Passkeys are like a password + 2FA mashed together. If someone steals your “passkey password” they still can’t use it to login without the hardware component. That means phishing is harder. Since passkeys are generated for the user from their hardware it also forces better hygiene on the user by not allowig any password duplication.
A downside is it is tied to hardware and a provider that can cause problems witb loss of device or when you change devices but it is hard to say how painful that is going to be.
It’s more about supporting a new standard. Plenty of folks are using same credentials everywhere, and passkeys could potentionally change that. Also, entering 1 thing is easier than entering 2.
Continuing on what Rolling Resistance said (sorry for the delay, had to step away for a while), I know plenty of people who do use a password manager and still use a static password in some places (hell, I’ve been guilty of that in a few places - but generally on network-isolated systems). Some people also don’t use 2FA because they find it inconvenient.
Passkeys are more or less very similar to how SSH keys work if you’re familiar with those, your device (or password manager) generates a secret key that it only has access to, and then gives the public key to the website (and a new keypair is generated for every single website). When you login to a website, the website sends you a challenge which you sign with your private key, that the website can then verify using the public key that you used when enrolling the passkey. This way, a website never has any form of secret - making say password hash leaks less relevant, whereas in theory you could give your public key(s) and post it on Google’s homepage without any repercussions… but don’t quote me on that one.
So even if you use a password manager, if you still have a few websites that share the same password, and one of those gets compromised - those other websites may still be vulnerable which wouldn’t be possible with a passkey.
If you use a password manager like bit warden, on a compromised machine, the credentials used to log into a site, could get copied. Then somebody else could log into that site as you.
Using pass keys, or hardware security keys means the private information never goes over the internet. So somebody who’s compromised the system, still doesn’t get the private key. So they can’t impersonate you later
When you visit a website you’d like to login to, your browser generates a public/private key pair and gives the public key to the site.
When you want to login:
The browser uses the website domain name to generate a challenge and sends it to the website.
The website verifies the challenge by sending back a randomly generated long text, encrypted with the public key.
Browser confirms by sending back the decrypted text as proof.
Now both website and browser are sure the other is legit, there are no passwords involved, the login process is standardized and can be upgraded with new protocols and cyphers whenever needed, you can’t be phished, you can’t be tricked by a fake domain that looks in Unicode like the correct one, and if anybody breaks in and steals the public key they can’t do anything with it.
The main advantage is that, like hardware security keys, they’re immune to Man in the Middle phishing attacks, but are far simpler to use so should hopefully see much more widespread use.
uh. for the slower ones… how does this improve security? 🤔
edit. thanks @[email protected], @azron, @[email protected] i still dont really get it, but feel confident to trust you guys on this one.
My understanding is:
Passkeys are like a password + 2FA mashed together. If someone steals your “passkey password” they still can’t use it to login without the hardware component. That means phishing is harder. Since passkeys are generated for the user from their hardware it also forces better hygiene on the user by not allowig any password duplication.
A downside is it is tied to hardware and a provider that can cause problems witb loss of device or when you change devices but it is hard to say how painful that is going to be.
[edited for a bit more clarity]
but butwarden already makes phishing impossible, and even if someone gets the password, they don’t have the 2fa?
It’s more about supporting a new standard. Plenty of folks are using same credentials everywhere, and passkeys could potentionally change that. Also, entering 1 thing is easier than entering 2.
Continuing on what Rolling Resistance said (sorry for the delay, had to step away for a while), I know plenty of people who do use a password manager and still use a static password in some places (hell, I’ve been guilty of that in a few places - but generally on network-isolated systems). Some people also don’t use 2FA because they find it inconvenient.
Passkeys are more or less very similar to how SSH keys work if you’re familiar with those, your device (or password manager) generates a secret key that it only has access to, and then gives the public key to the website (and a new keypair is generated for every single website). When you login to a website, the website sends you a challenge which you sign with your private key, that the website can then verify using the public key that you used when enrolling the passkey. This way, a website never has any form of secret - making say password hash leaks less relevant, whereas in theory you could give your public key(s) and post it on Google’s homepage without any repercussions… but don’t quote me on that one.
So even if you use a password manager, if you still have a few websites that share the same password, and one of those gets compromised - those other websites may still be vulnerable which wouldn’t be possible with a passkey.
If you use a password manager like bit warden, on a compromised machine, the credentials used to log into a site, could get copied. Then somebody else could log into that site as you.
Using pass keys, or hardware security keys means the private information never goes over the internet. So somebody who’s compromised the system, still doesn’t get the private key. So they can’t impersonate you later
Passkeys are client-driven.
When you visit a website you’d like to login to, your browser generates a public/private key pair and gives the public key to the site.
When you want to login:
Now both website and browser are sure the other is legit, there are no passwords involved, the login process is standardized and can be upgraded with new protocols and cyphers whenever needed, you can’t be phished, you can’t be tricked by a fake domain that looks in Unicode like the correct one, and if anybody breaks in and steals the public key they can’t do anything with it.
This is the best primer that I’ve found: https://www.eff.org/deeplinks/2023/10/what-passkey
The main advantage is that, like hardware security keys, they’re immune to Man in the Middle phishing attacks, but are far simpler to use so should hopefully see much more widespread use.
but it one would use a security key for the butwarden login, all of thst is pointless, no?
That is different kind of protection. 😄
The phishing protection is still very valuable. Also presumably you’d protect your Bitwarden account better than any number of random sites.