Meanwhile, half of the people at every company I’ve ever worked at:
The worst part of the left one is the implication they have only two passwords. The “under the keyboard” part at least requires physical access and (hopefully) means its not something stupid or short like “p@ssw0rd”.
I have yet to see a sticky note password that was anywhere near NIST compliant lol.
NIST compliance is 15 characters. That’s it. No stupid cycling every three months. No stupid special characters.
Somebody finally read the XKCD comic.
my workplace makes us change passwords every 3 months and I don’t respect them so its the same password with the same number at the end -1 because I can’t be bothered. If I get hacked oh no ive dealt damage to a multi billion dollar corporation woe.
I have a system of using month and year plus a common trailing string. My annoyance is that every year the last number on the year keeps moving.
I wonder why passphrases fell out of style? If you remembered a series of random words like you were activating the freaking Winter Soldier, boom, 40+ characters!
If we take the EFF wordlist commonly used to generate passphrases, we have 7776 words. If we take ASCII alphanumerics and special characters we have about 92. Assuming we generate a NIST compliant password of 15 characters in length we get 92^15=2.8*10^29 of combinations. To get the same level of security (same number of combinations) using the EFF wordlist we need (log(2.8)+29)/log(7776)=29.45/3.9=7.6 around 8 words. If we assume the words are 7 characters long on average, plus the separators, we get 7*8+6=62 characters long. If we start to also include Unicode characters like other scripts or emojis (something I’ve recommended to others) the required number of words grows even more. I don’t know about you, but I can’t be bothered to type that all out every time, a password manager works for me.
Yeah, that makes a lot of sense. I guess I meant for things where you need to actually memorize a password, like for the password manager.
But yeah for 99% of cases, a backed up KeePass database with randomly generated ridiculous passwords for every little service is fantastic. 👍
I can memorize the 8 words though, which is why I use that method for anything where I can’t use keepass.
Did they ever get into style. I use them, but I don’t know anyone else who does. And some sites make diceware passphrases harder to use by e.g. requiring you to add numbers, special characters or capital letters, or by banning spaces. Or by banning non-ASCII, which makes it harder to use diceware passphrases in other languagess than English.
Ain’t it 8 characters, and 15 for machine accounts?
I just read it yesterday but maybe it was an older entry
The “under the keyboard” part at least requires physical access
That’s fine at home. Not so great in an office, though
I agree, but if I had to choose between someone reusing passwords and someone who kept them under the keyboard I’d probably choose the latter
You can’t fit that many post-it notes under the keyboard though, so if they’re doing the latter they’re probably doing the former
This is why passphrases are better than passwords. So the “Under the keyboard” can be used as password. It has 3 out of the 4 types to match complexity and plentiful for length. And so much easier ro remember. It could be also a quote from your favorite movie or book, part of a lyric of your favorite song, etc.
So at a customer I found the following note. At the desk of an employee with the last name “Sun”:
“‘Sun’ is user name and password!”
I wonder why we use passwords at all.
Woah now what about changing 1 to !
I will take a stanza from a song, use the first letter from each word, switch the S to 5 or $ as an example, and make sure I have two uppercase, two lower, two numbers. and two special characters, 8 minimum, although now it runs about 13.
I hum as I type in my password. All I have to remember is how I typed it out.
Come at me, dictionary cracks. The result is bonkers as fuck, but I loved that stanza. I have passwords I have used for 20+ years.
My coworker who sits next to me recently commented to me that I always hum the same tune when I log into my computer. Then he mentioned I hum a different tune when I log into the proxmox.
My sticky note would be like:
computer - Local H
proxmox - Sonic Youth
mail server - Future of the Left
NAS - Faith No More
Inventory - Slothrust
etc.
Holy $#!7111
Alt joke:
Thanks for the tip! My password is now…
hunter2I feel more secure already. :D******* you say?
Oct0ber2026!
That’s why you should never change your password. No one will think to guess @utumn2O23 in 2026.
I have a nice notepad from a conference on my desk labelled “Passwords”
Usekeys are a pass. Trap them!
Them pass a use, keys are!
I like you 🤣
The biggest problem I see is that it requires OS or browser integration. While possibly a better solution than simple passwords this feels like a vendor lock-in scheme.
You could store them in your password safe if it supports them?
Potentially the server can request hardware/software attestation that would limit the choice of password safe to approved ones only. We don’t yet know how big/likely this could be, but in theory it’s possible.
well, if I’ve seen a vendor lockin before, and I’ve seen a couple, they’ll push them with open standards until they’re accepted and normalized.
Then suddenly the big players like Google and Microsoft will block all the open platforms sighting “security” forcing businesses to adopt closed proprietary versions while touting their free and easy too use platforms.
then the monitize it.
they can already force your to install their app to receive a push notification (cough… google…cough…). if they really want to lock you in they will. passkey or not.
You don’t remember them you are not expected to moving from iOS to Android lets say generate new ones for your new device.
They really aren’t a trap. They’re a well designed standard. The tooling around them isn’t quite perfect yet, but they’re a huge improvement over passwords.
People upvote because they hate change.
People upvote because they hate change.
People upvote because big tech has a tendency of forcing the most anti ownership outcome possible on everyone. Here, such an outcome likely would be mandatory passkeys that are set up to require hardware attestation.
One way to reduce that risk is to boycott passkeys until TPM and hardware attestation is removed from the standard. You may not think that’s a fair response, or that such a boycott won’t save us from the inevitable outcome, but nevertheless it’s not a completely irrational reaction.
This is what people seem to be missing, I haven’t seen a rebuttal to this problem.
This is the article that converted me into a TPM hater: https://www.gnu.org/philosophy/can-you-trust.en.html (And SystemD hater, since Lennard Poettering was employed by Microsoft for a while, the ones that control the TPM default signatures, and now apparently tries to get Linux to use secure boot signing everywhere. Very suspicious.)
Like, yeah, GNU/FSF tend to be radical with many opinions and that’s not everyone’s cup of tea. But I feel like this article has a point.
And also until the committee designing it has it members on it representing the interests of users. The point that this was lacking in the original is-a-trap article is an important one and is also being missed.
I’m just not convinced that mandatory hardware attestation is actually a real problem we need to worry about.
Like, yes, people with high security jobs will have that for sure. And they should.
But large companies that want customers? They want to make it as easy as possible for their customers to connect. They’re not going to force people to have a hardware device which if damaged or lost will lose them a customer. That’s just not what they want.
And yet, it’s there.
Embrace, extend, extinguish as in literally every single corporate case. Thousands of rug pulls later and we still haven’t learned our lesson.
In this case: first get people in the door en masse, then expand the requirements for things like hardware attestation in a transition period, then vendor lock people.
Adobe would never move to cloud only, that would lose them customers.
See: Literally every single API rug pull ever. Reddit, Unity, etc… Get people using the API and infrastructure, then switch from free to huge fees.
See: cloud companies giving good deals for storage and then charging massive fees for output bandwidth to access or move that data
See: VMware rug pull
This is the exact same except they are telling us what they are going to do from the start. When someone tells you how shitty they are, listen.
But large companies that want customers? They want to make it as easy as possible for their customers to connect. They’re not going to force people to have a hardware device which if damaged or lost will lose them a customer. That’s just not what they want.
I would say this is already proven to be wrong, since Microsoft Windows appears to be already doing exactly that with the special hardware device “TPM”: https://rossmanngroup.com/services/encrypted-data-recovery/bitlocker …in regular customer machines.
The TPM exists because it’s useful to support use cases where you want your passkeys tied to a device. It isn’t a Microsoft thing either. I run Linux - my computer has a TPM. I can’t use it because Linux support for the TPM is weak still, but it’s there! You probably have one too if your computer was made in the last decade.
By default, even on Windows, your website passkeys aren’t stored in the TPM. No one is forcing you to store your passkeys on the TPM.
And they won’t, because it’s a bloody stupid idea that benefits no one.
Microsoft wants your passkeys synced across devices because that’s how you get lock in. If the passkeys are stuck on the computer you made them on, then you may as well buy a Mac for your next computer because those passkeys are gone either way! If the passkeys are in Microsoft Password Manager though, now migrating to a Mac is harder.
Oh I know I have a TPM, yes. I blacklist all the Linux TPM modules though. Screw that thing.
It seems to me that the definition of attestation in the passkeys standard is the exact same as HTTPS certificates, which is not bad at all and nearly impossible to rug pull?
I would argue that is different because an Https server doesn’t scale as much as a user login. Also, as someone that had to rely on things like “letsencryp” free certificates for personal servers, this is so annoying to setup and I hate that security needs a third party having to give me something for free and be able to stop giving it at any moment.
I do get the point on servers, is annoying but adds security to people visiting webs. but making this also a problem on the user login side is exactly why people hate this shit, and doesn’t add any security for the users.
Passkeys officially have TPM support: https://www.w3.org/TR/webauthn-2/#sctn-tpm-attestation Let’s Encrypt doesn’t require a TPM. Passkeys can apparently require an actual closed-up DRM anti user hardware component to sign what you’re doing.
While Let’s Encrypt requires an external party for signing, 1. it’s not something the average citizen needs or uses a lot, unlike potentially passkeys, 2. there is no variant of it that works via special DRM hardware that they try to establish everyone as having.
Also, Let’s Encrypt is a non-profit while the common Passkey server-side storage vendors don’t seem to be.
Anyway, that’s just my opinion.
there’s formats other than TPM like Apple and FIDO U2F, so I don’t think Apple, Yubikey (which chairs the standard’s working group), and the password manager industry (which already does passkeys) would just let that happen.
i am not convinced regarding TPMs
i am not convinced regarding TPMs, and I agree with the FSF on 90% of other things they say. the essay assumes that making a DRM-free copy will be made hard enough that it’s very impactful (“no excuse for the system” doesn’t really faze me). (c.f. PDFs already technically support prohibiting copying. Nearly all PDF readers support overriding this feature. c.f. email read receipts. c.f. the massive multieclecticism of software to open the same type of document and the aging hulk that is most companies’ IT infrastructure. c.f. “Microsoft quietly extends Windows 10’s extra security updates program for free”.) even if that somehow does happen, partly thanks to how inconvenient that’d make sharing and how companies often need a dozen people to access the same document, there will be somehow a way to share keys.
on that note (of my last sentence under the spoiler), you’ve also missed the point of https://lemmy.dbzer0.com/post/76949971/28679239 , which is not the first paragraph.
it’s not something the average citizen needs or uses a lot, unlike potentially passkeys
i would certainly say the average citizen uses HTTPS a lot
Let’s Encrypt is a non-profit while the common Passkey server-side storage vendors don’t seem to be
(context for onlookers: Let’s Encrypt is the most popular certificate authority, while the analogous to attestation is the concept of certificate authorities and not any one certificate authority.)
Let’s Encrypt was only founded in 2012 (and announced 2014) with general availability in 2016, while the current HTTPS standard with certificate authorities had been around since 2000. Passkeys, 2021. I think fairness is something the world needs.
Let’s Encrypt was only founded in 2012 (and announced 2014) with general availability in 2016,
I wouldn’t agree HTTPS was unproblematic before Let’s Encrypt existed, so I’m not sure where you are going with this. The average person doesn’t need a HTTPS cert issued, which I would say is comparable to the average citizen using a passkey. If only some spaces, e.g. enterprise, use them then it’s not a real problem. But that’s why it seems problematic to me once passkeys are pushed for general use.
you’ve also missed the point of
I don’t think that I did, but my apologies if that is the case.
no, i was saying Let’s Encrypt solved HTTPS’s problems. before it HTTPS had the problems people claim passkeys’ attestation certificate chain has. it is very possible an authority equivalent to Let’s Encrypt will come about within the 16 years after 2021.
the average person doesn’t need an passkeys certificate issued either. using a passkey is the equivalent of HTTPS’s TLS packets, not making a new certificate.
it is very possible an authority equivalent to Let’s Encrypt will come about
So why shouldn’t we tell people to boycott the tech until then? Even then, that doesn’t solve the threat of a hardware attestation toggle.
using a passkey is the equivalent of HTTPS’s TLS packets
I disagree.
I only dislike the ability for service providers to enforce a “security level”. Those should be the exclusively under my (the user) control. Sending preferred default (hints) would be cool, but not enforcement.
That a webpage can basically prevent me from using a passkey if the passkey is stored in software (a password manager for example) is complete bullshit. Especially if there is still username/password as alternative which is clearly worse. Sure, hardware tokens are the ultimate security. But it should be up to me and not them if I want that level of security.
But they already do enforce a “security level” for passwords through minimum character counts (e.g. must be at least 8 characters long), specific character requirements (e.g. at least one upper case + lower case + number), rotation schedules (e.g. must be changed every 90 days), etc. Some even enforce password sharing (e.g. Netflix IP/geolocation checks).
Yeah and certain password requirements are also dumb. But at least they still give me a degree of freedom how to generate the password and how I store the password.
Second factor is sometimes worse than Passkeys; with vendor specific apps (Steam Guard, Blizzard Authenticator, Microsoft Authenticator, etc) instead of following standard TOTP. But still. I want agency over my credentials.
I fucking love passkeys. I hate 2FA on every god damn website, but clearly the majority of people are too lazy/stupid for passwords alone to work in a time when phishing is so widespread. My only problem with them was that I couldn’t use my Bitwarden passkeys in Firefox for Android, but they fixed that, and I’ve never had a bad experience with a passkey since.
This has actually been a really good discussion on both sides as I think many including myself didn’t know about some of the inner workings of them. I’m glad the discussion happened. The trap article IS worth a read, it’s overly long but is really well written. After reading enough about both sides though I don’t think I’m too worried and will continue using them.
I’ve honestly not seen any benefits over passwords.
If I want to check my mail on a library computer, I can type in a password and I’m in. If it’s using passkeys I need an already logged-in smartphone - which I probably don’t have if I need that library computer in the first place. That’s just one example.
Memorizing passwords doesn’t scale well.
You’ve likely got dozens of accounts. You’re not going to memorize a password for every account. Re-using passwords is a serious security problem though. Poorly secured sites get their password databases leaked all the time. If you use the same password on lots of sites, it’s basically a sure thing that the hashes are out there on the darkweb already along with your email, and your password is compromised.
Also, typing your email password into an unsecured library computer is a terrible idea. It is ridiculously easy for someone to install a keylogger and gather emails and passwords. In the past, your main protection was that it wasn’t worth anyone’s time to break into the computers, install keyloggers, collect lists of passwords, then figure out how to use them to get money. But with LLMs that can all be automated. It has become ridiculously cheap, and can be done by someone with a bot farm in Russia.
A password manager largely fixes the first problem, but at that point you need a device with your password manager with you to log in anyway. And the password manager doesn’t fix the second problem at all.
Personally I like Passkeys, and I enroll them in both my KeePassXC vault and on my two hardware keys (a primary Yubikey which I carry with me and a spare one at home).
It doesn’t absolve one from neglecting proper security best practices (don’t login on a system you don’t trust, logout / clear cookies when done, etc), but a Passkey on a hardware key is much more difficult to phish or extract if you’re using someone else’s computer.
Well if your using a pasword manger instead of easily remmbered passwords your screwed either way. And considering the fast majority of people use the same password eveywhere and use a simple passowrd they are a big improvement.
The trap is they’re pushing passkeys before password managers that make them portable are yet to be mainstream. And that platform lock in may be a motive driving it.
“To login to your account, please use the device assigned to your identity.”
Right now, if someone who doesn’t know about password managers starts using passkeys because of a few popups you just have to follow through to enroll, they’re going to get very confused when they try to login somewhere else. There may be alternative login methods for now, but that may change.
It doesn’t seem all that forced yet, but if we have any idea of how big tech works, that’s where it is going.
Passkeys are great, Big tech aren’t.
I use them with my password manager but I’m cautious on which services and how often i may need to login to them on other devices.
There is nothing or should be from the standard stopping you having multiple passkeys. One on your phone one on your pc. Switch devices create new passkey for it. It isn’t a password and people have to stop treating it as one. Now sites only allowing one is another issue.
Passkeys are greate as long you make sure you use a third party (partial) password app, like proton or bitwarden that works everywhere.
I think the worry is that if passkey attestation is required it will force people into a narrow set of authenticators controlled by the big orgs.
At this point in time it’s not a problem, but how can we know it won’t be in future?
Which most people don’t do.
They’ll learn like I did the hard way. Lol
Passkeys are awesome. Developers not following the standard properly are a trap.
Admittedly I didn’t read that one guy’s blog post very closely, but it seemed to claim that because some companies may some day misuse/abuse some features of passkeys, passkeys are poison and no one should ever use them.
Well if that’s possible, it doesn’t sound like a good basis for security.
The features they’re talking about are secure from a cryptographic standpoint.
However, there are features built into the passkey system so that a company could decide that it will only accept passkeys from a specific piece of hardware or software.
This isn’t necessarily bad, you may only want your server to allow you access if the passkey comes from your phone’s hardware. A person could have stolen your passkey but they’re unable to fake the attestation step.
On the other end of things, a company like Google could provide a passkey service which requires you to use hardware provided by vendors that they approve of and they could abuse their position to force it’s implementation, such as how you can use Google to sign into websites via OIDC.
Google could just as easily provide a service for ‘secure’ passkeys which are only allowed to be issued by phones provided by Google, Verizon or AT&T. No more third-party OSs (at least, if you want to sign into anything on the Internet) and no more jailbroken phones. You would have to use the exact, spyware laden, operating system that comes installed directly from your cellular provider who would have remote root access to your device.
I think the idea that we can just boycott passkeys and prevent this is nonsense magical thinking. It requires some hypothetical world where we can perfectly coordinate a boycott of otherwise useful technology. In reality this issue will remain obscure and generally only known to people interested in the topic while Google can pour tens of millions in advertising to reach everybody on the planet explaining how good and secure attested passkeys are to mainstream Internet users.
Use passkeys, they’re useful and more secure than passwords. Not using them won’t prevent enshittification, just sit back and watch the slow motion attested passkey trainwreck as it unfolds over the next decade.
I’m gonna need to find this comment in ten years. Wish me luck
Please provide a blood sample to verify your Age. Thank you for using Open FaceGoogazonthropic, we love you.
This isn’t necessarily bad,
I’m of the opinion that it is bad, from the perspective of the user. They are now locked into that company. It not bad from the perspective of the authentication provider, and the service provider may get a positive outcome of it from fewer breaches due to bad passwords.
The problem is the authentication provider isn’t trust worthy.
It’s a very basic principle, that you don’t create powers that could be abused. That they haven’t been abused yet does not make doing so ok. It like saying it’s ok that my government was given the power to lock people up with no reason or due process because they haven’t used it yet.
Another point someone brought up in one of these posts: the remote attestation (IE locking your passkeyto a specific app or software) issue is highly unlikely to be used for public websites, because it would block / halt the adoption they’re trying to promote, and its against their interest. No website that I know of has done this for TOTP either.
They push TOTP and passkeys now because they want to avoid the costs and support around resolving hijacked accounts, and password phishers.
The use-case for remote attestation is a valid one also: say you have a really secure internal system that you want to lock down to only users of your specific passkey validator, and make sure its that specific app, unspoofed.
so whats a passkey and how is it different from a password?
It’s essentially just public key cryptography streamlined to reduce friction for the user. When you’re prompted to create a passkey for a service a new public/private keypair is created. The private key can then be synced to other devices for example via the iCloud keychain or Bitwarden. Obviously you have to then trust that provider to keep your keys safe. The upside is that your passkey can be automatically discovered and used to sign in without using a password. Alternatively the private key can be device bound but the downside is that if you lose the device you lose the private key too.
If it was just to helpfully reduce friction, it wouldn’t be so controversial. The inclusion of any sort of TPM and hardware attestation support at all is what has some people sounding the alarm (in my opinion rightfully).
It’s mainly controversial because the actual use contradicts its purpose. Passkeys are phishing-resistent, which is still the main risk for password in real world scenarios, and are a good idea.
But the websites supporting it put out big warnings when you don’t have another method to login configured. And they don’t actually advise you how to backup your passkey and keep it safe, but instead want you to set up an alternative way to login or recover your account. Which totally defeats the purpose in the first place.
Quite the contrary: “there is a problem with your passkey/account, please use the recovery method you set up” even makes for more convincing phishing. So why are they pushing for passkeys when it isn’t for security reasons?
This is, imo, the bigger issue. No clean way to export and move passkeys around, even between the open source options like Bitwarden and Proton Pass or as plain backups…
Because of this discussion (and because I hadn’t looked at passkeys for quite a while), I did some testing…
And passkeys integrate seamlessly into my keepassXC to get backed up with all my regular passwords. So software- instead of device-based passkeys that can be properly transfered, synced or backed up work…
The problem is that tech-minded people that use password managers and think about security and backups are not the primary target group that passkeys should protect from every-day phishing attempts in the first place. And when it’s supposed to protect the common user effectively and conveniently/frictionless but then instantly destroys the effect by advising to set up another login method it makes no sense.
Maybe I should have clarified, you can’t export from Bitwarden into KeePassXC or vice versa. Imagine you have 100 passkeys and you want to switch your passkeys manager. Unless something has changed drastically in the last few months, this was impossible
Are you sure about that?
When I open up the import function in KeePassXC I can pick 1Password(.opvaul), Bitwarden(.json), Proton Pass(.json) and a couple of other file formats.
PS: Oh, wait. That only works for the passwords while passkeys simply get ignored? Okay, that’s dumb.
My post was only meant to be a quick explanation of what passkeys are so I’ll leave it as is. I do think it’s healthy to be suspicious of big tech corporations and their motivations though so I’ll be doing some further reading.
That passkeys are a trap article also has straight up one of the best explanations what passkeys are https://nonfunctional.substack.com/p/passkeys-are-a-trap-do-not-use-them
A passkey is cryptographically signed by the server when it’s created.
So it does not only has your credentials encrypted which are then used to login to a server, but it also carries information about the server and only that server can request the credentials from the passkey. So unlike a password a passkey is resistent to phishing attempts as you can’t actually give your credentials away to anyone but the actual server it was created for.
Or “Like all questions of security vs convenience, a user should decide what they are or are not comfortable with.”
I think the reason passkeys are so controversial is that tech has a long history of ignoring user choice and pushing the most anti ownership solutions possible. Therefore, I think there is fair concern emerging along with any new mechanism that has any sort of TPM or hardware attestation components at all.
The concern is valid, but we should also look at these company’s interests in pushing passkeys, which first and foremost is avoiding all support and resources they have to dedicate to password resets and account hijacking, of which TOTP was the band-aid for, which they also push.
The software or hardware attestation is IMO a non-issue for most public sites. We have a precedent in TOTP, and they haven’t locked those down either to specific software, because they care more about adoption (to avoid the costs above) than controlling what software you use to validate.
If someone wants to say that these companies will turn on this attestation for passkeys in the future, and break a ton of logins and decrease adoption, then they should have a reason why they haven’t done so for TOTP.
Passkeys are a good idea to prevent phishing. Using passkeys but then require a second method to login as a backup to prevent lockout when you lose your key (as many sites do) is epic bullshit. It makes an actual security improvement into some convenience feature so people don’t need to remember/type passwords anymore. Because the phishing will now ask for the alternative/recovery login to fix some alleged problem with your account/passkey…
So it suddenly does not provide additional security anymore above what a password manager would already do.
When you sell somehting as a security feature then instantly defeat the additional security to make it just about convenience the question about the actual goal feels natural…
Passkeys: don’t stop them Passkeys: don’t, stop them
the duality of passkeys
No duality: only suck
What a shitshow
Again with this?
I’m going to do the smart thing, get drunk and pass that key to a designated driver and let him figure it out.Seems like if you want something to be able to be unlocked, you’ll need a key.
It’s the typical case of perfect being the enemy of good.
