Fixes what? By ‘less trusted device’, do you mean to say leaking your password? Adding more factors makes it less likely an attacker gets all your factors, yes. Totp is also a shared secret credential. You can combine it with a password or a passkey if you want. Just don’t store them together, or you loose them both at the same time.

Passkeys use public-private cryptography and password use shared secret. So regardless if the key is stored in a password manager, the passkey is still more secure. It would be impervious if stored in a security key. But it is still more secure than a password, even when handeled the same way.

Passkeys are not perfectly implemented on every service and not exactly widely available. I use passkeys on a handful of places. Where they work, they are nice. I want my accounts passwordless and no multi-hassle-authentication any more.

He just kind of drags a folder or file to the window, which may have a list of many folders and stares blankly, like a cat, then drops the file somewhere there. He has been instructed to drop it on the background surface if he want it in that folder and on a folder if he wants it in there. Doesn’t matter he forgets and just does.

When I force him to use right, click-copy/move or ctrl+c/v, he is forced to think about what and to where.

I think he doesn’t want to think. Mental bump to overcome that he avoids. Exactly what old people should not do. He needs to be forced to use that brain.

Passkeys have inherent advantages over passwords. They are more secure.

1. Public-private cryptography vs shared secret
2. They can be stored in an authenticator that can never leak your private key.
3. You can have many passkeys for the same account and they are all unique and can be revoked individually.
4. Can be put in a password manager. (less secure, but still better than password. see point 1)

The standard requiring the authenticator to report attestation if asked, opens up for abuse though.

Even if the standard allows them asking for attestation; the nice thing is that they can’t force the passkey in to protected storage, as long as there is a browser like firefox in between you and them. (don’t use non free apps) So store all your passkeys how you wish and the day they start asking you to replace those passkeys with their better storage options, you just don’t. If they lock you out of your account, then stop using their service. Don’t use shitty services when they abuse you.

They are turning off passwords before they start asking for attested authenticators anyway. So might as well enjoy the convenience of passkeys while they are working like you want them to.

The issue with my dad is that he does thing with computer seldom enough that he forgets. He packs away his laptop and prefer i do the regular things for him. (i refuse this) He could do it more often or write it down. But he is lazy. So he needs directions every time. When he intends to copy or move files, he still drags files, droping it randomly somewhere on the explorer window and making a mess. Then he loudly shouts in frustration, when his files are not where he expects. I keep telling him to not use drag and drop. I should disable that.

This is why modern media players try to find your media based on metadata, ignoring file structure.

Edit: At the time of upload it was a png. I guess lemmy.zip made the choice to convert it.

An attempt to make an image describing where passkeys live:

Attestation means that whatever code runs on your authenticator has been submitted to the FIDO Alliance (google and buddies) and they signed off on it. After that it can’t be changed.

Security keys like the Solokey Hacker (the superior version), is not signed and never will be, cause I can tinker with it in any way I wish. It’s truly mine.

Like the article highlights, attestation is part of the standard. The remote service can ask for cryptographic proof that your authenticator, where you stored your passkey, is attested. I have not seen any service doing that so far. IT managers are doing that internally, for their employees for sure. They don’t trust bobs homemade solution, only their chosen vendors. From that standpoint it’s reasonable.

This gives the service the power to deny you freedom of choice of where to store your passkey. They might say only yubikeys allowed or only microsoft hello or only IOS secure enclave or whatever they wish. It might become a scenario where they don’t allow any passkey solution that can run outside their platform. Running LineagOS or Linux? Google and microsoft will say it’s “not secure enough”.

They will abuse that power to make your decision for you and lock you in. “Password manager not allowed, Use our cloud insted”.

Ideally it’s not part of the standard and they don’t get the option of knowing anything about your authenticator. It’s none of their bussines how i choose to store my secrets.

Any sane service will just not ask about the attestation. They don’t have to ask. I would not ask my users on my webpage. You can store your passkeys on printed paper for all i care. Although, storing them on a usb/nfc key is pretty damn secure and cool!

Password is a shared secret: When you want me to prove myself, i repeat the password we both know. Both of us could loose that password and it happens every day. Can’t go a day without a major data breach news.

passkeys use public-private keys. Anyone can posses the public key, so that is ok to leak. The private key you keep to yourself. When you ask me to prove myself, you hand me a challange which i manipulate with my private key and hand back to you. You check it with the public key and conclude that i am indeed the one that posseses the private key. Mathematical magic! The private key was never shared.

For the user, the password is replaced with a file stored somewhere. Either in your usb security key or in your password manager of choice. Stored in a security key (aka authenticator), the private key never leaves the authenticator and all cryptographic operations are done inside it. The private key can’t leak. Amazing! Passkes in a security key are called hardware bound, very secure and nice. The security key, you can plug out and take with you. There are built in hardware like this in phones and computers. But you can’t take that with you. That sucks. They only authenticate that device. But you can make any number of passkes for all your devices.

The bad part is that some big corporatins would like to control where and how you can store the passkeys and preferably make it harder for you to escape them. The solution is to not use the services of these malicious corpos.

Log in to a website that supports passkeys, go to the account security page, press add passkey. Your browser looks for connected security keys to add the passkey to or if you have an extension installed, it might start your password manager. in the security key case; It asks for your pin and it’s done. If you use a password manager to store it, it will ask you where to put it. Once done; you can repeat and add any number of passkeys to your security keys or database. You should do at least two, for redundancy.

I would not tie my passkey to windows/ios/android or whatever. I won’t let a third party manage or sync them. Only on a security key I own or my password database.

If the site supports passkeys, the site asks the browsers WebAuthn API to create a passkey. From there it’s up to the browser where the passkey ends up. In firefox, for example, it tries my security keys first, and I can choose which one by touching it. If you use a password manager, like KeepassXC, you install an extension to hijack this process, so all passkeys end up in the password database.

Attestation on a security key just means the firmware on the key has to be signed. So in theory, you can’t use something like the ‘Solokey hacker’. When sites ask for information on my keys I ususally choose to block it in the browser. That has not been a problem so far. I allways register two separate keys for each service and they are fully mobile. A security key you could not bring with you would be pointless.

I have amazon passkeys on my security keys. I didn’t notice anything unusual with the registration process.

All the sites I’ve encountered have allowed me to use my security keys. Google had some dark pattern that made it confusing to set up and Discord does not allow passkeys for login, so the ones they let me create ended up undiscoverable passkeys, only for 2fa. The only site my solokey didn’t work so far is l1t forum. I don’t know why. but I doubt they require an attested device.

I use a NFC key for my phone.

I would not accept a device bound passkey. Nor would I let a third party, like Google, manage them for me.

If you wanna try it out; use https://webauthn.io/

That is the issue of passkeys. They are hard to understand and without understanding there can be no trust.

I evaluate it based on that they replace passwords. Password is shared secret, which is bad. Passkeys are public-private cryptography, which is good. Passwords has to be stored in a password database and your username is gonna be stored alongside it, so you might as well store your passkeys there istead. Passkeys have the added benefit of being possible to store in an authenticators secure storage, like a security key. I see no real downsides, relatively speaking. Passwords that are created by humans, those not using pw managers, are gonna be bad.

With my security key, using FIDO2, i have to have the key, touch the key and enter a PIN. My key is never exposed, signatures happen on device. It’s neat!

The future is in containerization anyway. If we all run Qubes OS, we can run each vibecoded project in separate containers. So when they crash and burn, we just restore from snapshots. The future where noone does long division is inefficient!

Considering the persistance and severity of bugs in Star Citizen I would expect this one to be delayed about 5 more years. There is no way they get this out the door in a working condition any time soon.

Cool stuff!

Now that is a good game!