Password is a shared secret: When you want me to prove myself, i repeat the password we both know. Both of us could loose that password and it happens every day. Can’t go a day without a major data breach news.
passkeys use public-private keys. Anyone can posses the public key, so that is ok to leak. The private key you keep to yourself. When you ask me to prove myself, you hand me a challange which i manipulate with my private key and hand back to you. You check it with the public key and conclude that i am indeed the one that posseses the private key. Mathematical magic! The private key was never shared.
For the user, the password is replaced with a file stored somewhere. Either in your usb security key or in your password manager of choice. Stored in a security key (aka authenticator), the private key never leaves the
authenticator and all cryptographic operations are done inside it. The private key can’t leak. Amazing! Passkes in a security key are called hardware bound, very secure and nice. The security key, you can plug out and take with you. There are built in hardware like this in phones and computers. But you can’t take that with you. That sucks. They only authenticate that device. But you can make any number of passkes for all your devices.
The bad part is that some big corporatins would like to control where and how you can store the passkeys and preferably make it harder for you to escape them. The solution is to not use the services of these malicious corpos.
Attestation means that whatever code runs on your authenticator has been submitted to the FIDO Alliance (google and buddies) and they signed off on it. After that it can’t be changed.
Security keys like the Solokey Hacker (the superior version), is not signed and never will be, cause I can tinker with it in any way I wish. It’s truly mine.
Like the article highlights, attestation is part of the standard. The remote service can ask for cryptographic proof that your authenticator, where you stored your passkey, is attested. I have not seen any service doing that so far. IT managers are doing that internally, for their employees for sure. They don’t trust bobs homemade solution, only their chosen vendors. From that standpoint it’s reasonable.
This gives the service the power to deny you freedom of choice of where to store your passkey. They might say only yubikeys allowed or only microsoft hello or only IOS secure enclave or whatever they wish. It might become a scenario where they don’t allow any passkey solution that can run outside their platform. Running LineagOS or Linux? Google and microsoft will say it’s “not secure enough”.
They will abuse that power to make your decision for you and lock you in. “Password manager not allowed, Use our cloud insted”.
Ideally it’s not part of the standard and they don’t get the option of knowing anything about your authenticator. It’s none of their bussines how i choose to store my secrets.
Any sane service will just not ask about the attestation. They don’t have to ask. I would not ask my users on my webpage. You can store your passkeys on printed paper for all i care. Although, storing them on a usb/nfc key is pretty damn secure and cool!
Personal anecdote to illustrate: the last time I tried creating and using passkeys for my Google account, I got the impression they (Google) would only accept keys coming from either Google Authenticator (their 2fa smartphone app) or something like macos’s built-in keychain. No way to give them a key generated using a local, offline service that I could store however I want - it needed to be accessible using, basically, a big corpo['s software] as the intermediary. This coming from how their website would request the keys from my browser (which means mozilla seem to be in on it as well :/).
Given that I currently use a pure file-based password manager that I can move around and switch the keys for as I please, the current state of passkeys feels like a step back in terms of allowing me to control my digital identities.
Password is a shared secret: When you want me to prove myself, i repeat the password we both know. Both of us could loose that password and it happens every day. Can’t go a day without a major data breach news.
passkeys use public-private keys. Anyone can posses the public key, so that is ok to leak. The private key you keep to yourself. When you ask me to prove myself, you hand me a challange which i manipulate with my private key and hand back to you. You check it with the public key and conclude that i am indeed the one that posseses the private key. Mathematical magic! The private key was never shared.
For the user, the password is replaced with a file stored somewhere. Either in your usb security key or in your password manager of choice. Stored in a security key (aka authenticator), the private key never leaves the authenticator and all cryptographic operations are done inside it. The private key can’t leak. Amazing! Passkes in a security key are called hardware bound, very secure and nice. The security key, you can plug out and take with you. There are built in hardware like this in phones and computers. But you can’t take that with you. That sucks. They only authenticate that device. But you can make any number of passkes for all your devices.
The bad part is that some big corporatins would like to control where and how you can store the passkeys and preferably make it harder for you to escape them. The solution is to not use the services of these malicious corpos.
Nice explanation!
Can you elaborate on this part?
Attestation means that whatever code runs on your authenticator has been submitted to the FIDO Alliance (google and buddies) and they signed off on it. After that it can’t be changed.
Security keys like the Solokey Hacker (the superior version), is not signed and never will be, cause I can tinker with it in any way I wish. It’s truly mine.
Like the article highlights, attestation is part of the standard. The remote service can ask for cryptographic proof that your authenticator, where you stored your passkey, is attested. I have not seen any service doing that so far. IT managers are doing that internally, for their employees for sure. They don’t trust bobs homemade solution, only their chosen vendors. From that standpoint it’s reasonable.
This gives the service the power to deny you freedom of choice of where to store your passkey. They might say only yubikeys allowed or only microsoft hello or only IOS secure enclave or whatever they wish. It might become a scenario where they don’t allow any passkey solution that can run outside their platform. Running LineagOS or Linux? Google and microsoft will say it’s “not secure enough”.
They will abuse that power to make your decision for you and lock you in. “Password manager not allowed, Use our cloud insted”.
Ideally it’s not part of the standard and they don’t get the option of knowing anything about your authenticator. It’s none of their bussines how i choose to store my secrets.
Any sane service will just not ask about the attestation. They don’t have to ask. I would not ask my users on my webpage. You can store your passkeys on printed paper for all i care. Although, storing them on a usb/nfc key is pretty damn secure and cool!
Very cool, I didn’t know about Solokey.
Thanks for mentioning it.
Personal anecdote to illustrate: the last time I tried creating and using passkeys for my Google account, I got the impression they (Google) would only accept keys coming from either Google Authenticator (their 2fa smartphone app) or something like macos’s built-in keychain. No way to give them a key generated using a local, offline service that I could store however I want - it needed to be accessible using, basically, a big corpo['s software] as the intermediary. This coming from how their website would request the keys from my browser (which means mozilla seem to be in on it as well :/).
Given that I currently use a pure file-based password manager that I can move around and switch the keys for as I please, the current state of passkeys feels like a step back in terms of allowing me to control my digital identities.