- Big Tech has implemented passkeys in a way that locks users into their platforms rather than providing universal security
- Passkeys were developed to replace passwords for better account security, but their rollout by Apple and Google has limited their potential
- Proton Pass offers passkeys that are universal, easy to use, and available to everyone for improved online security and privacy.
The way Apple or companies like Paypal implement two-factor authentication, let alone passkeys, drive me up the wall. This all could have been so much better.
I’m not even going to mention all the platforms that rolled out passkey creation support, but not passkey login support, for whichever damn reason
Yeah, Apple 2FA is infuriating, especially since you can do all factors from the same device. Kind of defeats the purpose of traditional 2FA/MFA. Also, companies that decide you 2FA experience has to use their app, instead of a standards-compliant TOTP app of your choosing…ugh.
Traditional 2FA (assuming you mean apps with codes) can be done from the same device (if you have the app with the codes installed on that device).
It doesn’t defeat the purpose of 2FA. The 2 factors are 1. The password and 2. You are in possession of a device with the 2FA codes. The website doesn’t know about the device until you enter the code.
Yeah my point is it does not protect the local device well. It does protect well from remote compromise though.
If you think forcing everyone to carry an object other than their phone around so they can use 2factor on their phone is a good idea… Or if you said I need to go to my laptop when I’m logging in on my phone and vise versa… that’s nonsense too. Sure maybe some companies require this. But that’s different.
Authy on my phone is just as “dumb” as Keychain on my phone.
How else are you imagining this should work? Keep in mind normal people need to do it too.
For Apple, it’s your iCloud account that everything depends on, and it’s the weakest point. Not by itself maybe, but in practice there needs to be a way to reset your iCloud password, even without your phone. Currently I believe that’s just an Apple representative asking life questions, but that information is mostly publicly available. There needs to be a better way.
A physical 2fa device may be just what we need to securely rest our iCloud passwords, keeping everything else more secure
That’s a fair point. iCloud Keychain is a single point of failure.
If I’m on my laptop, and the 2fa code shows on that same laptop, it defeats the purpose of it. The point is sortation of security privileges, ask this just adds more work while providing no less security to the device. It does protect you from remote compromise, though.
It doesn’t defeat the purpose of it, as you indicate, it can protect from remote attacks.
Also most or all of these should require some for of local authentication.
For example I have 2fa apps on my phone, where I need to use them, so yes, that’s less than ideal. However
- it protects against remote attacks
- it protects against SIM attacks
- and even if someone stole my phone and unlocked it, they’d still need my face id for every use
The factors are:
- Something you have
- Something you are
- Something you know
Here the password is something you know and the device is something you have (typically also protected by something you are, like your fingerprint or face)
Someone with your phone but no password or fingerprint is SOL. Someone with your password but not your phone also SOL
PayPal for sure, because at one point they actually removed the ability to use a hardware mfa token.
A little known fact about iCloud is that you can use hardware MFA tokens. I think this feature was just recently released though. They force you to enroll at least two tokens too, which is a nice safety. I set this up about a month ago and it’s been great.
When vaultwarden supports this I’ll play ball. If I don’t have control over my authentication methods, then they aren’t my authentication methods.
Bitwarden does, not sure about the self-hosted version.
Still waiting for the mobile app. Maybe the firefox addon would work, but would prefer the app
I noticed that recently every post on Proton’s blog has been an advertisement of their services.
They are hypocrites.
A few days ago they posted that corporations are bad because they collect fingerprints, profile users, etc., yet they are no better, as their mobile apps rely on Firebase Cloud Messaging (FCM) owned by Google to deliver notifications to their users.
In 2020 they wrote that they “may offer alternative push notification system”, but apparently shitting on corporations is easier than making actual changes. Four years ago.
If I can’t add your passkey to my Bitwarden vault, I’m not using your passkey.
deleted by creator
Bitwarden proper wants $40/year to have two users sharing passwords. You might try Vaultwarden?
That doesn’t seem unreasonable at all for not having to host your own server.
That’s with hosting your own server. Unfortunately I only discovered this paywall after sending them $10 out of good will.
Of course it’s open source, so it’s certainly possible to break their DRM, and if it were something less sensitive I would.
I still might, but VaultWarden looks like a better alternative.
Nowhere on their pricing page does it say you need to host your own server.
Proton Pass offers passkeys that are universal, easy to use, and available to everyone for improved online security and privacy.
I wonder if there could be any bias in Proton claiming their product is the best
I’d trust them miles before Google or Apple. Hell, they dropped the prices on some of their products when they found ways to provide them cheaper. Proton is a good company.
That doesn’t mean they will be around forever. Economic realities care little about whether a company is good or not.
True, but this is valid for every company.
Let’s say that since the company is Swiss based and, AFAIK, not quoted maybe they are not driven by the “the next quarter is all that matters” mentality of many quoted (US) companies.
There is a smaller chance that they will do something stupid to monetize more just to be ok next quarter (while risking to lose everything the next one) and will be there as long as they provide a value to the customer for the paid price.
Do you typically just take people’s word for their claims or do you do cursory research?
Could someone ELI5 (if possible) what passkeys actually are?
Basically hardware keys (like YubiKey) without hardware
So…. Software keys…
deleted by creator
a.k.a password-protected certificates
From my understanding it’s the concept of trust. Basic passwords are complete trust that both ends are who they say they are, on a device that is trusted, and passing the password over the wire is sufficient and nobody else tries to violate that trust. Different types of techniques over time have been designed to reduce that level of trust and at a fundamental level, passkeys are zero trust. This means you don’t even trust your own device (except during the initial setup) and the passkey you use can only be used on that particular device, by a particular user, with a particular provider, for a particular service, on their particular hardware…etc. If at any point trust is broken, authentication fails.
Remember, this is ELI5, the whole thing is more complex. It’s all about trust. HOW this is done and what to do when it fails is way beyond EIL5. Again, this is from my own understanding, and the analogy of hardware passwords isn’t too far off.
Not surprised,
Google too nowadays.
There’s a reason why they removed their company motto “Don’t be Evil”
I thought they just removed the first word.
I am not using passkeys until it’s possible to easily migrate them between providers (not just devices / browsers). If I used Proton Pass, and then later decided to use another password manager, could I export my passkey data?
Proton Pass allow you to export your passwords in various formats (both plain and encrypted). That you are able to import somewhere else is not something Proton Pass can guarantee but you have your data.
Lock downs are pretty much a hard pass for me. Anything I buy, I research, and if there’s even the slightest hint of BS incompatibility, it’s simply a no go.
Not commenting on the merits of the blogpost’s arguments, but Proton is selling their own product here too
Proton enabled passkeys in their free tier. So ultimately, yes by using their free tier and being safe in the thought that you can always leave if you want, that might drive you to pay for a paid plan.
But companies trying to earn your business by offering you a good honest product is not at all the same as a company using anti-consumer practices to keep you from leaving lol.
And if you believe in our mission and want to help us build a better internet where privacy is the default, you can sign up for a paid plan to get access to even more premium features.
Translation: don’t give those other guys money, give us your money!
Well no, their call to action isn’t to not give anyone else money. They didn’t have anything negative to say about their competition like 1Password. They’re just warning you about the shady things Google and Apple are doing specifically. And as an alternative they’re offering their own solution instead, which also doesn’t cost any money.
The horrors of giving money to a company that actually cares instead.
deleted by creator
As someone who is not familiar with photon, I love to see a vendor presenting a feature with a technical discussion, even if they’re also selling it. As far as I can tell, no one was hiding intent, no one was directly selling, so “well done”. Or maybe I just agree with the premise, I dunno
Is this an ad?
It’s a PSA with an ad at the end.
That was my observation as well. If it walks like a duck and it quacks like a duck…
Yeah I’ve avoided passkeys. Anything that Google is pushing to me is always in their interests.
People not getting phished is in their interests. That doesn’t mean it’s not in yours.
People getting their accounts compromised leads to spam email, spam comments, fake crypto livestreams, etc that impact others. Google definitely has an interest in preventing people from getting their accounts compromised and not just for the benefit of the individuals with the accounts but their platforms as a whole.
Google pushed email accounts to you, do you not have an email address either?
I’m not locked into Gmail: I know it implements standards and I choose it as long as it is most convenient.
A lot of what comes into my gmail account is actually addressed to various aliases from various providers, and I can point those aliases anywhere
In particular, all my recent online accounts use unique generated email addresses that I can disable at will, and that forward to my actual email
Well that’s great news, then you’ll like passkeys because you can use them without being locked into anything.
A lot of my hesitation is that not only are passkeys being pushed by the big vendors AND they seem to have a less than portable implementation BUT ALSO they don’t seem to give enough details. Everything is dumbed down for the less technical until it means nothing
I like that this thread already has more actual information than all the outreach of the big vendors over months
Any example of websites where I can try passkeys? I have both bitwarden and Proton pass to test out
I personally like the demo at https://www.passkeys.io/.
deleted by creator
told ya so, i got downvoted for being skeptical of this shit.
if google or similar is pushing it, is should NOT be trusted! lets NOT, please!
You still deserve those downvotes. There’s nothing to not trust about passkeys.
theres google, give me an alternative not exclusively controlled by oligarchs and i will consider it.
Not sure what Google has to do with passkeys besides the fact that they’ve implemented them. Google implemented passwords too but I’m guessing you’re fine with those?
Passkeys are not exclusively controlled by oligarchs so I guess by your own admission you should consider them.
i will, when i see these claims of openness estabilished and working in practice.
Well you’re in luck, they’re currently established and working in practice.
