security jobs will have that for sure. And they should.

But large companies that want customers? They want to make it as easy as possible for their customers to connect. They're not going to force people to have a hardware device which if damaged or lost will lose them a customer. That's just not what they want.

NIST compliance is 15 characters. That's it. No stupid cycling every three months. No stupid special characters.

Somebody finally read the XKCD comic.

my workplace makes us change passwords every 3 months and I don't respect them so its the same password with the same number at the end -1 because I can't be bothered. If I get hacked oh no ive dealt damage to a multi billion dollar corporation woe.

Woah now what about changing 1 to !

Last time I was in Thailand and my buddy told me don't worry, she's not a trap.

Usekeys are a pass. Trap them!

I have a nice notepad from a conference on my desk labelled “Passwords”

well, if I've seen a vendor lockin before, and I've seen a couple, they'll push them with open standards until they're accepted and normalized.

Then suddenly the big players like Google and Microsoft will block all the open platforms sighting "security" forcing businesses to adopt closed proprietary versions while touting their free and easy too use platforms.

then the monitize it.

I have a system of using month and year plus a common trailing string. My annoyance is that every year the last number on the year keeps moving.

If the computer is in even a marginally secure place, storing passwords on physical paper is better than what a lot of people do.

Of all the proverbial bullets I've been hit with, none had my name on them; they were all addressed "To whom it may concern". The times my identity has been stolen or my accounts compromised it was because somebody attacked some fairly large entity, like Alphabet or Equifax or Microsoft or Visa. Nobody's going to walk into my house looking for my passwords. They might walk into my house looking for my television, but that hasn't happened to this house longer than I've been alive.

But they already do enforce a "security level" for passwords through minimum character counts (e.g. must be at least 8 characters long), specific character requirements (e.g. at least one upper case + lower case + number), rotation schedules (e.g. must be changed every 90 days), etc. Some even enforce password sharing (e.g. Netflix IP/geolocation checks).

Yeah and certain password requirements are also dumb. But at least they still give me a degree of freedom how to generate the password and how I store the password.

Second factor is sometimes worse than Passkeys; with vendor specific apps (Steam Guard, Blizzard Authenticator, Microsoft Authenticator, etc) instead of following standard TOTP. But still. I want agency over my credentials.

Mozilla's warning is funny. "Don't use this to reject attestations from unapproved authenticators!" That's, like, almost the entire purpose to attestation. It tells you an Apple device or a YubiKey or whatever created the credential. What else could you use this information for other than to make life harder for users using certain authenticators?

Maybe I should have clarified, you can't export from Bitwarden into KeePassXC or vice versa. Imagine you have 100 passkeys and you want to switch your passkeys manager. Unless something has changed drastically in the last few months, this was impossible

Holy $#!7111

Alt joke:

Thanks for the tip! My password is now....

hunter2 I feel more secure already. :D

I wonder why passphrases fell out of style? If you remembered a series of random words like you were activating the freaking Winter Soldier, boom, 40+ characters!

And yet, it's there.

Embrace, extend, extinguish as in literally every single corporate case. Thousands of rug pulls later and we still haven't learned our lesson.

In this case: first get people in the door en masse, then expand the requirements for things like hardware attestation in a transition period, then vendor lock people.

Adobe would never move to cloud only, that would lose them customers.

See: Literally every single API rug pull ever. Reddit, Unity, etc... Get people using the API and infrastructure, then switch from free to huge fees.

See: cloud companies giving good deals for storage and then charging massive fees for output bandwidth to access or move that data

See: VMware rug pull

This is the exact same except they are telling us what they are going to do from the start. When someone tells you how shitty they are, listen.

I would say the people hate it, because they are exposed to the tooling and not the standard.

The standard might be the best there is, if the tooling is shit people won't use it. And once you've been exposed to bad tools you make the connection between tools bad = passkey bad because they don't know there's a difference...

The trap is they're pushing passkeys before password managers that make them portable are yet to be mainstream. And that platform lock in may be a motive driving it.

"To login to your account, please use the device assigned to your identity."

Right now, if someone who doesn't know about password managers starts using passkeys because of a few popups you just have to follow through to enroll, they're going to get very confused when they try to login somewhere else. There may be alternative login methods for now, but that may change.

It doesn't seem all that forced yet, but if we have any idea of how big tech works, that's where it is going.

Passkeys are great, Big tech aren't.

I use them with my password manager but I'm cautious on which services and how often i may need to login to them on other devices.

Not every service allow for registering more than one passkey

And what are they odds of simultaneous losing / breakdown of all three keys? I think they are not negligible.

Yep, there's a reason 2FA recovery keys are usually printed and stored safely.

With that said, one way to avoid someone compromising service A due to somebody breaking into service B is to have different passwords everywhere, so a Password Manager is more convenient anyway.

Oct0ber2026!

they can already force your to install their app to receive a push notification (cough.. google...cough...). if they really want to lock you in they will. passkey or not.

If we take the EFF wordlist commonly used to generate passphrases, we have 7776 words. If we take ASCII alphanumerics and special characters we have about 92. Assuming we generate a NIST compliant password of 15 characters in length we get 92^15=2.8*10^29 of combinations. To get the same level of security (same number of combinations) using the EFF wordlist we need (log(2.8)+29)/log(7776)=29.45/3.9=7.6 around 8 words. If we assume the words are 7 characters long on average, plus the separators, we get 7*8+6=62 characters long. If we start to also include Unicode characters like other scripts or emojis (something I've recommended to others) the required number of words grows even more. I don't know about you, but I can't be bothered to type that all out every time, a password manager works for me.

yup, and Netflix will use passkey attestation to make sure you can't share logins with other users

The “under the keyboard” part at least requires physical access

That's fine at home. Not so great in an office, though

Did they ever get into style? I use them, but I don't know anyone else who does. And some sites make diceware passphrases harder to use by e.g. requiring you to add numbers, special characters or capital letters, or by banning spaces. Or by banning non-ASCII, which makes it harder to use diceware passphrases in other languagess than English.

I’ve honestly not seen any benefits over passwords.

If I want to check my mail on a library computer, I can type in a password and I’m in. If it’s using passkeys I need an already logged-in smartphone - which I probably don’t have if I need that library computer in the first place. That’s just one example.

Are you sure about that?

When I open up the import function in KeePassXC I can pick 1Password(.opvaul), Bitwarden(.json), Proton Pass(.json) and a couple of other file formats.

PS: Oh, wait. That only works for the passwords while passkeys simply get ignored? Okay, that's dumb.

It seems to me that the definition of attestation in the passkeys standard is the exact same as HTTPS certificates, which is not bad at all and nearly impossible to rug pull?

I will take a stanza from a song, use the first letter from each word, switch the S to 5 or $ as an example, and make sure I have two uppercase, two lower, two numbers. and two special characters, 8 minimum, although now it runs about 13.

I hum as I type in my password. All I have to remember is how I typed it out.

Come at me, dictionary cracks. The result is bonkers as fuck, but I loved that stanza. I have passwords I have used for 20+ years.

My coworker who sits next to me recently commented to me that I always hum the same tune when I log into my computer. Then he mentioned I hum a different tune when I log into the proxmox.

My sticky note would be like:

computer - Local H

proxmox - Sonic Youth

mail server - Future of the Left

NAS - Faith No More

Inventory - Slothrust

etc.

Them pass a use, keys are!

Memorizing passwords doesn't scale well.

You've likely got dozens of accounts. You're not going to memorize a password for every account. Re-using passwords is a serious security problem though. Poorly secured sites get their password databases leaked all the time. If you use the same password on lots of sites, it's basically a sure thing that the hashes are out there on the darkweb already along with your email, and your password is compromised.

Also, typing your email password into an unsecured library computer is a terrible idea. It is ridiculously easy for someone to install a keylogger and gather emails and passwords. In the past, your main protection was that it wasn't worth anyone's time to break into the computers, install keyloggers, collect lists of passwords, then figure out how to use them to get money. But with LLMs that can all be automated. It has become ridiculously cheap, and can be done by someone with a bot farm in Russia.

A password manager largely fixes the first problem, but at that point you need a device with your password manager with you to log in anyway. And the password manager doesn't fix the second problem at all.

I agree, but if I had to choose between someone reusing passwords and someone who kept them under the keyboard I'd probably choose the latter

I like you 🤣