Microsoft Confirms Password Deletion for 1B Users | Hacker News Reader

Microsoft Confirms Password Deletion for 1B Users

forbes.com

248 pointselorant678 comments

Passkeys are a terrible idea. They are security theater and a disaster for users waiting to happen.

Imagine you're on vacation and have lost your phone. You want to go to a cafe and log into a chat app, an email service, whatever to contact your family. In the world that passkey advocates want this is impossible via the passkey flow. If you can't authenticate via a primary device that contains your private key, you're f-ed. Service providers know this so of course they will provide recovery mechanisms. (Not consistent recovery mechanisms of course, each will have their own convoluted and likely to be broken ones). If the recovery mechanism allows for knowledge based recovery (challenge questions) then you're basically telling people that they need N passwords rather than one password. Maybe that challenge question is just a long password (recovery key). Maybe it requires access to another system, which you likely don't have in this circumstance. So you're either back to having passwords, or you're f-ed. Security theater or a disaster.

A service only has value if I can access it. I should be able to sit down at any computer in the world with the knowledge in my head and get access to any online service to which I subscribe.

You made a case for Passkeys having a flawed UX, but not one for them being security theater. Words mean things; "security theater" is a term of art for things people do for enhanced security that add no security, and Passkeys are not that.

Downthread, you claim that Passkeys (if stored in a password manager) are no more secure than a random password stored in that password manager. That seems obviously to be false; Passkeys are phishing-resistant, and stored passwords are not. So that might be where your misconception comes from.

I don't understand what is meant by phishing-resistant. There always need to be systems to authorize new devices or allow users to re-prove themselves if they loose the primary proof. Is the idea that scammers would have difficulty adapting phishes to access these resources? If "hello this is Jeff Bezos what is your password" works why wouldn't "hello this is Jeff Bezos please click authorise a new device so I can transfer you 1000$"

>I don't understand what is meant by phishing-resistant

By far the most common phish is "click this link or your account will be shut down" which brings you to a fake Microsoft/Google sign-in page, where they say "please enter your credentials" (or some variant of this). This flavor of phishing is eliminated by passkeys.

Phishing schemes will try to adapt, and some may still be successful. That is why it is not called "phishing-proof".

See the comment from 'nailed downthread. I think some people on this thread are trying to axiomatically re-derive what Passkeys and FIDO2 are. Phishing resistance is literally the point of FIDO2.

There is no "authorize a new device" for passkeys. You'd need to actually run the "register new passkey" or "authenticate using passkey" flows on the attacker's device.

That's why they are so much more secure than passwords and even TOTP or "click approve to authenticate" flows!

Because in the former case the attacker now has your password and can post it for everyone else to abuse. In the latter, which is still a problem, there is no transitivity. You're screwed with this one attack, but if you revoke their access that's it. They cannot re-use the credentials.

Phishing is resisted because the URL of the site is used in the key generation algorithm. So a site with a similar looking but different URL won't yield a workable token, even if the user is tricked into authenticating to the fake site.

You'd really have to be a state actor to be able to generate a phishing site on the original url with a valid certificate as well.

Let's say I end up on acccounts.totallygoogle.xyz. I press "login with passkey" and my password manager says "you have no passkeys for this site". I press "login with a password" and the password manager says "you have no saved passwords for this site". What exactly is the difference?

"you" can copy out the password and still "log in" on the phishing site, leaking your password.

"Dang, this stupid password manager seems to rarely autofill right, lemme quickly paste that in there...got it!"

You can never make this mistake with a passkey or FIDO authenticator.

The parent of your post outlines a phishing attack vector. The only known way to close the vector is nuking the user account.

If you can explain how, in a phishing resistant way, passkeys can grant access to a user’s account in the absence of any devices they own, I’d like to hear it.

It’s theatre because you still need the non passkey recovery method. The system is as weak as its weakest link.

This is missing the forest for the trees. Phishing attacks won't ask you to reset your passkey - or if they do, they'll have to be much more complicated and targeted. This will dramatically reduce the attack surface threatening the vast majority of users.

I tend to agree @tpatek but I’m really too much of a security newb to hold a strong opinion.

What’s the best resource in your opinion for learning enough about passkeys for a lay person to make informed decisions on them?

How about... an interview with Adam Langley about their design and properties?

https://securitycryptographywhatever.com/2022/08/11/passkeys...

(I'm not being totally serious).

Shouldn't the app storing the private key be protected by a 4-digit PIN, or a fingerprint, both of which are less secure than a plain old password? What have we achieved?

If it requires physical access to the device to enter the four-digit PIN or scan a fingerprint, that would be a substantial step up from passwords which could be used from anywhere in the world.

A PIN or fingerprint aren’t necessarily less secure than a password (and can in fact be much more secure).

In any case, nobody is stopping you from using a password-secured implementation! I do that myself on some of my devices.

It's a 6 digit pin but it's safer because it's backed by a hardware token or secure element which limits the attempts to 5 or 10 tries before locking itself.

I think you’re letting your emotions distract from the larger picture where millions of people are compromised on a regular basis because they use systems designed the way you want.

Knowledge-based access is inherently problematic: if you don’t police passwords, most people will be compromised because they use weak and/or shared passwords. If you use strong passwords, you’re also screwed if you lose your phone so you’re in the same reset game with trivia questions which are increasingly weak because they can be answered from information on Facebook/LinkedIn or from breaches from other companies which used the same question. New logins from previously unused devices in a new part of the world shouldn’t work anyway because that’s indistinguishable from a successful attack.

Passkeys avoid all of that, but you need backups either in the form of a Yubikey or a recovery code in your wallet. Yes, that’s annoying but there is no world where nobody is annoyed, so it should be a question of whether more people are inconvenienced by their accounts being breached versus traveling and losing all of their devices but still being able to remember their strong passwords.

> Passkeys avoid all of that, but you need backups either in the form of a Yubikey or a recovery code in your wallet. Yes, that’s annoying but there is no world where nobody is annoyed...

We're not talking about annoyance here, we're talking about data breaches on the one hand and permanent account lockouts on the other. There is no world where the majority of people remember distinct passwords for each service, and there's likewise no world where the majority of users carry a Yubikey or even download their recovery codes at all, much less carry them with them.

So we're left really with two choices at the extremes: do we go for the failure mode where people reuse passwords and lose money and data that way, or the failure mode where a company is physically incapable of restoring a customer's account? Given the choice between these extremes, companies will always choose the former.

Now, these extremes aren't the only choices, but then you get to the crux of OP's argument: passkeys stored in a password manager aren't any more secure in practical terms than random passwords stored in a password manager. Your auth system is only as secure as its recovery mechanism (which is the observation that led Slack to initially not bother with passwords at all).

There's one way in which I disagree with op, which is that passkeys prevent users from typing in a password and storing it in the password manager, which many users do—they effectively enforce random passwords rather than it being just a best practice that needs to be taught.

Knowledge-based access (something only stored in your head) has Constitutional protection in the United States. The same is probably not true for physical things such as phones and YubiKeys stored in your pocket.

Not that I worry about that, but it is worth pointing out that you may lose some legal protections when you use physical things rather than your knowledge.

Locking people out of their accounts is pretty much a worst case scenario. It's so bad that services with passkeys generally don't want to risk it, hence the knowledge-based recovery options. Which makes passkeys mere convenience rather than extra security.

So passwords are bad because users can't be trusted to chose strong passwords but for passkeys they suddenly are trusted to keep secure, comprehensive, backups?

Why should everything be dumbed down and idiotproofed these days? Why not educate people instead? Blame people not passwords. Passwords managers are good and free and every new phone has one built in. There is no excuse for using weak passwords anymore.

I helped a family member set up an account on a state website which involved also creating an account on id.me. The amount of text message codes and email codes and usernames and passwords was ridiculous and incredibly difficult for them to follow. Passkeys would make it impossible

Of you have a Yubikey why do you need to use passkeys (which are essentially software emulation of a Yubikey).

> Knowledge-based access is inherently problematic: if you don’t police passwords, most people will be compromised because they use weak and/or shared passwords.

I don't like it that the solution is to usurp control from the user and gate authentication through what will, in my opinion, ultimately be a small number of big tech companies. We'll eventually be dependent on having an Android phone, an iPhone, a Microsoft account, or similar. It'll be a world of "trust me bro" credential managers and you'll have to hope you never get banned by the big tech companies because it'll have a life altering impact if that means losing access to all of your accounts.

The reality is that big tech has proven we can trust them because we're nothing more than 1 of a billion customers as far as they're concerned.

> Passkeys avoid all of that, but you need backups either in the form of a Yubikey or a recovery code in your wallet.

Passkeys create a huge burden in the context of managing devices and recovery codes.

To start with, I'm not a fan of recovery codes. I have so many accounts that it's almost impossible to keep track of all the recovery codes. I have to organize them well enough that anyone who would happen to get access to my file cabinet would own my life.

To mitigate that, I need a system for tracking which recovery codes I have in my file cabinet and I need a plan for rotating / revoking them if anyone gains access to them. Even worse, printed recovery codes are observable without altering the owner (aka me). Someone could photocopy all my recovery codes and I wouldn't know I've lost control of them.

As for devices, I use Yubikeys for my high-value accounts and managing them is a huge pain in the ass. I have 5 sitting beside me. One is old, two are v4, two are v5. I didn't keep a list of all the accounts I used them for from day 1, so now I have to keep all of them. Forever. Just in case.

The only way Passkeys will solve those problems is by taking complete control of authentication and treating it like a managed service. You'll be giving up control of your ability to prove your identity and, eventually, you're going to be paying a subscription fee for it.

In my opinion it's almost a guarantee that Passkeys are going to be used as leverage against users, not to benefit them. The sad thing is that once 99% of oblivious users are fooled, the rest of us are going to get the choice of using them or being shut out of everything.

Ive also seen some pretty terrible implementations that don’t even allow end users to manage enrolled devices; so if someone steals your authenticator they have access to your account indefinitely.

Personally I like the benefits passkeys offer but some work still needs to be done around management of enrolled devices

> but you need backups

You have lost 99.99% of the population.

of course they will provide recovery mechanisms

Or, maybe they won't. Are Google and other free-as-in-facebook services going to suddenly open customer service departments?

I got permanently locked out of Facebook because during a phone OS update, the 2FA app somehow lost my Facebook information. I can't log in to Facebook because the 2FA app can't authorize it. I can't add my Facebook account to the 2FA app without first logging in to Facebook. I've sent my photo ID to Facebook a number of times, but it just goes into a black hole and I never get a response.

On the plus side, I have a lot more time to do meaningful things, and not scrolling my life away like a drug addict.

It sounds like you're arguing against passkeys, two-factor authentication, and password managers.

Do you use single, easy-to-remember plain-text passwords for all of your accounts and services? If not, you need to understand what the recovery process is when your passkey/2FA/pw-manager is unavailable or lost.

GP doesn't seem to mention password managers. The nice thing about password managers vs passkeys is they need not be locked to a particular device or platform. I can sync the same database of credentials between my phone, pc, and laptop without worrying if they are from the same vendor. I can export backups. I can access it through my personal website on any device (assuming I also remember my personal website login too) if desperate.

The problem with passkeys isn't the concept, it's the lack of flexibility in implementation.

I use easy to remember plain text passwords for services that are low risk. It's a spectrum. I'm not concerned about someone hacking into my Hacker News account for example but I am very concerned about someone breaching my bank.

> I should be able to sit down at any computer in the world with the knowledge in my head and get access to any online service to which I subscribe.

The problem with that is you have no way to be sure that the knowledge in your head won't somehow make its way into someone else's head. There's a reason that phishing is a thing.

It should be a non-goal to prevent users from making mistakes in ways which harms everyone.

You’re not wrong, but I think you’re presenting this as a dichotomy when there’s a lot of value to be had between the two extremes (passkeys all the way or passwords all the way).

The big benefit to a passkey for a service provider is that when you see a user using one, you can assert things about that session—that this is the users device, that the session isn’t likely to be spoofed, etc. These are useful things to know if you want to implement any kind of context-aware access!

Passkeys certainly aren’t a silver bullet, and I don’t think they’re really marketed or implemented well a lot of the time, but I’d caution against writing off the tech as a whole .

Microsoft has made it very, very clear that they are building toward a future with the expectation that you are always on-line, and if you aren't, they are going to make life painful in large and small ways.

> Imagine you're on vacation and have lost your phone.

A few years ago when SMS tokens and Authenticator apps where less common, I was able to do work without having my phone on the same room as my computer. Now I need to have it on my desk most of the time for logging in.

There are authenticator apps that will run on your computer, and apps that will let you read SMSs on your phone from you computer. You phone might need to be on for the latter, and maybe even connected to the same local network, but it does not have to be literally on your desk.

Isn't the difference that with passkeys you'd have 1 password for all passkeys where when using passwords directly you'd have a different one for each site. The benefit of passkeys here being that you shouldn't need that password most of the time so you don't expose it. You get the benefits of unique passwords per-site with only 1 actual password. The same benefits of a password manager but with better unique passwords.

The main downside to passkeys currently is that I cannot be my own service provider. Having that I don't see a big downside.

Passkeys are in 1Password. I'm authenticated into 1Password on my phone, ipad, browser extension on multiple computers. As long as I don't lose access to all devices at the same time I'm fine...

Passkeys are arguably slightly more convenient and not risky for those of us who are technically aware enough to use password managers, sure. But that's not what most people will do. Most people will see their phone ask them to add fingerprint/face unlock, so they do that, and now their passkey is stored only on their phone (or in iCloud if they're lucky).

> In the world that passkey advocates want this is impossible via the passkey flow.

That's incorrect. I use passkeys to login automagically with many services, but nothing precludes me from logging in with my (20 character) passwords.

> If you can't authenticate via a primary device that contains your private key, you're f-ed.

That's also incorrect, for multiple reasons — accounts support multiple passkeys, those passkeys are securely sync'd across multiple devices, recovery and backup mechanisms exist, etc.

> That's incorrect. I use passkeys to login automagically with many services, but nothing precludes me from logging in with my (20 character) passwords.

That is not the world which passkey advocates envision. In the case of those services you mention, passkeys are nothing but convenience; they provide no extra security. In the world passkey advocates envision, passkeys improve security, meaning the removal of password authentication options.

I've already been temporarily locked out by one such service, because a Firefox update made the passkeys I store in Bitwarden inaccessible (Firefox would pop up a macOS Touch ID modal rather than the Bitwarden passkey). That is the world which passkey advocates want, because it "improves security".

> security theater

Laypersons probably don't see ATOs at scale. I worked at a fintech and it was a relentless uphill battle to protect our users. We saw massive distributed login attempts daily and constantly bought compromised passwords on the gray market to run against our users' accounts. We tried to encourage better password hygiene, 2FA, Fido, etc.

You have to protect users from their own misunderstanding. When it comes to their bank accounts, improper security can be life-changing.

The term "security theater" itself is often thrown around to criticize when it's completely undeserved. Lots of people use it to poke fun at the TSA, but the term totally dismisses the fact that hijackings have plummeted [1,2]. The TSA does its job.

[1] https://www.statista.com/statistics/1240246/aircraft-hijacki...

[2] https://imgur.com/a/xV9ebD9

>The term "security theater" itself is often thrown around to criticize when it's completely undeserved. Lots of people use it to poke fun at the TSA, but the term totally dismisses the fact that hijackings have plummeted [1,2]. The TSA does its job.

Your graphic shows 'worldwide' data rather than US data. How would the TSA be involved in reducing hijackings on flights outside of the US? The connection seems spurious at best.

We could just as easily argue that hijackings correlate with other violent crime and the reduction in violent crime worldwide has led to their decline. Or that increased prosperity worldwide mitigates hijackings. There's very little basis to believe that TSA has anything to do with it.

The TSA may stop hijackings but that doesn't mean it's doing it efficiently or following science based approaches. Backscatter machines are an example

People do need protected from themselves (that's generally the point of regulation, lobbying aside)

TSA misses 95% of fake bombs/weapons

https://www.nbcnews.com/news/us-news/investigation-breaches-...

Hijackings are down because pilots lock the door to the cockpit now

> Maybe that challenge question is just a long password (recovery key).

Specifically, recovery keys are designed to be so long and complex that no human could possibly memorize them, ensuring that they’re written down / printed instead of memorized — thus making them a “something you have” credential rather than a “something you know” credential.

Nobody is checking their email on vacation in an internet cafe in 2024. Losing your phone is a real pain these days.

I assume any device in an Internet cafe is riddled with keyloggers so now you've lost your phone /and/ email account

An internet café is probably a bad choice, but I can't access a passkey-protected service from a friend's phone either.

Crazy idea, but maybe passkeys can allow users to log in more easily and with greater security 90% of the time while not significantly worsening the attack surface. It’s almost as if, security against a determined actor isn’t the sole way in which decisions around authentication are made!

> They are security theater

Passkeys are highly secure compared to passwords. All problems I know of (and there are quite a few!) revolve around availability, not security.

All problems you do write about after this are indeed related to availability, but then you shouldn't call them "security theater".

The argument is that service providers will not accept the reduced availability and so will deviate from the pure passkey way into some patchwork of security theater.

And if you have 2FA setup and no devices. You're also screwed. Its the exact same scenario.

Or if all your passwords are in a password manager on your phone

Yeah, TOTP is also a huge problem.

> They are security theater

You claimed that but didn‘t support it. They may be a bad idea (and I disgree), but how are they „security theater“, which means they are insecure?

>Imagine you're on vacation and have lost your phone

This is a solved problem.

a) you can make a phone call b) you can print important travel documents ahead of time c) you can bring a backup device on your travels. I leave a Yubikey with my house keys in the hotel or sleeping accommodations and carry my phone

> b) you can print important travel documents ahead of time c) you can bring a backup device on your travels.

While I remain on the fence about passkeys, I often see this argument from advocates when things go wrong along the lines of: "why didn't you securely store your backups and keep them with you at all times"

Firstly, it's annoying when a user is already in that situation, it does not help them solve the problem right now.

Secondly, it clearly faces a scalability issue, a significant proportion of passkey users right now tend to be well informed on the authentication model and threats, but when it scales to billions of users many of them will not be well informed and will not think about how to be prepared for when things go wrong, potentially locking them out of everything they would need to fix the situation.

While I appreciate the advantage this model gives, I struggle to imagine it will work well on the unsuspecting public.

Yubico's explanation of the name "YubiKey" is that it derives from the phrase "your ubiquitous key", and that "yubi" is the Japanese word for finger.

The Yubikey is greatly held back from wider adoption because of its stupid name.

> If the recovery mechanism allows for knowledge based recovery

Basically almost every single auth method is flawed by that because it gives way to social engineering attacks. Also once your email is taken over everything else is.

How do you log in anywhere without a computer? You have a wifi receiver implanted in your head?

Who said they would be on the moon? We’re surrounded by computers we can borrow all the time.

Without a 'personal computer' that contains your passkeys.

Next up, cloud based passkey proxy services. Store your passkeys there they auth for you after you give them some other damn auth method.

The software industry has zero concept of how much pain and suffering passkeys are going to cause the average person, almost entirely because the average American has an iPhone and a Windows laptop and there's literally nothing built-in to iOS or Windows that will sync passkeys between these two devices. The world's most popular password managers are Excel and Apple Notes, in that order; these apps do not support Passkeys.

Passkeys are not going to happen, and its the industry's fault. Its a bad standard that solves some problems the industry itself has, by creating more problems for consumers. If you force consumers to move to only-passkeys, you're going to lose customers, and it might not even be their choice, you're just making the decision to lock people out.

It's not quite as bad, your average user with an iPhone or Android phone will be fine. Just scan a QR code on the Windows machine and log in with the phone.

The problem is that the UX for this is extra super confusing, and people will end up with passkeys that aren't backed up anywhere and get locked out of their accounts.

I don't have many things against passkeys for corporate accounts, but I don't think we're going to fully destroy passwords in the personal space. To the hardline Passkey-for-everything advocates, I pose the following situation:

In your sleep, your house has burned down. You have zero devices, and your backup keys are stuck in a building you do not have access to for another several hours. You have made it out of your home with: Your wallet, containing $20 cash, a handful of slightly melty credit cards, an ID that is almost readable, and your keys. The credit cards are fucked and will need to be replaced. Your ID is mostly readable.

This is the situation that I pose for most people to try and get undone from. I then amp it up another notch:

you have no job and are unemployed currently. You cannot make use of any insurance system as you have been deemed "impossible to insure" due to your status. You currently live in a cardboard box behind a restaurant in downtown.

And before you go "why would a homeless person need email", it's required for lots of services, as is a phone number that can at least have voicemail at it (this is a service that Futel^1 provides in some places). You can't assume that physical artifacts will continue being in the possession of a dishomed person. One of the common reasons for losing all your personal effects in this situation is the state literally taking everything down to your clothes away^2.

^1 https://futel.net/ ^2 https://www.realchangenews.org/news/2024/06/05/sweeps-triple...

Heck, forget about the fire.

You're traveling in a foreign country without your laptop when your wallet and phone are stolen. You can probably get to a public computer, but how do you get into your email?

This situation strikes me as much more likely than getting hacked. Hence I will never use passkeys unless forced, and if forced I will do everything in my power to switch to another service. Same for forced 2FA as far as I'm concerned.

All of this makes me realize that availability is my biggest risk. My passwords are all 30 character random alphanumerics and I have none of them memorized.

For mainstream people uninterested in such things, this isn't a solution, but since the question was posed to "me", one way back into digital life that is not passkey specific is https://dangerousthings.com/product/apex-flex/

> and your keys

Ah, so no worries then. I've still got a passkey for all the services I really care about.

If I'm not supposed to have cloud-synced credentials like so many here dislike with those implementations of passkeys, chances are the copies of my password safes and my SSH keys to the VPS are all cooked as well.

"Just"? You just added minutes of figuring out where your phone is and how to scan a QR code to a log in process.

You do it once the first time you log in, then add another passkey for the service to the laptop. Now you don't need your phone to log in. Also, if you lose your phone, you can log back into the service on your new phone with your laptop.

Find your phone: https://www.icloud.com/find/

Scanning a QR code: https://support.apple.com/en-us/102680

The time investment could even be worth it, since "Signing in with a passkey is three times faster than using a traditional password and eight times faster than a password and traditional MFA", according to the article.

What if the passkey was generated on Windows and you're trying to sign in to iOS?

It’s your fault for not carrying your desktop and a camping battery with you.

Just install a webcam on it and scan the qr code iOS displays.

>and people will end up with passkeys that aren't backed up anywhere and get locked out of their accounts.

I don't know why this is such a common misconception about passkeys.

Account recovery flows are generally entirely unaffected by moving from passwords to passkeys. If a user forgets their password or passkey, they generally go through an email recovery flow and generate a new one.

Why do we even have passkeys at this point? Just store a cookie and use email verification for adding new devices.

...this is sort of a rhetorical question, but also maybe not? Slack does it, as do some other services I can't think of off the top of my head. I feel like a lot of normal people who don't use password managers basically always use email resets when logging in from a new computer.

The thing is, email was never designed for this purpose. Password managers are. I stay logged into my email client on my computer, but I have to retype my password to open my Bitwarden vault.

An alternative viewpoint to consider is how much pain and suffering passwords cause large companies or identity providers.

One example: Large organizations often spend $1m/yr on password resets alone.

"Hello, IT, my toddler accidentally dropped my phone in the ocean. I can't log into anything now. No, I can't restore my iCloud keys onto my Windows laptop. Please help."

I suppose corporate gets to overnight you a yubikey in 2-3 days?

>Hello, IT, my toddler accidentally dropped my phone in the ocean. I can't log into anything now.

It's clear that you are making assumptions without doing any research...

Yes you can. See "Recovery security" section of this article:

https://support.apple.com/en-us/102195

>No, I can't restore my iCloud keys onto my Windows laptop.

Yes you can — see this article:

https://support.apple.com/guide/icloud-windows/set-up-icloud...

That's why I very specifically said: Passkeys solve problems that corporations have, by moving the problems on to consumers.

Our industry was done writing reliable, quality software years ago, so it shouldn't come as any surprise that we want to keep going in that direction. Passwords have such an obvious, fantastic, beautiful quality in how when all else fails you can verbally say out loud "my password is X C J 5 4..." Its the ultimate form of reliability: non-digital, spoken or written language.

Passkeys throw that away. I don't care about any of the other arguments. Our industry wants to build less reliable software, so we built passkeys. I don't know why we're obsessed with building things that are less reliable instead of more reliable, but we are. Its sad, its insane, and frankly I'm getting so damn tired of trying to push for reliability every day and instead seeing Microsoft just throw weight around, get hacked, throw weight around again, get hacked again, and somehow still reap respect for their position in matters of security.

> The software industry has zero concept of how much pain and suffering passkeys are going to cause the average person, almost entirely because the average American has an iPhone and a Windows laptop and there's literally nothing built-in to iOS or Windows that will sync passkeys between these two devices

Then you register multiple passkeys for the website, just like you would register several Yubikeys.

It’s a 1-click process, and no HW-token required. Most people will be fine.

Many services which support passkeys do not support multiple passkeys. The big ones have figured out that we need support for multiple, but sadly just like with Yubikeys not everyone got the message on that.

But, its like I said: You have zero concept of the struggle that is already happening and will continue to get worse. That's what I mean when I say that the software industry has zero concept: You think you have the solutions, but you actually haven't even grasped the full scope of the problem.

This. Almost no-one's even realised that maybe being able to enroll multiple TOTP tokens would be a good idea. I spent some time recently trying to figure out a good, properly secure, robust authentication method would be for various important accounts both personally and at work, and I've more or less concluded that there isn't one, the best compromise that mostly works is TOTP but manually copying the secret across two hardware keys, which is wayyyyy outside the average user's capabilities, and I'm not even sure I'll be able to make it work in practice.

passkeys are not serious until they actually address backups in a way that isn't just "we'll copy the secrets around in our cloud services just like passwords lol"

(And it's not like there's no solution here: firstly make it mandatory in the spec to allow enrolling multiple keys, then standardise a means to enroll a device from another device, automatically, across all devices that other device is enrolled in, and then also it would probably be a good idea if that also offered a way to revoke the other keys)

The only site that uses passkeys I regularly use that doesn't support multiple is PayPal. Pretty much every other site that at one time only supported one now supports multiple. Which common sites still only allow one, other than PayPal?

> Most people will be fine

this assumes majority of population has the means and discipline to purchase, register and maintain multiple pass keys and/or devices.

There's a world outside the developed countries where a typical yubikey can cost 10-20% of a family's monthly income.

A family where phones are the only tech devices in the household and the phone is typically in a 100-150 USD price range and costs about half of monthly income.

By making passkeys mandatory we are asking them to get multiple of yubikeys/phones per person in the family ?!

They cannot afford to and will not maintain multiple passkeys or backups.

Orgs will have to build a way to help them recover their accounts easily without further costs or just ignore them as "edge cases".

Passkeys are free. You do not need to buy them.

They replace passwords, after all.

> Then you register multiple passkeys for the website, just like you would register several Yubikeys.

So just like Yubikeys, when you lose one of those keys you'll need to go to the 100's of sites where you registered that key and change it. This is not a good plan.

How do you log in on the other device to set up the second passkey?

Using the "passkey on other device" flow, which usually involves QR codes.

Apple‘s password manager is available for Windows, although I don’t know if it supports passkeys.

Also, there are mechanisms to use a passkey from another device (over Bluetooth I think?)

Yes, its called "hybrid transport", and its a flow where a laptop presents a QR code to a mobile phone, who then sets up a BLE connection for one time use of the passkey.

https://www.corbado.com/blog/webauthn-passkey-qr-code

(Not sure how the "cloud assisted" part of caBLE works)

So... you need to carry two electronic devices for this so-called security solution?

BLE seems to be a different way to authenticate than QR codes. Desktop computers may often not have Bluetooth chips.

iCloud Passwords is not built-in to Windows, so users have to know to install it. Most don't. Most iPhone users don't know they're using iCloud Passwords. In fact, many aren't (because it is oftentimes toggled off in settings because their grandson told them to do it or some other b.s. like that).

And, also, it barely works, if the wind is blowing in the right direction; was clearly built by a long forgotten team to check a box.

They've also released a Chrome extension, but no Firefox extension (actually, they did release a Firefox extension, but it only works on MacOS). Again, you have to know to install this.

The Windows Hello bluetooth system for passkeys has never worked for anyone I've seen try to use it. The display & scanning of the QR code works better. But, that only works if the passkey was generated on iOS and is being used on Windows; if the passkey was generated on Windows and needs to be used on iOS, you're probably screwed (I've never seen Windows try to pop open its webcam, if the device even has a webcam, to scan a QR code on another device.)

Apple has a password manager? What is it called? I’m a typical iPhone/Windows user and have never heard of it.

Apple has had a password manager baked into iOS for 11 years now. It was initially called iCloud Keychain and buried in the system settings, now it's been broken out into the "Passwwords" app as of iOS 18. There are extensions for Chrome to use the app on Windows PCs as well.

https://support.apple.com/en-us/120758

Proton Pass does this. It's browser extension will also generate and store passkeys in your Proton account making it accessible to any device.

Not built in. The number of Windows users who use Proton Pass is a rounding error toward zero.

What is a browser extension? Do I need to take a class on that? Where do I buy one?

Really, not being snarky here. If I asked my dad to install a browser extension he would drive his laptop to my house and ask me to install it for him. If I wasn't available - then it just wouldn't happen.

My mom can't see, so maybe she's okay?

Blogspam for https://www.microsoft.com/en-us/security/blog/2024/12/12/con...

The title is inaccurate. Microsoft doesn't actually "confirm password deletion for 1B users". They confirm it for millions. They have a concept of a plan for getting >billion people on passkeys as an auth factor, and will be able to get some of them to go passkey-only.

> Our experiments show that people love passkeys and are ready for them.

Really? I somehow doubt that.

> If they don’t enroll when you first ask, don’t assume their decision is permanent

No is supposed to mean no

I don't mind passkeys and Bitwarden will take care of them for me. I enrolled most important stuff with hardware tokens and it's the same services now offering passkeys so I haven't migrated but probably eventually will.

Microsoft only started supporting webauthn in the last couple years so it's surprising they're actually rolling out passkeys. Maybe they finally gave up on smart cards

They are really good. And but my android phone (on android 13) doesn't support it. So what should I do? Buy another phone?

> No is supposed to mean no

One counterargument is that nobody forces you to use their services.

I think the root problem is that nobody produces personal hardware over which the average person could conveivably assume full control. I'm not even sure it's possible, given how advanced the computer technology is.

Er, isn't it a bit manipulative to equate changing a software system with the more serious uses of that phrase?

I just had a great, novel business idea. I'm going to start writing brief, ad-laden, content-free articles all about someone else's blog post. Glad I thought of that before anyone else did. Please don't steal my idea.

The problem with passkey is that it's obscure for the common folk.

I'm a developer, yet for some odd reason I'm having a hard time understanding passkeys. Are they synced between devices? Do I need to set up a passkey per device? What happens if I have a single passkey on my phone and it gets lost? Do I lose access to that service?

So many questions that need a clear and concise answer.

The support is a little buggy on Windows too.

One issue I found recently was changing my GPU clearly changed the definition of my "device" in Windows and invalidated all my passkeys. But the passkeys are still there, the sites I access still try to request them, but Windows can't provide them, so it basically just errors out. Not found out how to clear this all out yet.

30+ years of software dev, but I rarely had to worry about security. I've grown up with passwords (from 1980s BBS logins on up), but just like you, I still don't fully "grok" passkeys, in the sense of how I understand passwords, their threat model, how they can be cracked, etc.

I think I understand it's a bit like a "my public SSH key + website's public SSH key merged together", so that each website can verify the passkey we created together using their private key. The basic mechanism is more or less straightforward.

What I do not understand well is the "how to store and manage 100s of passkeys", and how to migrate my family (including my parents in their 80s, who are far away and I am the main tech guy when the closer "basic tech literate" family members who live closer can't figure things out) to them. We use Linux and Windows boxes at home, and Android phones (for now).

I can easily log into any accounts from any of these, even from my work laptop if needed, some requiring SMS 2FA (let's leave that for another discussion). If I created a passkey on a linux desktop and stored it in a yubikey, can I re-use it on someone else's windows laptop? Would I need the bluetooth version of the Yubi to sync with my phone? Or would I have to create a unique passkey from each device to each website, using my existing password?

Basically: I don't have "one phone" and "one computer", both running the same OS. What are some usage models, including some that don't require yubikeys, because no way could I get my parents in their 80s to understand those.

Most implementations sync passkeys to the respective clouds.

How do I log into that cloud account? Since I can't do it recursively with a passkey stored in it, can I?

And what if that cloud account decides to cut off my access?

Buy a yubikey. Use a password manager that supports passkeys. Enroll multiple credentials with your cloud account.

This is sounding more and more complicated. I don't want a Yubikey. How does a password manager help my cloud account? What does enrolling multiple credentials even mean?

> Use a password manager that supports passkeys

If the user is, what's the point of having passkeys? One using a password manager has (strong) passwords generated for them...

First time I'm hearing about removing passwords and it sounds like they're implementing an even worse idea.

Anything that depends on a cloud service where your account can be destroyed any time without any recourse because support is managed by bots is a no go.

Personally, I'm comfortable with cloud services, but only if I have some sort of backup strategy.

I store all my passwords in Bitwarden. One reason I use Bitwarden (as opposed to e.g. Keypass) is because it has cloud syncing. All of my passwords are synced between all of my devices.

Critically, however, if Bitwarden's server was to disappear tomorrow, it wouldn't destroy my life. My passwords would still be stored locally, so I could open Bitwarden and export them, then import them into another service.

Passkey by design have no solution this! That means I can't trust them! I need to be able to export all of my credentials to some type of local file, which can be transferred to a new machine or service without the cloud, as a failsafe. I don't care if this is less secure, because my Bitwarden setup is already very secure, and I am much more scared of being locked out of my own accounts than of someone else getting in.

> Most implementations sync passkeys to the respective clouds.

So, in the end, the old Microsoft mantra: "Your security is very important for us". Besides Microsoft, NSA, CIA, the five eyes and friends, no one has access to your passkey, this means is secure.

No. If you read the documentation, they only synchronize encrypted data.

Is there a fallback for when the respective cloud services are unavailable?

Do the keys need passwords to work, or is the key itself sufficient? i.e. Is it like an SSH key without or with a password?

It depends on who is running your keys for you. Most of the vendors (Apple, Google, Microsoft) are using device-specific (hardware) keys to unlock the passkeys, which generally means that transitively you've first logged in with Face ID, Touch ID, Android Gesture, Windows Hello, PIN or one of the other names or brand names for "device-specific pass code or biometric" that unlocks your device's hardware security enclave.

In your analogy terms it is akin to an SSH key stored on a hardware device like a Yubikey that you have to "push the button" to unlock. It is more secure than just an SSH key without a password, but depending on a lot of factors, including your personal threat model, may be more or less secure than an SSH key with a strong password. (You'd assume the Yubikey's unexportable hardware key is a lot stronger to break than any password, so it is potentially far more secure from brute force attacks, especially remote attacks with no physical access to try to export an unexportable key. It's reliant on physical device security so it is far more weak to "in the room"/"over the shoulder" attacks. At the end of the day most people's threat model is somewhere in the middle of the two extremes.)

Of course if you decide to use a password manager like 1Password or BitWarden those passkeys are going to be locked behind your "master vault password" in a similar way to your other passwords.

The key itself, but the standard explicitly supports platforms, browsers, or password managers handling authentication to permit key use.

For example you can have a passkey where the private key is on a security token protected with a PIN or biometry.

You can have a private key live in a secure element on an endpoint too.

You could make a browser plugin that requires no auth whatsoever if you wished.

I think technical people understand the mechanics of using Passkeys, having them backed up to multiple devices etc, but there's no way my 70 year old father is going to be able to understand that. He barely knows the difference between the computer login and his gmail login. My parents are also not wealthy-enough to have Apple take care of all of this for them. He has a hand-me-down Linux laptop because all he needs is Google Chrome. Thankfully I've been able to teach my parents to write down their passwords in a password book.

I can't tell you how many times I've ask my father "what's your google password" and he says "I don't have a google password". I like the idea of eliminating passwords, but inevitably his phone is going to break or his computer is going to crash and he needs a way to recover.

The password book of every person around me become awful over time. They don’t distinguish between uppercase and lowercase, they write bad notes, most of the content is outdated, sometimes there duplicates and overall cause me more headache than anything.

I hate password books. I don’t have a better solution though.

For now, I teach them to use chrome password manager for now and log in their chrome account when they need help. It sucks too. But at least I don’t get angry with their notes.

A box of index cards with alphabetical tabs is a step up. That way you can update entries without making the book a mess.

But it's a small step.

If I install all my private-passkeys onto my phone, then I have a new problem of Lost, Stolen, Broken to deal with. I’m device agnostic, I want to get to my account from my phone, tablet, laptop, desktop, all I’m doing is spreading the exposure out by needing to install passkeys everywhere.

Microsoft will probably tell you that the Microsoft Authenticator supports syncing, so you should set it up on a backup device.

This has several problems though, one of them being that they assume you have at least two mobile devices (let's say a phone and a tablet) and another that they assume the OS you run on both your devices is the same. They do not support migrating you passwords between Android and iOS for example!

I love that the "big guys" get to support syncing passkeys between devices... but others don't (wasn't it KeePas who had issues where they were threatened by being blocked from supporting that - https://github.com/keepassxreboot/keepassxc/issues/10407#iss... )

Nice how he whipped out the attestation threat when contradicted. Shows their authoritarian leanings.

I do not and never will trust cloud storage of credentials.

Microsoft's interesting approach here with Authenticator is that they don't expect you to trust one cloud with all your credentials, they are hoping that you can trust two clouds with partial information. They've (allegedly) got some variant of Shamir's Sharing where some of the data is encrypted in OneDrive and some of it is encrypted in iCloud or Google Drive depending on which phone you use. That's (supposed to be) why there is that "phone-type lock-in" on the automatic backups/transfers because the cloud with the most phone-native/device-specific encryption is phone-vendor dependent today.

Do you trust VPNs? Because they are the same idea with a slight twist. VPNs encrypt data before it leaves your computer and decrypts it when it arrives at the destination.

1Password and the like encrypt data before it leaves your computer, stores it for however long you want, and then decrypts it when it the data is copied to your computer.

Another option is to use a password manager that supports passkeys, such as BitWarden. You can even host it locally, behind a VPN, if you don't trust the threat modelling of their hosted version.

Then, it's a case of installing BitWarden on any devices you want to use to login, protected with a strong password and 2FA.

I don’t understand the benefit of using passkeys in a password manager.

If the password manager is unlocked, I get logged in automatically anyways.

With a password manager storing unique passwords, your password is still being sent over the network to that website each time you log in.

With a password manager storing passkeys, your private passkey is not transmitted as part of the website request. It can't be intercepted or accidentally/negligently stored in plaintext in a database or server logs.

You still have to trust the secure syncing of your passkeys, just like you do with passwords, but there are still fewer threat vectors than with passwords.

This covers a negligible percentage of all hacked accounts and is at best a tiny part of what passkeys are supposed to solve.

Makes sense now. I shoulda read the document, but conversation is funner.

1. Passkeys are unique, so no more password stuffing attacks.

2. Passkeys can't be to short, in contrast to passwords

Passkeys essentially remove almost all risks for websites and moves them to the user (lost passkey, attacks on their password managers). It is not perfect, but it removes a lot of problems that we have right now (like more than a billion leaked passwords in the wild)

So it adds no value over the long, randomly generated passwords from a password manager besides making a new standard and giving Microsoft a reason to push a new dark pattern on users to force higher uptake rates of this new, bespoke standard with limited support?

> 1. Passkeys are unique, so no more password stuffing attacks.

Not really relevant for password manager users.

> 2. Passkeys can't be to short, in contrast to passwords

Not really relevant for password manager users.

> Passkeys are unique, so no more password stuffing attacks.

Just like passwords. What is the difference ?

> Passkeys can't be to short, in contrast to passwords

So a "long password" is a "passkey" ?

> a new problem

Yes, the problem exists in multiple "places" and all schemes are different balances.

There are many different kinds of "security". Each suits different needs, or addresses different threats. Not all are based upon "identity" as a central concept. Not all are based on secrets. For those that are, changing your secret from something you know to something you own merely shifts a locus of trust and mode of use.

Passkeys (and ssh keys with passphrase) are a good solution in some cases, where you use multiple end points which may be compromised. But they are no better (and less flexible) than challenge response and one time passwords and other elaborate password schemes that are a superior access control secret in other situations [0].

The problem is that most people don't understand the quite subtle interplay of factors. This is one area of cybersecurity education I'm spending more time on because regulations are going to place more emphasis on making good security choices (and not just accepting vendor defaults).

Microsoft unilaterally deciding it thinks it knows what is "best " for you accords with its clumsy patrician over-reach, and cover for a pitiful security record in its products.

Perhaps one of the most important meta-security factors is that you be able to select products that allow you to choose your security parameters and how they interact as your situation and access habits change. But that responsibility requires understanding.

[0] https://cybershow.uk/blog/posts/secrets

you can use a password manager to store your private-passkeys, so as long as you have access to it, you don't need to worry about lost devices

I mean, same with passwords, right? If you enter your password on a compromised device or you forget it, you are screwed. Which is what password managers (or passkey managers, or perhaps we could use a new term like "credential managers") help you with. Syncing, preventing unauthorised access (for example requiring your biometrics, main password or similar), backing up...

You can write down your password anywhere and copy it to any other piece of paper at any time. You don’t need certain brands of paper blessed by a consortium, or have restrictions even when copying to a blessed brand of paper.

The only reason you care about copying your password is because it's usually (always?) the only credentials you have for a service.

This isn't true of webauthn/passkeys. The number of use cases where you need to "make a copy of " or "backup" your passkeys is zero. I get that some providers let you do this for some level of convenience, but you can opt out of this and just enrol multiple distinct credentials with each service.

Unless you want to re-log into and re-enroll every service you ever signed up for when you get a new device (which is when lots of people get rid of their old device, it’s even what device manufacturers recommend, see trade-in prompts when you buy a new phone), you do need to migrate credentials.

> The number of use cases where you need to "make a copy of " or "backup" your passkeys is zero.

That just tells me you haven’t thought about the problem at all.

Honest question: Can I have a paper backup of passkeys? How can I pass them to tech-illiterate relatives?

No and you can't. These are features.

No and that is actually a key advantage that makes them almost impossible to be stolen or phished.

I haven’t dug into this but I must be missing something with passkeys.

It’s the same issue I had with getting a Yubikey.

The odds that I lose a piece of hardware that I’m carrying on me seems orders of magnitude greater than the odds of having my password cracked.

How does one recover from a lost device (other then backing up to Apple’s private cloud in which case you’re beholden to them forever to be able to access your own accounts).

> The odds that I lose a piece of hardware that I’m carrying on me seems orders of magnitude greater than the odds of having my password cracked.

I 100% agree with you, but the counter argument I've heard is that "it's worse if someone else gets into your account than if you get locked out."

This does make sense to me in some scenarios. Like, if the author of some core Javascript package gets locked out of their Github, they can't push updates to the package; if a hacker gets into that person's Github account, they can push malicious updates to said package. Better to be locked out!

If this describes you, I think a Yubikey makes sense. Personally, I am not in this category!!!

I have two Yubikeys, one of them never left my home

The "have a backup token" workflow seems like tedious make-work. I have to remove it from its "safe place" and keep it proximate to my primary token while I enroll it in everything my primary token is enrolled in.

The workflow to enroll a new backup token (when the primary is lost and the backup becomes the primary) also seems like tedious and error-prone make-work.

It would great if I could load my backup token's public key into my primary token and export a copy of the primary token's secrets, encrypted with the backup token's public key. When I lose my primary token I would only need to restore my backup token and be back in business. That eliminates the make-work of enrolling on the backup token.

Of course, this scheme allows for "cloning" of a token so it'll never be allowed by the "security" nannies who know better than us.

> It would great if I could load my backup token's public key into my primary token and export a copy of the primary token's secrets, encrypted with the backup token's public key. When I lose my primary token I would only need to restore my backup token and be back in business. That eliminates the make-work of enrolling on the backup token.

Yes, exactly this. At one point I had a list of services that I utilize along with a list of the yubikeys I had enrolled on each. My plan was to enroll my backup key periodically (retrieving it from its safe place to do so). This ended up being a giant pita, and despite my best efforts, the list became out of date. In the end I just use Google Authenticator for everything since I can back it up.

My Yubikey is only used as a factor to enable access to my password manager from a new computer. I only need it when I reinstall my computer or buy a new one.

The things you use only once every so many years is typically the kind of things you can't find the day you need it. Unless it is stored in a safe in a bank.

I have a second one but its pointless, I'm bad about registering it as a backup token in the few places that even have UIs for doing it, most places don't even let you register more than one.

So do I, but this is annoying because I need to have physical access to both of the keys when setting up 2FA on an account, or hope that I remember to add the backup yubikey when I get back home.

I have 3, yet having two pretty important systems where only one (a single 1!) yubikey allowed to be registered or only support phone app based MFA. (having the misfortune being made to work with about two dozens of web services, it is soooo twentyfirst century putting everything into the clouds regardless if it is a good idea or not)

I ended up disabling MFA in one case - with the most terrible flavour of implementing MFA - because f you!, they ask me to re-login on my stationary main home computer repeatedly for 'security reasons' (idiots) and I too many times end up the particular MFA gadget being somewhere else than at the reach of my hand, obstructing my efforts and workflow too often. Using computer systems are wasting efforts nowadays rather than helping, with the forcing through of cutting edge advanced 'solutions' without thinking about the broad picture (the curse of single-mindednes).

And then we did not even talk about my bank, completely different animal giving no shit about third party physical keys, yet another different way to get blocked if not done exactly as those particular fellas dreamed of in cheerful company meetings not caring collaborating on generic approaches.

MS is particularly bad and not to be trusted with their "insightful design" (it is told this way in the article, HAHAHA, funny guy) solutions f-ing up two things while pushing a marginal one through. With important ones the ratio is higher.

The great thing about bitcoin crap is that it's real world public/private keys used by the general public.

And oh man tons of almost millionaires have lost their backups. Tons of people still have stolen credentials. Basically nobody can "do it correctly".

> Passkeys not only offer an improved user experience by letting you sign in faster with your ... PIN, but they also aren’t susceptible to the same kinds of attacks as passwords.

I don't know about you, but a PIN is pretty much a password in my book.

Once I figured out that I can use a password with Windows, I stopped using my PIN. (I didn't use Windows for about a decade.) It's much easier to remember.

Even worse, on Windows, I'll only use passkeys on sites where I can use a Yubikey. If the passkey requires a PIN, I don't bother. I just can't be bothered to remember it.

Otherwise, on Mac, my passkey supports my fingerprint sensor. Much easier.

The Windows PIN is just a local password that isn't tied to a cloud account or ever sent across the network. Mine is a full text password, it doesn't have to be numeric.

I haven't tried it but it should also work with "Windows Hello" supported face or fingerprint recognition.

That is not mentioned anywhere, neither in the article, or when setting up a PIN.

The common definition of a PIN is for things like using an ATM, where the PIN is for the account, not the card itself.

The PIN is also for the card itself. The smartcard chip inside the card can validate it for offline transactions (although that's not as common in the US).

I think a reasonable modern definition for a PIN is "a password that can safely be short"; more here: https://news.ycombinator.com/item?id=42446015

> I don't know about you, but a PIN is pretty much a password in my book.

Then your book is filled with misunderstandings of what the PIN function in Windows is actually doing.

>> I don't know about you, but a PIN is pretty much a password in my book.

> Then your book is filled with misunderstandings of what the PIN function in Windows is actually doing.

The "PIN function in Windows" doesn't define what a PIN is. If Microsoft really meant the "PIN function in Windows" specifically, they should have said so in their blog post. Otherwise, in this context, PIN means this: https://en.wikipedia.org/wiki/Personal_identification_number.

> but a PIN is pretty much ___a password___ in my book.

> Once I figured out that I can use ___a password with Windows___, I stopped using __my PIN__.

Context clues. Read the whole comment. Pretty much immediately after they start talking about PINs and how they're pretty much just passwords, they go to talk about using passwords instead of PINs in Windows. Each sentence isn't its own entirely separate universe devoid of any context of the previous words and sentences.

What PIN do you think they stopped using immediately after referencing their Windows password? Think they stopped using their bank card PIN because they figured out how to go back to full Windows passwords?

So no, they're not speaking generally about all PINs, they're specifically referencing it in the context of Windows accounts.

https://www.grammarly.com/blog/writing-techniques/context-cl...

the way a PIN works in other contexts is the same concept as what microsoft means.

Your PIN for your bank card doesn't give anybody access to your bankaccount. that would be terrible. your pin acts as a secondary level of authentication to secure the bank card that is your primary authenticator. just like a PIN in windows hello acts to secure your primary auth method - the computer that's already signed in to your microsoft account.

Their post actually says "face, fingerprint, or PIN"

When you set up a PIN in Windows it can either be numeric or a full text password, it's your choice.

What's the difference between the two? I can log into my laptop with a password or a PIN; I assume anyone that steals or hacks my laptop can _also_ log in with a password or a PIN. PINs are inherently shorter and more simpler than passwords; why would anyone use a PIN over a password?

If you change your motherboard, your windows PIN won't work anymore, and you'll have to login to the underlying microsoft online account.

A regular local account with a password would still work after a motherboard change.

This is assuming no bitlocker. If you have bitlocker, I don't know if bitlocker key recovery will also fix the pin (hopefully you printed the recovery key and can find it)

I'm guessing this would also mess up passkeys.

The PIN on a Windows machine is a secondary credential to unlock the primary local credential, with the primary being your actual password.

Also, as mentioned in the sibling comment, PINs are just device-local credentials. They don't necessarily have to be numeric-only and can also be very long.

You can have your computer re-challenge you for a full password on some interval. So have it force you to use your password on your first login of the day, then you can use your PIN to hop back in during the day and then have the PIN option time out after so many hours. Same with any of the Hello credential options.

After too many failures with a PIN, it will disallow the PIN authentication entirely. So, its length isn't really a problem, it'll start to disallow PIN attempts after only a few wrong guesses. Once again, also configurable. Meanwhile, it'll always still allow a password although it'll start trying to slow you down on password attempts.

PINs are supposed to be stored on the TPM or similar secure platform module, they're not stored on the local computer storage. So, there's not some easily accessible file to do brute-forcing outside of the computer.

While consumer Windows isn't really Windows Hello for Business, the same basic ideas of PIN security are the same. Here's the FAQs on that which also go into some depth of why PINs over passwords:

https://learn.microsoft.com/en-us/windows/security/identity-...

The difference is that I can't login to your account using a pin. I need to use your master password or passkey, then once I have I can use a pin. Basically the pin is only local to your machine, so yes if someone steals your laptop it's the same, but there's a lot less people than can steal your laptop then can try to guess your Gmail password

> a PIN is pretty much a password in my book.

My definition of a PIN is a password that can safely be short (i.e. low entropy), which means you can only use it against a system capable of enforcing a rate limit.

That can be local trusted hardware (such as a secure enclave, a Yubikey etc.) or a remote backend via something like SRP.

> If the passkey requires a PIN, I don't bother. I just can't be bothered to remember it.

Then use your password! A PIN can, but does not have to, be short :) FIDO-compliant authenticators have to accept up to 255 UTF-8 characters; you're by no means limited to a numeric 4-digit code.

A PIN is not a password, because it only works on a device that you have already autheticated using some much more secure mechanism.

if there is anywhere that you can use a PIN without additional authentication it's not a PIN, it's just shitty insecure password.

Not necessarily. You can securely use PINs over a protocol like SRP, as long as the backend can be trusted to perform rate limiting properly.

I'm really skeptical about passkeys. This blog post talks about it in detail:

https://fy.blackhats.net.au/blog/2024-04-26-passkeys-a-shatt...

Also discussed on HN at the time: https://news.ycombinator.com/item?id=40165998

I think I'm fine with my uf2 / webauthn devices as second factor, thanks.

(Edit: to be clear, I'm not the author of said blog post)

Passkeys are webauthn credentials.

> And once that’s done, the data suggests there will be no turning back:

> Users are three times more successful signing in with passkeys than with passwords (98% versus 32%).

> 99% of users who start the passkey registration flow complete it.”

I suspect this is because primarily tech oriented folks use passkeys today, and they are fairly unlikely to have trouble logging in with any method.

Hilariously that 32% may well include all the bots doing stuffing attacks.

Also probably includes all the times my company has made me change my password. It always takes a good week before I remember that my old password isn't the one anymore.

It’s because it’s easier. Here’s what an Apple user experiences for creating an account or signing in:

1. Tap the login with Face ID button

2. Tap to approve it

It’s even faster than using a password manager without MFA but safer than password+MFA, and you aren’t spending any time goofing around with some poser’s password complexity policy or rotating your password when their servers are breached.

for real, it's so much better i've started using it everywhere, to the point where if a service asks me for a password i get really annoyed.

no i don't remember this random string i typed in months ago and no i don't want to have to type in the password to unlock my password manager for the 82349th time

this whole thread is perplexing, a forum full of tech people bitching about something that's more secure and more convenient

Passkeys are already standard, enabled by default in all the popular web browsers, and thus already widely used by non-technical people (path of least resistance).

I've got to admit I found that 32% claim staggering. Does anyone know the source of that and what exactly was measured?

If Microsoft really wants to push passkeys, why do they require Microsoft Authenticator for passwordless accounts? I already have a passkey set up and I'd be perfectly happy to delete my password, but I can't because I don't want yet another authenticator app exclusively for an account I barely use.

I was tempted to set this up, as I’ve been using passkeys everywhere that I can. But yeah, I’m not going to use Microsoft Authenticator for this one single account. I even already have a passkey for my Microsoft account.

"Passwords are no longer safe, the future is passkeys. Thus you can log in with face, touch or a PIN"

PIN - a personal identification number (aka a password)

This is one of those times where there is usually an ulterior motive behind this decision. Most cases in the form of power and/or control.

The PIN is not a password. Two very different concepts in what they're actually used for.

The password to decrypt your password database isn't your actual password to the logins contained within, its just a part of the process to get it.

The PIN to unlock a passkey isn't the credential itself. Its a part of the process to be able to use the credential.

Meanwhile, an account password is the credential.

In some scenarios that’s really a difference without distinction though.

If I have a key to my house attached to a chain so it can be used to open the door but not leave the property and then secure it in a lockbox. If someone steals the key to the lockbox they technically don’t have access to the house key but they can still rob my house

They're secret sequences of characters that grant access. The rest is implementation details.

Before iPhones had biometric authentication, a PIN was the only means to unlock the cryptographic key that protects your data on the phone. It still is; you can bypass Face ID and Touch ID at any time by entering your PIN.

So it's not like this is a new thing. It's the same concept, but applied to a PC as well.

The ulterior motive is compromised accounts and the support needed to deal with them is a tremendous waste of time and a liability.

Switching to hardware backed authentication reduces risk and support. Face/touch/PIN are an additional layer to protect against hardware theft.

If you’re going to speculate about ulterior motives, fill in the supporting details so people can tell you’re not just promulgating conspiracy theories.

Its a lot harder to share the passkey for e.g. your Netflix account among friends.

Until they are successfully explaining how to use these in a way that 70 year olds on eBay can understand, this should not be forced on users.

Ironically I've seen technical users far more confused by passkeys than 70 year olds on eBay. 70 years olds on eBay don't ask how the "Use Apple Face ID to Login to eBay" works and how secure it is, they just just generally trust Apple and eBay and just do it and it generally just works. It's the technical users that want to know all the details of passkeys down to minutia and have too many devices with syncing problems because at least one machine is a Linux machine with no hardware security enclave but "that's fine" because it is locked down to no real "cloud" access but still needs to login to eBay in an ancient Firefox fork that doesn't support passkeys once every couple of days for some hacky shell script bidder they've been running since they downloaded it off mIRC in the 90s…

«Activate login via FaceID». «OK».

Congratulations. You have a passkey.

Was that easy enough?

What happens when they lose or break the phone, or switch phones, which my parents do every two or so years?

As he’s 70 he’s using an old desktop PC and doesn’t have a smartphone. He uses the on device pass key system. One day, months down the line, Bluetooth gets switched off for whatever reason. What then.

So Microsoft blocks password attacks. A blocked password attack will never be successful. And they have to block a measly 7,000 of such attacks per second across the entire organization.

Wow ... how not to convince me that passwords are a problem.

I wonder how the internal metrics even define "password attacks". I have a 15 year old Skype account (with a long password) which I lost access to because Microsoft suddenly started requesting verification, insisting on 2FA via SMS to a 10-year-old phone number. Are all ten of my attempted logins counted in that statistic?

I imagine it has to be a certain number of attempts, because it's counting the password attacks that are stopped. You don't identify and stop a password attack after just two or three attempts. Let's say that the threshold is 20 attempts. So that's 7,000 * 20 = 140,000 password attempts per second. That's not very fast. It will not uncover strong passwords in any reasonable timeframe.

False negatives are a thing. If they've got a 99.9% success rate at blocking password attacks, it means there's 7 qps of successes. That's 500k hijacked accounts per day, 200M per year. That is a very large number.

And not a lot of systems have 99.9% recall, without trading away absurd amounts of precision...

If they suspend an account after, say, 20 password attempts, they're success rate at stopping password guessing will be vanishingly close to 100%. Especially if they've instigated strong passwords.

If passwords cannot contain dictionary words and must be mixed case with at least one special character in digit, there's no freaking way anybody's going to guess their way in, with a small number of tries before the account is frozen. The number of penetrations from that is going to be so tiny, it's not worth worrying about.

The bigger worry are stolen password hashes being cracked surreptitiously, where the attacker has an unlimited number of tries whose rate is only limited by their hardware.

Passkeys are good but giving my access keys to big tech (Google, Apple, Microsoft) is not acceptable to me.

There's other passkeys implementations and you can even use regular yubikeys as a passkey. But the problem is, many idiot sites block these implementations. PayPal for example only allows it in Chrome or Safari.

How do I backup my passkeys? I can print out a hard copy of passwords and even 2FA code generator strings, but I haven’t seen an easy way to export and import passkeys. This is a problem.

If it were as simple as printing out a list of QR codes or URL strings I would be happy, but so far no password app I know of supports this.

At the moment, export/import is not part of the "Passkey" standard. The FIDO Alliance has a draft of the Credential Exchange Protocol that would allow such actions. Allowing the trivial export of a passkey would end up defeating the cryptographic protections they offer.

https://www.bleepingcomputer.com/news/security/new-fido-prop...

I don't understand how can it really prevents exporting passkeys if it can be implemented by open source implementations like keepass. For example, if keepass do follow the guideline of FIDO Alliance to not implement exporting, but it would still possible to make a fork of keepass that force it to dump the credentials somewhere.

I really just want passkeys to exist for a decade and all lockout/lock-in edge cases being resolved before I retire my password manager, and before I tell my mother to move to passkeys.

Looks like they're beginning to work on it as we speak, how is this not supposed to be proven as stupid as possible by now :\

>At the moment, export/import is not part of the "Passkey" standard. The FIDO Alliance has a draft of the Credential Exchange Protocol that would allow such actions.

If it's already a standard, and it's that deeply faulty because it's been brain-dead since the beginning, then for a user having valuable data, they may be best advised to run the other way forever. Simple.

When you have an alliance of previous competitors and they are either incompetent or user-hostile enough from the beginning to leave out the most important factor in recovering from disaster -- personal backup & recovery -- I would want to wait a good ten years until after everyone as untrustworthy as that has been banished from any security work that could be the least bit consequential.

You can't have adequate security with untrustworthy people building the foundation no matter what they say otherwise.

People are the real problem, but clueless "security" people with initiatives this half-baked are more of a threat to average users' valuable data than millions of other clueless users are.

Why not use both? There are several password managers which supports passkeys.

That’s where I have mine.

That's fine for me, but my parents not so much.

Is there a good ELI5 for passkeys somewhere? A quick google got me to a site that says:

>Passkeys use Bluetooth technology, which requires physical proximity, to help verify the user.

Which I somehow doubt is accurate.

You probably know most of this, so sorry for the over simplification. but you asked.

A passkey is an implementation of public key authentication.

The private part should stay with you, this is your identity. The public part gets shared with others, they can use this to verify your identity. "microsoft passkey" wraps all this up into a simple tool that just looks like you are putting in a pin number.

The vague thousand foot mechanism is. someone who wants to verify your identity will ask you to sign a unique number. because only you have the private part needed to to do this, only you can sign it correctly. they can then use the public part to verify the signature is correct. and know it is really you they are talking to.

The private part is usually protected by a device, something to prevent others from using it. this is often just a password, in this case a PIN. but some times is a dedicated usb dongle. this only has to have local security guarantees not global network security guarantees. so a simple password like a PIN is not considered a problem.

The primary advantage over a simple password based system is that the thing that is shared(the public part) is unable to be used as your identity so it can't be stolen like a password. or perhaps more accurately, it does not matter if the public part is stolen(it is already public knowledge)

And now the irony, I have no proof, however I have a suspicion that because loosing the private part is the same as loosing your identity, that is, a big deal and a huge hassle to recover the account. I suspect microsoft is storing them internally. which means your account security degrades to a password based system where the password is basically pubic knowledge, that is, your so called security questions. what is your favorite color? is not a good password.

Just to add to your explanations:

1. Passkeys contain the username and the domain of the service that you have registered with

2. Because passkeys contain the domain, it provides very strong phishing protections, because a look-alike website still has a different domain.

Passkeys are resident keys. They take up storage space, which is a problem for dedicated hardware tokens which usually have limited storage space. A much nicer solution are non-residential keys that get recomputed on the fly based on the domain name that you want to authenticate against.

How does this mechanism prevent breaking one of the commandments of encryption systems:

Thou shalt not sign arbitrary plaintext

… if, as you say, a service first gives you something to sign with your private key ?

What kind of “phishing” would it be if Mallory convinced Alice to create a new account on some new service for the purpose of leaking private key bits?

Thanks

Sounds like basically public key logic with a biometric local wrapper?

Passkey is a cool marketing name for software emulation of a smart card. Hopefully you already know what a smart card does.

Except in this case, the smart card generates a new key _per domain name_

Why do they downvote you are these people neurotic or what? You're exactly right!

It's like when you get the push notification on your smartphone for two factor auth. So instead of typing in a password you get a notification on a secure device. For example on macos I can save the passkey in the os/browser and use my fingerprint to log in instead of a password.

I’m all for alternatives to passwords but what is the pathway for “I lost passkey”

Is it sending a reset to a recovery email?

It is outside of passkey scope. Most services will use email to recover access.

> It is outside of passkey scope.

Yeah right, pass along responsability to someone else. And you wonder why people don't trust this "security" solution.

Basically the same as if you had lost a physical key:

You either have an extra set up or you work around the problem through some kind of recovery method.

A trusted third party has a copy of the physical key to my flat. I handed them over once and they still work. I can print out the passwords and 2FA keys required to recover the most basic services (such as primary email and password manager) — as long as I don't change the credentials, it will keep working. But if I use passkeys stored on device, what are my recovery options? Do I need to retrieve the backup device every time I create a new passkey?

multiple passkeys

so OTP with the seeds backed up somewhere, and then passkeys on the devices I use often?

Seems like this will also be difficult for a lot of non-technical ppl. Though I guess not much worse than forgotten passwords?

In Scandinavia we have authenticators tied to the banking system (MitID in dk and BankID in sv), where if you lose it, you can get it renewed by going to your bank, or you can have a special hardware device at home that helps you renew it. Does this exist other places? These are used on more and more sites around here, where your real identity is important (everything utilities, banking, insurance, banking etc).

If you are comfortable using a cross-platform app like 1password, then passkeys can be a pretty great user experience even across ecosystems.

But Passkeys have a huge problem: They assume you will never have your device(s) stolen or broken or otherwise made inaccessible.

What happens if you're out of the country on holiday and your phone/laptop gets stolen and you need to log into your account(s) from a brand new device? You're mostly shit out of luck if you use passkeys. Especially because most peoples' backups/account recovery is a google email or icloud account which...requires you to have a known device handy to access them or set them up on a new machine.

> Passkeys not only offer an improved user experience by letting you sign in faster with your face, fingerprint, or PIN,

Just like with a password manager

> Plus, passkeys eliminate forgotten passwords and one-time codes.”

Again, can't forget what's stored in a password manager

I use Bitwarden. I don’t mind passkeys ending up there. But i want them all in there. I find the UI/UX is really poor with browser extensions, etc. and preferentially trying to use the OS’s password manager to store passkeys.

My mother has been using it because "now [she] only needs to enter her 4 digit computer pin instead of her long Bitwarden password"

Unfortunately she is unwilling to change her Windows pin to anything other than the PIN she uses everywhere else.

This has not improved her security at all. Before she switched it from what I assume was a Microsoft prompt, she had (through a bit of coaching from me) been fine with Bitwarden + TOTP

A lot of the arguments I'm seeing against passkeys are essentially that they are worse for power users who already have a password manager. But they're not mutually exclusive. I've been using bitwarden to store some passkeys. The UX is excellent. Everything is seamlessly synced across Linux, Android, and Windows.

I do worry a bit that using a passkey tends to disable MFA requirements, so basically anyone with access to my bitwarden vault can log into those services.

One thing passkey proponents forget is password-authenticated key exchanges (PAKEs).

PAKEs use passwords, and they are unphishable. That is the direction we should go to avoid vendor lock-in.

Does PAKE protect against scenarios like "password written on sticky note", "fake login page hosted at login.nnicrosoft.com", or "scammer impersonating IT staff"?

From the first, no.

It does handle the second and third, IIRC.

Where's the vendor lock-in?

Cloud sync.

Passkeys are an excellent way to lock yourself into your current device and out of your accounts if you ever move away.

I'd appreciate it if they let me block specific countries, etc from even attempting to log in. You can see the failure attempts somewhere in your user settings and I have them all day long from countries I'll never step foot in and quite a few adversarial.

> Signing in with a passkey is three times faster than using a traditional password

Unless I'm using a password manager.

> Users are three times more successful signing in with passkeys than with passwords (98% versus 32%).

With my password manager, I almost never fail to sign in. Admittedly, the autofill does mess up on some websites and then I have to spend a few seconds fixing it.

On the other hand, I am pretty darn skeptical that only 2% of users with passkeys have trouble signing in. Are they not counting the people whose passkey accidentally got deleted, or who are on the wrong device, since those people (by the nature of passkeys) could not even attempt to sign in?

Unless this is 100% free, easy and no PI, I will tell people to move to Linux

That won't solve anything when make online services that we all rely on start moving to this.

> 99% of users who start the passkey registration flow complete

What about the flow where 99% of users don’t know how to back up and restore passkeys and get permanently locked out of their accounts?

And passkeys only work with Microsoft OS, Microsoft Browser or some other thing that Microsoft controls?

Not hat I would ever imply that Microsoft has anything than our best interests in mind...

It is an open standard that is supported by all major OSes and browsers.

In fact, I would wager that the majority of current passkey users are on iOS (since Apple has been pushing this for a while now, and it's nicely integrated).

Aren't passkeys centrally hosted? So if MS gets breached or decides I don't matter they can just lock me out of my life if I host my passkeys with them?

https://www.microsoft.com/en-us/security/blog/2024/12/12/con...

> There’s no doubt about it: The password era is ending.

No it's not. How am I suppose to login to a console of a air-gapped server with passkeys?

> Signing in with a passkey is three times faster than using a traditional password and eight times faster than a password and traditional multifactor authentication.

When you sign in to anything Microsoft, you have to go through four different redirects, sure automatically but not not exactly single page sign-in.

> We don’t let users permanently opt out of passkey invitations, but we keep the messaging friendly.

by friendly you mean Dark-UI to push the user in the corner forcing them to accept as you limit their options one by one with threatening notification and nagging.

> We’re proud to be part of this collective effort and hope you will share learnings as well as you progress in your passkey journey.

Learnings is a grammatical error. Microsoft is proud to be a collective for part of vendor locked in.

The rest of all spunk.

> How am I suppose to login to a console of a air-gapped server with passkeys?

Passkeys don't require the internet to work

I dont get it. How is changing

What you know then what you have then what you are

To passkeys any better ? Sure you cant hack them but what happens with losing your phone ?

They are supposed to be synced, for example by Google's Password Manager, iCloud, or whatever tool you use (bitwarden, 1Password...)

Can they be synced to my paper notebook in my desk drawer?

I can’t say I’ll care all that much when they delete my MS account password, but LinkedIn and GitHub are going to be more painful.

Border security and thief's wet dream.

The FIDO Alliance can eat it until they support exporting passkeys and stop passive-aggressively threatening, "why don't we talk about this privately" anyone who tries to implement that.

There’s a recently released draft for an export/exchange protocol. Multiple vendors have already signaled work on implementation.

Does it allow me to export my credentials to my own machine for me to do with as I will, or is it only allowed for particular authorized vendors?

Oh, that's good news!

Wait.

“In the two years since passkeys were announced and made available for consumer use, the FIDO Alliance reported a few weeks ago, “passkey awareness has risen by 50%, from 39% familiar in 2022 to 57% in 2024.”

I don’t think that math works? Am I misinterpreting something?

(57-39)/39 ~= 46

I think they meant 50% increase from the 39% .

Ah! It was early, my brain wasn’t working. I appreciate the restraint the HN community exercised in not mocking me, hahaha

50% of 39% is 18. Add to 39 to get 57%.

That's why we use points when talking about changes in percentages. :)

Imagine it was 100 people. 39 were aware. 50% of that is 20. So now 57 are aware, which is 18 more than before, which is pretty close to 20.

So yeah, it was a change in 50%, but it was only 18 points higher.

My company uses Azure SSO so I am curious if this is just coincidence... but just this morning I had two (2!) separate desktop support technicians reach out to me today asking if I got my passkey set up for the company portals.

adversary-in-the-middle == MITM

I was reading that and thought "Wait, don't we already have a term for this?".

If they use MITM, that will include themselves. A password manager doesn't try to log in for you. But most passkeys managers are MITM. At least we can audit OpenSSL code, and we don't have to care about our public keys.

Great and the solution is passkeys.. were fucked.

"Convincing a billion users to love passkeys"

Microsoft's "convincing" is just going to be more months of casual user assault, abuse, and gaslighting with no way to just say "no".

What are passkeys?

It is public key cryptography. You give websites your public key, and keep your private key hidden. When you sign in to a website, they send you a nonce. You then digitally sign the nonce with your private key. They verify that the signature was signed with your private key, allowing you to log in.

There is no private info (aka a password) going out in public so you don't have to trust anyone to keep your password secret.

It greatly reduces the attack surface of logging in, but the attack surface is moved to the weakest part of the system, aka the user.

They're an authentication method that uses public/private keys instead of passwords. In websites the standard name is called WebAuthn.

This is similar to SSH or git operates when you disable passwords and use keys in ~/.ssh, for example.

You can store the private keys in YubiKeys or in password managers.

Another way for Google to collect your credentials.

And Microsoft, as per the case here. Or Apple.

Moreso another way to promote vendor lockin and planned obsolence.

I honestly don’t care about the “passkey” revolution. I use a password manager that generates a unique password for every service for a reason. Then secure it with 2FA (either with TOTP or emailed magic link), if available.

I think I have used a digital passkey a few times to try it. Works okay, I guess.

When will Hacker News adopt passkeys?

From the HN pushback I think this will end up like IPv6. I get to have nice things and some others likewise - many people get to repeatedly say "Nice things are impossible" and roll their eyes. I guess they're having fun in their own way?

It's nice when we build a non-brainer technology which gets adopted at scale by default, as happened for TLS 1.3, or even when other motives overwhelm the instinctive conservatism (e.g. Let's Encrypt) but that can't always happen and it looks like for WebAuthn the conservatives are going to stick by passwords "From my cold dead hands" etc.

One problem with HN in particular is that there are a lot more decision makers here, so more people whose conservatism means they're going to build, promote and demand worse solutions since the better option is in their minds impossible. That's unfortunate, it means there's a good chance that over the next years I'm going to be using more important services which have terrible authentication on account of somebody senior said "Passwords are good, we should require passwords" and anybody disagreeing was hushed or worse fired. So that's not great, but it is what it is.

Anyway, for the few people who get why this is a good thing but understandably don't trust Microsoft (or Apple, Google, Facebook, I dunno, Epic Games?) I have a suggestion: All of this technology also works fine with a Security Key, which is a thing you can buy from Yubico (or several other outfits, but Yubico is easiest if you have no idea what you're doing) for like $25. And if you - like me - use Security Keys those "But what if I lose it?" questions can be answered by Technology Connections' favourite: The magic of buying two of them.

Security keys (i.e. "roaming authenticators" in WebAuthN language) have significant practical usability and availability downsides.

> "But what if I lose it?" questions can be answered by Technology Connections' favourite: The magic of buying two of them.

And the magic of having to access both of them every time you create a new account anywhere, which probably means you'll keep them both close by – increasing the availability risk.

A more realistic recommendation would be to use an open source FIDO backend such as Bitwarden or Strongbox that let you cross-platform sync and, worst case, export your credentials if the vendor goes down a bad path.

Sure, if you trust Bitwarden but not Apple, you can, as I had assumed was obvious, use Bitwarden's Passkeys and not Apple's.

Personally I would rather have Security Keys, and there are going to be plenty of people like me. Yes, if you need a physical object as an authentication token you will sometimes need to have that object with you, I also thought that went without saying, but it's true in case it wasn't obvious.

Signing up for new accounts which deserve a separate meaningful identity (like a bank account, or a Youtuber's account, or GitHub maybe) is not a common occurrence, in the time since I last got a new Security Key I have added let's see, zero new accounts, so I had to add that key to all the existing accounts, at work and outside, then nothing.

the only secure device is turned off

Reply on news.ycombinator.com