this post was submitted on 14 Oct 2024
477 points (99.8% liked)

Privacy

31607 readers
1439 users here now

A place to discuss privacy and freedom in the digital world.

Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.

In this community everyone is welcome to post links and discuss topics related to privacy.

Some Rules

Related communities

Chat rooms

much thanks to @gary_host_laptop for the logo design :)

founded 4 years ago
MODERATORS
k_o_t@lemmy.ml
tmpod
Yayannick@lemmy.ml
ranok@sopuli.xyz
477
Bitwarden, Dashlane, 1Password and others have joined together to make passkeys portable (bitwarden.com)
submitted 2 days ago by soothing_salamander@lemmy.ml to c/privacy@lemmy.ml
57 comments fedilink hide all child comments
 

Looks like a huge amount of security vendors are working to have a secure and open standard for passkey portability between platforms.

It is always good to see major collaboration in the security space like this considering the harsh opinions that users of some of these vendors have toward many of the others. I just wish apps and sites would stop making me login with username and password if passkeys are meant to replace that lol.

top 50 comments
sorted by: hot top controversial new old
[–] unskilled5117@feddit.org 85 points 1 day ago* (last edited 1 day ago) (1 children)

Seems like people in the comments are misunderstaning the announcement entirely. This protocol is about import and export from password managers and not about having them synced between devices. It would prevent a lock in effect. This is a great development!

FIDO Alliance’s draft specifications – Credential Exchange Protocol (CXP) and Credential Exchange Format (CXF) – define a standard format for transferring credentials in a credential manager including passwords, passkeys and more to another provider in a manner that ensures transfer are not made in the clear and are secure by default.

[–] Petter1@lemm.ee 4 points 8 hours ago

Lock in effect of passkeys is just infuriating 😂good to see progress!

[–] independantiste@sh.itjust.works 34 points 1 day ago* (last edited 1 day ago) (10 children)

I don't like that passkeys are portable, this kind of defeats the entire purpose. The way they were sold to me is the following: it's 2 factors in one. The first is the actual device where the key lives, and the second, the user verification, like a pin, face scan, fingerprint etc. If it's synced across the cloud, there's no longer the first factor being the unique key on the unique device.

Granted, passkeys even without the first factor are still magnitudes better in terms of convenience and security compared to passwords, but it just disappoints me a little that there are no good options to save passkeys on my local device only, with no cloud sync.

If anyone knows of a local-only passkey manager app for android, as well as the same as a firefox extension, I'd love to know about it!

[–] mp3@lemmy.ca 33 points 1 day ago (1 children)

I guess you're better off buying a physical security key, which offers some guarantee that the keys cannot be exflitrated from the device.

[–] independantiste@sh.itjust.works 4 points 1 day ago (2 children)

I have one, but I use it as a second factor because it does not have a way of identifying me

[–] mp3@lemmy.ca 21 points 1 day ago (1 children)

Strange, my Yubikey allows me to authenticate using Passkeys just fine by entering the PIN that protects my stored credentials.

[–] Flying_Hellfish@lemmy.world 1 points 4 hours ago

I love my Yubikey but the older hardware versions can only store 25 passkeys, and I believe even the newer ones can only store 100. That seems like a lot until more sites start allowing passkey auth.

[–] nialv7@lemmy.world 7 points 1 day ago

Yubikey supports pin protection, the newest one even have a fingerprint scanner.

[–] arty@feddit.org 2 points 1 day ago

Loos like no one knows of Enpass

[–] ryannathans@aussie.zone 42 points 1 day ago (1 children)

If you don't want to sync your credentials with a server, why are you using a server based credential manager?

[–] independantiste@sh.itjust.works 4 points 1 day ago (1 children)

For 2 reasons:

  • I want to sync my credentials that cannot be made unique and revocable (ie passwords). I can have a single passkey per device, I cannot have a password per device for a same account. I also have to memorize a password, and I have hundreds that I may need to access while I am away and only have my phone.
  • I use one because currently I have not found a convenient way to save local passkeys on Android and my Linux PC.
[–] Petter1@lemm.ee 3 points 7 hours ago

You can save local passkeys using a local keepass file and keepassXC. No cloud needed.

[–] MangoPenguin@lemmy.blahaj.zone 15 points 1 day ago (2 children)

If they're not portable how would I for example login to an account while on my Desktop, if I set up the passkey on my Phone?

[–] ShortN0te@lemmy.ml 11 points 1 day ago (1 children)

You generate a second one on the other device.

[–] kautau@lemmy.world 11 points 1 day ago (1 children)

Assuming that all services you log into support multiple passkeys. My auto financing company doesn’t, for example

[–] Petter1@lemm.ee 1 points 7 hours ago (1 children)

Well, then it seems like they have not understand the idea behind passkeys, like so many..

[–] timbuck2themoon@sh.itjust.works 2 points 6 hours ago (1 children)

I'd like to see some documentation that says passkeys were intended to never be synced across anything.

Everything I have ever read is that it's basically asymmetric cryptography like ssh keys. You have a private one, generate the public and give it to the site. It stops reuse of passwords and site breaches become useless as the public key is useless for attacking an account on another site, etc. (well, besides whatever data was lost in the breach which is outside the scope.)

I see no reason to limit someone having the private key on their phone, their desktop, etc. Having to generate yet another passkey for every device is inefficient and would decrease adoption of this.

load more comments (1 replies)
[–] independantiste@sh.itjust.works 2 points 1 day ago (1 children)

There are already systems in place that allow temporary passkey sharing, for example with a QR code (CaBLE) https://www.corbado.com/blog/webauthn-passkey-qr-code

[–] Cyno@programming.dev 8 points 1 day ago (1 children)

Doesn't that imply you still have to open up your phone to temporarily share to your pc whenever you need it?

[–] independantiste@sh.itjust.works 3 points 1 day ago

Yes but when you are logged in, you can add the passkey that belongs to the new device to your account

[–] warm@kbin.earth 14 points 1 day ago (1 children)

Them being portable makes them actually useful though for me, unless there was a way to use them from a phone to login to a website on a desktop/other device.

Being able to login into a password manager and use a passkey is great, passkeys need to become mainstream to get everyone away from passwords, but they can't be locked locally onto one platform or you have issues. The regular joe won't be backing them up from their iPhones or whatever.

I don't see why a local option wouldn't exist though, perhaps they will come once passkeys have matured further.

[–] independantiste@sh.itjust.works 22 points 1 day ago (2 children)

I read the post more closely and saw that this isn't about syncing the keys across password managers, it's about transfering them to a different password manager/device. In that case I'm okay with the initiative. This is to prevent lock-in and I'm all for it.

load more comments (2 replies)
[–] Cethin@lemmy.zip 6 points 1 day ago

They should be portable. I don't know if they should be stored in the cloud though. Ideally you can open a password database in whatever application you want if you have the database and login information. Not allowing this is inconvenient and doesn't seriously increase security.

Having them not be portable ensures people use them less frequently. If I couldn't sync mine between my phone and desktop I probably wouldn't use it. The way I do it isn't built into my manager (KeepassDX), but I use Syncthing to keep it up to date on both devices. It'd be better if there was an official option for people bad with technology.

[–] soothing_salamander@lemmy.ml 5 points 1 day ago (1 children)

Admittedly, for some password managers, the passkeys are stored locally and are not accessible in the cloud unencrypted without the decryption keys that exist on devices you authorize.

This may still not make a difference for you though. For me, I consider passkeys, even stored in the cloud, to be enough for the vast majority, so I appreciate these vendors working to make passkeys more easy for the end user.

[–] independantiste@sh.itjust.works 2 points 1 day ago (1 children)

I agree and I still store my passkeys in proton pass, but that's more because there's no real option for storing them locally only. I really like passkeys and they make me optimistic about the future, it's just that I think the way they should work is that each device should have a passkey registered to an account, so that the access can then be revoked if the device was compromised. And it's even convenient in this way with the QR codes that you can use to temporarily share a passkey to then be able to add the new device.

[–] soothing_salamander@lemmy.ml 2 points 1 day ago

That's completely fair. Appreciate the discourse friend

[–] shortwavesurfer@lemmy.zip 4 points 1 day ago

Keepassdx is actively working on this

[–] LodeMike@lemmy.today 3 points 1 day ago

The user should be able to do whatever they want.

load more comments (1 replies)
[–] zerozaku@lemmy.world 10 points 1 day ago (2 children)

Why is the buzz around passkeys is back? I am seeing them way more often than they used to be. I think I have created passkeys for 2 apps and don't even know how that worked, it such a breeze that almost felt it wasn't secure lol.

In what ways the passkeys are different than authenticator apps?

[–] soothing_salamander@lemmy.ml 15 points 1 day ago

Passkeys are meant to replace password-based login whereas TOTP apps are only meant as a 2FA method.

[–] neveraskedforthis@lemmy.world 9 points 1 day ago (1 children)

Convenience and security.

Authenticator apps are still vulnerable to phishing, passkeys are not.

[–] ShortN0te@lemmy.ml 12 points 1 day ago (1 children)

With the ability to transfer passkeys, the attack vector phishing does not sound that far fetched. Tho i have not looked into the transfer process.

We will see i guess.

[–] Neon@lemmy.world 3 points 18 hours ago (1 children)

Idk, a SSH-Key is also transferrable, yet it's still safe

And given that Passkeys are essentially specialized ssh-keys, I don't see the Problem.

But I'd like to know it I'm wrong.

[–] ShortN0te@lemmy.ml 2 points 13 hours ago (1 children)

Why do you think SSH-Keys are safe against phishing? I mean it is unlikely, that someone will just send the key per mail or upload it somewhere since most ppl using SSH-Keys are more knowledgeable.

When you now get an easy one click solution to transfer Passkeys from one Cloud provider to another it will get easier to trick a user to do that. Scenario: You get a mail from Microsoft that there is a thread and that you need to transfer your keys to their cloud.

[–] Petter1@lemm.ee 1 points 8 hours ago (1 children)

The thing is, that you only have to share public keys and never private ones. So you can only phish public keys…

[–] ShortN0te@lemmy.ml 1 points 7 hours ago (1 children)

The thing is, that you only have to share public keys and never private ones. So you can only phish public keys…

How would you sync or transfer a passkey across devices without transferring the private key?

[–] AA5B@lemmy.world 3 points 5 hours ago (2 children)

That’s July question: the article even points that out. If previously the private key was in hardware, never exposed, but now it has to be available to software. Does it open any potential attacks?

Even if it is less secure, this is probably a good thing to prevent vendor lock-in. I know that’s one reason I rarely use passkeys

[–] Petter1@lemm.ee 1 points 4 hours ago

Yea, I strictly did not set up any passkeys until I got strongbox pro, to store it outside of apple walled garden. To get 2FA secrets was hard enough (had long time no macOS device, only iOS)

[–] ShortN0te@lemmy.ml 1 points 5 hours ago (1 children)

That was a rhetorical question towards the commenter since the discussion point was not understood.

[–] Petter1@lemm.ee 2 points 4 hours ago

I read it again and agree 😂

[–] Petter1@lemm.ee 7 points 8 hours ago (1 children)

I have my passkeys in my keepass file in my private cloud since about 6month using strongbox on iOS and KeepassXC on Linux. Sadly, not many websites support passkeys on firefox for linux desktop yet… Hope this helps!

[–] Yerbouti@sh.itjust.works 4 points 5 hours ago (1 children)

Lol, I'm a semi-noob and this sentence is really intimating.

[–] Petter1@lemm.ee 3 points 4 hours ago

Keepass is a style of encrypted file with a list of the passwords and the syntax is standardised. There are many apps/programs for any platform that offer pw management based on that file. I use keepassXC app on linux and strongbox on iOS since both of them are well integrated into the operating systems. On ios i use the webDav protocol to sync the keepass file on my server with strongbox app. On Linux I use nextcloud sync to mount my files on the server into linux and in keepassXC I have set it to automatically grab that keepass file on boot. Ah of course the keypass file is protected by a strong password, but this could as well be a hardware token like a yubikey. But if you have a yubikey, you just store your passkeys on that😂

load more comments
view more: next ›