this post was submitted on 11 Oct 2023
291 points (98.0% liked)

Technology

59148 readers
2261 users here now

This is a most excellent place for technology news and articles.

Our Rules

  1. Follow the lemmy.world rules.
  2. Only tech related content.
  3. Be excellent to each another!
  4. Mod approved content bots can post up to 10 articles per day.
  5. Threads asking for personal tech support may be deleted.
  6. Politics threads may be removed.
  7. No memes allowed as posts, OK to post as comments.
  8. Only approved bots from the list below, to ask if your bot can be added please contact us.
  9. Check for duplicates before posting, duplicates may be removed

Approved Bots

founded 1 year ago
MODERATORS
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
291
Google will now make passkeys the default for personal accounts (arstechnica.com)
submitted 1 year ago by [email protected] to c/[email protected]
190 comments fedilink hide all child comments
 

Passkey is some sort of specific unique key to a device allowing to use a pin on a device instead of the password. But which won't work on another device.

Now I don't know if that key can be stolen or not, or if it's really more secure or not, as people have really unsecure pins.

you are viewing a single comment's thread
view the rest of the comments
[–] [email protected] 3 points 1 year ago (1 children)

What do you see that's wrong with it that we don't if I may ask?

[–] [email protected] 7 points 1 year ago (1 children)

Mostly phishing. Passkeys can’t be phished. And really, passwords are awful in general for security purposes. You don’t have to use your phone or google or apple or whatever.

I actually have a physical usb key that I use as a passkey. Its just a more secure login implementation and will likely be the only option in the future.

[–] [email protected] 2 points 1 year ago (1 children)

Passkeys can be phished, it’s just much more difficult than with passwords, TOTP MFA, SMS MFA, other OTPs, or push notification-based MFA (e.g., Duo or the way Microsoft, Apple, and Google push a notification to their app and you confirm and/or enter the key).

Passkey is extremely phishing resistant in the same as Webauthn MFA and U2F MFA are, in that origin checks by the browser prevent attackers from initiating the auth process. But it can still be attacked in these ways:

  1. XSS bug in the target website
  2. Browser vulnerability
  3. Malicious browser (not a concern on iOS but a concern everywhere else)
  4. Compromise of any cert in the chain between you and the target website
  5. Convincing the user to install (or using malware to install) a root certificate, or compromising one you already installed (e.g., for work)
  6. Bookmarklet/clipboard/devtools attacks

From memory, passkeys, webauthn, and u2f should prevent over 99% of phishing attacks that are successful without them in place.

There’s also the risk of the passkey itself being compromised, though that level of risk is dependent on your device / how you’re storing your passkeys and isn’t a “phishing” risk.

[–] [email protected] 2 points 1 year ago (1 children)

The main point is all those attacks need to attack the local software or hardware implementation on one of the two ends (or a cert issuer), and even then it's replay protected so for example an XSS attack lasts only for one session, so it's more robust.

[–] [email protected] 1 points 1 year ago

Correct, but that doesn’t change the fact that “Passkeys can’t be phished” is not true.