PassageNick

This is a great question.

I think the biggest barrier to adoption is lack of end user demand for the service. That is followed by people not understanding/believing the incredible increase in user experience and security. It's almost like people think it is too good to be true.

It is not clear to me what they are implementing here. There is not mention of passkeys anywhere.

Not sure I follow....

Biometrics are very difficult to impossible to reproduce short of physical coercion.

Passwordless is actually MFA --

Something you have (your device) Something you are (your biometric)

Those are definitely two factors that are required to be together for passwordless to work

>> I hate having to rely on having my phone handy to log into anything.<<

This isn't the case. Nothing about passkeys says you need your phone to login on a website with your laptop, for instance.

The problem with legislation like this is that it eliminates the possibility of better solution.

What happens if someone invents a better interface than USB 3.0?

Or better, why would anyone bother when a better interface couldn't be used?

No -- every origin has it's own Public/Private key that is stored on the TPM chip on your device. The TPM is designed specifically for securing these keys.

Each passkey is a modest amount of data, and I don't see a person having so many passkeys that the TPM gets full.

That's a great article, thanks. In fact, it's a fantastic article. I read it a couple of weeks ago, and learned a lot. Thanks.

Apple's changes do degrade security, but I think it is important to note that even with those degradations, Apple passkeys are still many orders of magnitude more secure than passwords.

....and can you explain the cookie theft thing a bit more?

If you can take a photograph of someone's fingerprint and reproduce it, how, exactly, does one use that?

They cannot block access. The passkeys are actually stored on your devices in a Trusted Platform Module. When moved to the cloud, they are E2E encrypted, and the transferring platform has zero knowledge of your keys.

Currently, you cannot move them to other devices without the cooperation of some cloud service, or the like. At some point you'll have to trust someone to move passkeys between devices.

Passwordless is MFA -- something you are and something you have.

I'm not a yubikey expert, but I don't believe that losing your Yubikey will open up your company to a breach.

For a typical passwordless solution, losing your phone isn't a risk, given that no one can reproduce your face or thumbprint.

You own your own passkeys on your own device, ultimately. Google/Apple/MS have no ownership or knowledge of the actual keys.

Fair enough.

Re: Yubikey -- I confess I don't know. The folks in r/yubikey definitely will, though.

The "Big Three" are on the FIDO board, along with 1Password. They can't really do the extinguish thing, and it really isn't in their interst to do so.

An no, the small tweaks don't kick anyone out of the game.

There will be other, perhaps more trusted, companies that you can use to move your passkeys around between eco-systems.

The threat surface of a password based system is like Lake Superior.

The threat surface of a passkey based solution is like a small puddle after a rain.

How is there a "reduction" in security here?

Yeah, it is non-trivial to implement, but not impossible. Some folks go that route.

There are SaaS solutions that implement it for you and make it easy to include in your app.

(Full disclosure: I work at https://passage.id)

WebAuthn is the short name for the "FIDO Alliance Web Authentication Protocol".

"Passkey" is the trade name (that Apple tries to own) for the "stuff" that results from using the WebAuthn protocol. At it's root, a passkey is really the private key portion of that "stuff" that is kept. So yes, in practice, a passkey is the result of a WebAuthn implementation.

MS, Apple, and Google don't implement WebAuthn. Companies like mine do. Each website out there that wants to use passkeys needs to employ WebAuthn, whether via build or buy. What the "Big Three" do is leverage their OS's and platforms to enable the storage and migration of passkeys within their eco-system. WebAuthn is implemented in their browsers, and they enable the use of passkeys (which websites make happen via implementing WebAuthn).

One thing to note is that the Big Three also make a small adjustment to the WebAuthn protocol to allow passkeys to shared inside their cloud infrastructure. This every so slightly reduces the security of passkeys (which start out as very, very many orders of magnitude more secure than passwords).

You can read about Passkeys here: https://passage.id/post/a-look-at-passkeys

More on WebAuthn: https://passage.id/post/what-is-webauth

That's a quality aphorism.

It seems strange to me that anyone would go anything but Cloud Native today.

It's amazing how the attitude about not wanting to put data in the vendors hands has changed over the last ten years.

I remember having a hard time to convince our CEO to use BitBucket in 2011 because our precious code (that no one would actually want or could actually understand.....) was going to be "in the cloud".

I bet there are many firms that gave into the fear and regret it now.

(Note: I work for Passage.id, now part of 1Password...)

Auth is pretty easy to implement, but difficult to get and keep right. Then there are the nooks and crannies that crop up and appear and get discovered that you have to be aware of and keep up with. I am of course biased, but it seems to me that paying a company to keep up with the rapidly changing environment is much more efficient than trying to do it yourself.

And with WebAuthn and Passkeys -- you can implement that yourself without too much trouble. It's not trivial but not impossible, but the same argument applies -- nooks, crannies, corner cases, risks, etc.

Well, no, that is not right. Passkeys most definitely not available to someone who steals your phone.

WebAuthn is two-factor. In order to login, you have to provide 'something you have' (your device) and 'something you are' (your face, fingerprint, etc.)

Passkeys cannot be taken or stolen by force.

WebAuthn is not at all like saving your password in your browser. Passkeys (i.e.private keys) are stored in a virtually impregnable Trusted Platform Module and not available. Even if someone steals your device, they cannot access your passkeys.

The passkeys are stored in a Trusted Platform Module, and as far as I know, it is basically impregnable, even with access to the physical device.

The reason I ask is that I see certifications all over the place. Frankly, I couldn't care less about them, but wonder why some folks seem to want them and feel that they are valuable.

WebAuthn drastically improves authentication.

For starters, it doesn't release any secret information into the wild. Instead, it uses a public/private key pair to challenge the user to decrypt something that only she or he can decrypt. The website (as an example) no longer stores anything but your public key, which doesn't reveal anything.

Secondly, you can't give away your passkey information so it is for all practical purposes unphishable. (I can't conceive of a way that it might be phished, but that doesn't mean there isn't one.)

In addition, it is super-duper easy on users. They don't have to remember anything, and can login with the touch of a finger or a glance at the camera.

This is a huge step forward in authentication.

That would kind of defeat the purpose, no?