Usekeys are a pass. Trap them!
Meanwhile, half of the people at every company I’ve ever worked at:
Oct0ber2026!
If the computer is in even a marginally secure place, storing passwords on physical paper is better than what a lot of people do.
Of all the proverbial bullets I’ve been hit with, none had my name on them; they were all addressed “To whom it may concern”. The times my identity has been stolen or my accounts compromised it was because somebody attacked some fairly large entity, like Alphabet or Equifax or Microsoft or Visa. Nobody’s going to walk into my house looking for my passwords. They might walk into my house looking for my television, but that hasn’t happened to this house longer than I’ve been alive.
Yep, there’s a reason 2FA recovery keys are usually printed and stored safely.
With that said, one way to avoid someone compromising service A due to somebody breaking into service B is to have different passwords everywhere, so a Password Manager is more convenient anyway.
Woah now what about changing 1 to !
I will take a stanza from a song, use the first letter from each word, switch the S to 5 or $ as an example, and make sure I have two uppercase, two lower, two numbers. and two special characters, 8 minimum, although now it runs about 13.
I hum as I type in my password. All I have to remember is how I typed it out.
Come at me, dictionary cracks. The result is bonkers as fuck, but I loved that stanza. I have passwords I have used for 20+ years.
My coworker who sits next to me recently commented to me that I always hum the same tune when I log into my computer. Then he mentioned I hum a different tune when I log into the proxmox.
My sticky note would be like:
computer - Local H
proxmox - Sonic Youth
mail server - Future of the Left
NAS - Faith No More
Inventory - Slothrust
etc.
Holy $#!7111
Alt joke:
Thanks for the tip! My password is now…
hunter2I feel more secure already. :D
The worst part of the left one is the implication they have only two passwords. The “under the keyboard” part at least requires physical access and (hopefully) means its not something stupid or short like “p@ssw0rd”.
The “under the keyboard” part at least requires physical access
That’s fine at home. Not so great in an office, though
I have yet to see a sticky note password that was anywhere near NIST compliant lol.
NIST compliance is 15 characters. That’s it. No stupid cycling every three months. No stupid special characters.
Somebody finally read the XKCD comic.
I wonder why passphrases fell out of style? If you remembered a series of random words like you were activating the freaking Winter Soldier, boom, 40+ characters!
Did they ever get into style? I use them, but I don’t know anyone else who does. And some sites make diceware passphrases harder to use by e.g. requiring you to add numbers, special characters or capital letters, or by banning spaces. Or by banning non-ASCII, which makes it harder to use diceware passphrases in other languagess than English.
If we take the EFF wordlist commonly used to generate passphrases, we have 7776 words. If we take ASCII alphanumerics and special characters we have about 92. Assuming we generate a NIST compliant password of 15 characters in length we get 92^15=2.8*10^29 of combinations. To get the same level of security (same number of combinations) using the EFF wordlist we need (log(2.8)+29)/log(7776)=29.45/3.9=7.6 around 8 words. If we assume the words are 7 characters long on average, plus the separators, we get 7*8+6=62 characters long. If we start to also include Unicode characters like other scripts or emojis (something I’ve recommended to others) the required number of words grows even more. I don’t know about you, but I can’t be bothered to type that all out every time, a password manager works for me.
my workplace makes us change passwords every 3 months and I don’t respect them so its the same password with the same number at the end -1 because I can’t be bothered. If I get hacked oh no ive dealt damage to a multi billion dollar corporation woe.
I have a system of using month and year plus a common trailing string. My annoyance is that every year the last number on the year keeps moving.
I have a nice notepad from a conference on my desk labelled “Passwords”
The biggest problem I see is that it requires OS or browser integration. While possibly a better solution than simple passwords this feels like a vendor lock-in scheme.
You could store them in your password safe if it supports them?
Potentially the server can request hardware/software attestation that would limit the choice of password safe to approved ones only. We don’t yet know how big/likely this could be, but in theory it’s possible.
they can already force your to install their app to receive a push notification (cough… google…cough…). if they really want to lock you in they will. passkey or not.
Netflix will use passkey attestation to make sure you can’t share logins with other users
well, if I’ve seen a vendor lockin before, and I’ve seen a couple, they’ll push them with open standards until they’re accepted and normalized.
Then suddenly the big players like Google and Microsoft will block all the open platforms sighting “security” forcing businesses to adopt closed proprietary versions while touting their free and easy too use platforms.
then the monitize it.
Passkeys are awesome. Developers not following the standard properly are a trap.
Passkeys are greate as long you make sure you use a third party (partial) password app, like proton or bitwarden that works everywhere.
I think the worry is that if passkey attestation is required it will force people into a narrow set of authenticators controlled by the big orgs.
At this point in time it’s not a problem, but how can we know it won’t be in future?
This right here. KeepassXC (PC) already had passkey support for a while, KeepassDX (Android) recently implemented support. If you use FOSS implementations, vendor lock-in and potential future corporate enshittification are non-issues.
vendor lock-in and potential future corporate enshittification are non-issues.
For now.
In some countries, banks require users use their app on IOS or Google’d Android. You can’t use their services via browser, LineageOS, GrapheneOS
Then you’re screwed anyway
This mentality is so gross. “Well might as well roll over and get pounded in the A by big corpo! what else am I going to do, right? Hehe!”
Fuck off with that defeatist bullshit.
Make them drag you ckicking and screaming. Only morons and cowards walk in lock-step with the corpos
Then don’t use these websites and this is a non issue
Ah, but of course! Why didn’t I think of closing my bank account?
The argument from the “it’s a trap” article is that the service you are registering to can use attestation to ensure that you are only using passkey managers that they approve.
I have to admit that I haven’t investigated this thoroughly myself but if the protocol can be abused in that way then your only choice really would be not to use the service. If it is related to banking or government services then you may not have much of a choice.
The web api for fido2/passkeys exposes attestation information.
Warning: Attestation provides a way for a relying party to determine the provenance of an authenticator. Relying parties should not attempt to maintain allowlists of authenticators.
from https://developer.mozilla.org/en-US/docs/Web/API/Web_Authentication_API
Mozilla’s warning is funny. “Don’t use this to reject attestations from unapproved authenticators!” That’s, like, almost the entire purpose to attestation. It tells you an Apple device or a YubiKey or whatever created the credential. What else could you use this information for other than to make life harder for users using certain authenticators?
I did read that part, but like you, I haven’t been able to independently verify it yet.
Which most people don’t do.
They’ll learn like I did the hard way. Lol
They really aren’t a trap. They’re a well designed standard. The tooling around them isn’t quite perfect yet, but they’re a huge improvement over passwords.
People upvote because they hate change.
I’ve honestly not seen any benefits over passwords.
If I want to check my mail on a library computer, I can type in a password and I’m in. If it’s using passkeys I need an already logged-in smartphone - which I probably don’t have if I need that library computer in the first place. That’s just one example.
The trap is they’re pushing passkeys before password managers that make them portable are yet to be mainstream. And that platform lock in may be a motive driving it.
“To login to your account, please use the device assigned to your identity.”
Right now, if someone who doesn’t know about password managers starts using passkeys because of a few popups you just have to follow through to enroll, they’re going to get very confused when they try to login somewhere else. There may be alternative login methods for now, but that may change.
It doesn’t seem all that forced yet, but if we have any idea of how big tech works, that’s where it is going.
Passkeys are great, Big tech aren’t.
I use them with my password manager but I’m cautious on which services and how often i may need to login to them on other devices.
I would say the people hate it, because they are exposed to the tooling and not the standard.
The standard might be the best there is, if the tooling is shit people won’t use it. And once you’ve been exposed to bad tools you make the connection between tools bad = passkey bad because they don’t know there’s a difference…
People upvote because they hate change.
People upvote because big tech has a tendency of forcing the most anti ownership outcome possible on everyone. Here, such an outcome likely would be mandatory passkeys that are set up to require hardware attestation.
One way to reduce that risk is to boycott passkeys until TPM and hardware attestation are removed from the standard. You may not think that’s a fair response, or that such a boycott won’t save us from the inevitable outcome, but nevertheless it’s not a completely irrational reaction.
It seems to me that the definition of attestation in the passkeys standard is the exact same as HTTPS certificates, which is not bad at all and nearly impossible to rug pull?
And also until the committee designing it has it members on it representing the interests of users. The point that this was lacking in the original is-a-trap article is an important one and is also being missed.
This is what people seem to be missing, I haven’t seen a rebuttal to this problem.
I’m just not convinced that mandatory hardware attestation is actually a real problem we need to worry about.
Like, yes, people with high security jobs will have that for sure. And they should.
But large companies that want customers? They want to make it as easy as possible for their customers to connect. They’re not going to force people to have a hardware device which if damaged or lost will lose them a customer. That’s just not what they want.
And yet, it’s there.
Embrace, extend, extinguish as in literally every single corporate case. Thousands of rug pulls later and we still haven’t learned our lesson.
In this case: first get people in the door en masse, then expand the requirements for things like hardware attestation in a transition period, then vendor lock people.
Adobe would never move to cloud only, that would lose them customers.
See: Literally every single API rug pull ever. Reddit, Unity, etc… Get people using the API and infrastructure, then switch from free to huge fees.
See: cloud companies giving good deals for storage and then charging massive fees for output bandwidth to access or move that data
See: VMware rug pull
This is the exact same except they are telling us what they are going to do from the start. When someone tells you how shitty they are, listen.
I only dislike the ability for service providers to enforce a “security level”. Those should be the exclusively under my (the user) control. Sending preferred default (hints) would be cool, but not enforcement.
That a webpage can basically prevent me from using a passkey if the passkey is stored in software (a password manager for example) is complete bullshit. Especially if there is still username/password as alternative which is clearly worse. Sure, hardware tokens are the ultimate security. But it should be up to me and not them if I want that level of security.
But they already do enforce a “security level” for passwords through minimum character counts (e.g. must be at least 8 characters long), specific character requirements (e.g. at least one upper case + lower case + number), rotation schedules (e.g. must be changed every 90 days), etc. Some even enforce password sharing (e.g. Netflix IP/geolocation checks).
Yeah and certain password requirements are also dumb. But at least they still give me a degree of freedom how to generate the password and how I store the password.
Second factor is sometimes worse than Passkeys; with vendor specific apps (Steam Guard, Blizzard Authenticator, Microsoft Authenticator, etc) instead of following standard TOTP. But still. I want agency over my credentials.
This has actually been a really good discussion on both sides as I think many including myself didn’t know about some of the inner workings of them. I’m glad the discussion happened. The trap article IS worth a read, it’s overly long but is really well written. After reading enough about both sides though I don’t think I’m too worried and will continue using them.
I fucking love passkeys. I hate 2FA on every god damn website, but clearly the majority of people are too lazy/stupid for passwords alone to work in a time when phishing is so widespread. My only problem with them was that I couldn’t use my Bitwarden passkeys in Firefox for Android, but they fixed that, and I’ve never had a bad experience with a passkey since.
Admittedly I didn’t read that one guy’s blog post very closely, but it seemed to claim that because some companies may some day misuse/abuse some features of passkeys, passkeys are poison and no one should ever use them.
It’s a very basic principle, that you don’t create powers that could be abused. That they haven’t been abused yet does not make doing so ok. It like saying it’s ok that my government was given the power to lock people up with no reason or due process because they haven’t used it yet.
Well if that’s possible, it doesn’t sound like a good basis for security.
The features they’re talking about are secure from a cryptographic standpoint.
However, there are features built into the passkey system so that a company could decide that it will only accept passkeys from a specific piece of hardware or software.
This isn’t necessarily bad, you may only want your server to allow you access if the passkey comes from your phone’s hardware. A person could have stolen your passkey but they’re unable to fake the attestation step.
On the other end of things, a company like Google could provide a passkey service which requires you to use hardware provided by vendors that they approve of and they could abuse their position to force it’s implementation, such as how you can use Google to sign into websites via OIDC.
Google could just as easily provide a service for ‘secure’ passkeys which are only allowed to be issued by phones provided by Google, Verizon or AT&T. No more third-party OSs (at least, if you want to sign into anything on the Internet) and no more jailbroken phones. You would have to use the exact, spyware laden, operating system that comes installed directly from your cellular provider who would have remote root access to your device.
I think the idea that we can just boycott passkeys and prevent this is nonsense magical thinking. It requires some hypothetical world where we can perfectly coordinate a boycott of otherwise useful technology. In reality this issue will remain obscure and generally only known to people interested in the topic while Google can pour tens of millions in advertising to reach everybody on the planet explaining how good and secure attested passkeys are to mainstream Internet users.
Use passkeys, they’re useful and more secure than passwords. Not using them won’t prevent enshittification, just sit back and watch the slow motion attested passkey trainwreck as it unfolds over the next decade.
I’m gonna need to find this comment in ten years. Wish me luck
Please provide a blood sample to verify your Age. Thank you for using Open FaceGoogazonthropic, we love you.
Another point someone brought up in one of these posts: the remote attestation (IE locking your passkeyto a specific app or software) issue is highly unlikely to be used for public websites, because it would block / halt the adoption they’re trying to promote, and its against their interest. No website that I know of has done this for TOTP either.
They push TOTP and passkeys now because they want to avoid the costs and support around resolving hijacked accounts, and password phishers.
The use-case for remote attestation is a valid one also: say you have a really secure internal system that you want to lock down to only users of your specific passkey validator, and make sure its that specific app, unspoofed.
Brought to you by the community sending death threats to a guy that added a date field in a program
Who did what now?
The developer who added a “date of birth” field to systemd received death threats, because some people saw it as a first step towards age verification and apparently the appropriate response to that is cyber bullying and death threats
I have a password manager and hardware token. I see no need to use passkeys.
Password manager can store passkeys as well. They’re way easier to fill than passwords, they always work and never have issues with filling like you can have on some websites that just don’t work well with pw managers.
Still needs an arguably perhaps overengineered complicated standard to do it, and seems to open the door to more hardware attestation demands. I’m not a fan and I refuse to use passkeys. (But I can see the use for preventing fishing attacks, so I realize there is no obvious perfect answer here.)
Yubikey4lyfe
Yubikeys support device bound passkeys already.
But you need to buy at least two of them, which isn’t cheap.
And… honestly, you should probably buy 3. Losing your main key only to find out that your backup key broke a month ago and you haven’t been testing it is a real risk.
Not every service allow for registering more than one passkey
And what are they odds of simultaneous losing / breakdown of all three keys? I think they are not negligible.
I ended up getting one through arstechnica (they sent one if you subscribed back then), then I got more through some sale or something
are passkeys not a type of a hardware token? they’re tied to a device.
They’re actually not tied to a device. They can be synced across devices.
Bitwarden, 1Password, Dashlane, Google, Apple, and Microsoft will all do passkey syncing for you.
We don’t yet have a good Linux native passkey store. I believe the
credentialsdproject is working on a spec for that. Once that’s up and running I would expect to see some options for syncing without relying on a third party service (though, you can self-host bitwarden right now). It’s definitely not seamless on Linux yet though.Sadly 4 of those companies are American, and Dashlane has significant US operation presence, making those recommendations unacceptable to me - ymmv
1password is Canadian and zero-knowledge so could be an option if i didnt already use a different service.
I dont like the idea of pre-authorising a device to handle credentials and access in perpetuity at the hardware level. I’d be fine with having a hardware key that holds passkeys but cant use them, while the device using them can only do so when i put the two items together. Unfortunately i do not understand how to save a passkey to a hardware key or how to manage them once that is done. Till someone gives me a straightforward ux to do that, i’ll be using unique passwords, a manager, and totp.
If i am misunderstanding, thats just a different problem; the passkey thing needs to be explained more clearly.
Microsoft makes a hard distinction between Device-Bound and Synced passkeys inside of corporate tenants. They are in fact two different things that happen to be using the same FIDO standard, and can be stored alongside one another in the same app if it supports it.
Also KeePassXC with the browser plugins works a treat for synced passkeys.
so whats a passkey and how is it different from a password?
It’s essentially just public key cryptography streamlined to reduce friction for the user. When you’re prompted to create a passkey for a service a new public/private keypair is created. The private key can then be synced to other devices for example via the iCloud keychain or Bitwarden. Obviously you have to then trust that provider to keep your keys safe. The upside is that your passkey can be automatically discovered and used to sign in without using a password. Alternatively the private key can be device bound but the downside is that if you lose the device you lose the private key too.
If it was just to helpfully reduce friction, it wouldn’t be so controversial. The inclusion of any sort of TPM and hardware attestation support at all is what has some people sounding the alarm (in my opinion rightfully).
It’s mainly controversial because the actual use contradicts its purpose. Passkeys are phishing-resistent, which is still the main risk for password in real world scenarios, and are a good idea.
But the websites supporting it put out big warnings when you don’t have another method to login configured. And they don’t actually advise you how to backup your passkey and keep it safe, but instead want you to set up an alternative way to login or recover your account. Which totally defeats the purpose in the first place.
Quite the contrary: “there is a problem with your passkey/account, please use the recovery method you set up” even makes for more convincing phishing. So why are they pushing for passkeys when it isn’t for security reasons?
This is, imo, the bigger issue. No clean way to export and move passkeys around, even between the open source options like Bitwarden and Proton Pass or as plain backups…
Because of this discussion (and because I hadn’t looked at passkeys for quite a while), I did some testing…
And passkeys integrate seamlessly into my keepassXC to get backed up with all my regular passwords. So software- instead of device-based passkeys that can be properly transfered, synced or backed up work…
The problem is that tech-minded people that use password managers and think about security and backups are not the primary target group that passkeys should protect from every-day phishing attempts in the first place. And when it’s supposed to protect the common user effectively and conveniently/frictionless but then instantly destroys the effect by advising to set up another login method it makes no sense.
Maybe I should have clarified, you can’t export from Bitwarden into KeePassXC or vice versa. Imagine you have 100 passkeys and you want to switch your passkeys manager. Unless something has changed drastically in the last few months, this was impossible
Are you sure about that?
When I open up the import function in KeePassXC I can pick 1Password(.opvaul), Bitwarden(.json), Proton Pass(.json) and a couple of other file formats.
PS: Oh, wait. That only works for the passwords while passkeys simply get ignored? Okay, that’s dumb.
My post was only meant to be a quick explanation of what passkeys are so I’ll leave it as is. I do think it’s healthy to be suspicious of big tech corporations and their motivations though so I’ll be doing some further reading.
That passkeys are a trap article also has straight up one of the best explanations what passkeys are https://nonfunctional.substack.com/p/passkeys-are-a-trap-do-not-use-them
A passkey is cryptographically signed by the server when it’s created.
So it does not only has your credentials encrypted which are then used to login to a server, but it also carries information about the server and only that server can request the credentials from the passkey. So unlike a password a passkey is resistent to phishing attempts as you can’t actually give your credentials away to anyone but the actual server it was created for.
Or “Like all questions of security vs convenience, a user should decide what they are or are not comfortable with.”
I think the reason passkeys are so controversial is that tech has a long history of ignoring user choice and pushing the most anti ownership solutions possible. Therefore, I think there is fair concern emerging along with any new mechanism that has any sort of TPM or hardware attestation components at all.
The concern is valid, but we should also look at these company’s interests in pushing passkeys, which first and foremost is avoiding all support and resources they have to dedicate to password resets and account hijacking, of which TOTP was the band-aid for, which they also push.
The software or hardware attestation is IMO a non-issue for most public sites. We have a precedent in TOTP, and they haven’t locked those down either to specific software, because they care more about adoption (to avoid the costs above) than controlling what software you use to validate.
If someone wants to say that these companies will turn on this attestation for passkeys in the future, and break a ton of logins and decrease adoption, then they should have a reason why they haven’t done so for TOTP.
If someone wants to say that these companies will turn on this attestation for passkeys in the future, and break a ton of logins and decrease adoption, then they should have a reason why they haven’t done so for TOTP.
Didn’t you already answer this by saying they want to increase adoption? That seems like the reason. I think the argument here is the same as what they do with something like streaming (which is closer to what I have a problem with, rather than locking people to specific software). They work on adoption until the numbers and ease of use are high enough to kill the other options and prevent multiple people from logging into one account. They lose some people, but gain more because of the new restrictions forcing people to have their own account.
Doesn’t necessarily work the same in that sense, but it’s still a numbers game. We continuously see companies/governments postpone onerous policies until they have enough people willing to put up with it. Then they ram it through and ignore the people that complain. It’s age gating and digital only purchases and digital id and backdoors and everything else we see with tech.
Passkeys are a good idea to prevent phishing. Using passkeys but then require a second method to login as a backup to prevent lockout when you lose your key (as many sites do) is epic bullshit. It makes an actual security improvement into some convenience feature so people don’t need to remember/type passwords anymore. Because the phishing will now ask for the alternative/recovery login to fix some alleged problem with your account/passkey…
So it suddenly does not provide additional security anymore above what a password manager would already do.
When you sell somehting as a security feature then instantly defeat the additional security to make it just about convenience the question about the actual goal feels natural…
Last time I was in Thailand and my buddy told me don’t worry, she’s not a trap.
Again with this?
I’m going to do the smart thing, get drunk and pass that key to a designated driver and let him figure it out.the duality of passkeys
No duality: only suck
Seems like if you want something to be able to be unlocked, you’ll need a key.
It’s the typical case of perfect being the enemy of good.
