Hacker News Reader

Comment by evil-olive | Hacker News Reader

the FIDO Alliance has an FAQ [0]

> What is a passkey?

> Any passwordless FIDO credential is a passkey.

I would recommend [1] as an excellent overview of the FIDO2 and WebAuthn standards that underlie passkeys. depending on how you use your Yubikeys, you may already be using these standards.

if you already have a password manager you're happy with, the appeal of adopting passkeys is somewhat marginal. if you're using your Yubikeys for FIDO2-based MFA you're already getting the majority of the benefit.

0: https://fidoalliance.org/passkeys/#faq

1: https://www.youtube.com/watch?v=DWrLBwi7ZBA

View on HN

> if you already have a password manager you're happy with, the appeal of adopting passkeys is somewhat marginal

This is where I'm at personally right now; basically just waiting for my favorite password manager to add support for passkeys. After that the transition will be pretty seamless; I'll just start storing passkeys in my password manager instead of passwords wherever possible, and get a nice UX improvement as a result.

There's a nice security improvement to passkeys, as well. No more passwords getting leaked from poorly-run websites, security breaches, etc. You can dump an entire user database and nobody is compromised outside of the obvious privacy implications.

The biggest security benefit of passkeys is that they raise the floor of security posture for the least security conscious users. E.g. You can't use "bob1989!" as your password on every single site, write it on a post-it stuck to your monitor, and enter it into every phishing site that sends you an email claiming to be from "M1cro3oft Supp0rt".

For users who already have a very good security posture the security benefits of passkeys are pretty marginal. For example, I already use a long, unique password for each site via my password manager. If a site gets breached it will only affect that specific site, and even then only if they store passwords in plaintext. My passwords have enough entropy that even an MD5 hash is unlikely to be cracked in an offline attack. For me the biggest potential benefit of passkeys is better UX when signing in to websites.

> I'll just start storing passkeys in my password manager instead of passwords wherever possible

Depends on how the password manager stores the passkeys.

I noticed that bitwarden stores TOTP keys such that the secret is exportable. Which means that if you're bitwarden wallet is compromised, even temporarily, the TOTP keys can be stolen.

If the password manager just stores the private key as an encrypted file, then it would probably be better to use a yubikey, iOS or Android device as those are designed to prevent the key from being extractable.

But maybe password managers will store passkeys a HSM.

I don't plan on using an HSM to store my passkeys anytime soon. The security benefits are marginal for me compared to the huge inconvenience of having to manually update my credentials on hundreds of sites every time I buy a new HSM.

I'll continue to use WebAuthn hardware keys as a second factor for the small minority of sites where that makes sense. For the rest I'll just use passkeys synced to my password manager.

You have a (constantly expanding) choice in what software or hardware your passkeys are provided by, and can decide based on your own risk/convenience trade-offs.

> 0: https://fidoalliance.org/passkeys/#faq

"What is a passkey?" might as well redirect to zombo.com.

> Any passwordless FIDO credential is a passkey.

Oh great. So a physical security key could be a passkey, but only if it's used as 1FA not 2FA. At the same time, this weird "store key material in a device and optionally sync to the cloud" thing is called passkey, but if someone uses it as 2FA it suddenly isn't a passkey?

The term is often used without a clear definition. As a passkey should be used instead of a password, it means that you need "user verification" (PIN or biometrics) to protect the access when the device is lost.

The other thing is that it is more convenient to have "discoverable credentials" (a.k.a. "resident keys") so the browser can check if there are passkeys stored on your FIDO2-authenticator for a specific website. (instead of asking for a username first)

Syncing is optional but if your passkey is not synced, it is usually called a "device-bound passkey" (e.g. Windows Hello).

Is there a more technical explanation anywhere? I would like to know what they are not what they are used for and why they are so great.

https://passkeys.dev/docs/reference/terms/#passkey

Exactly what I was looking for, thanks!

Reply on news.ycombinator.com