Technology

Private keys on an anonymous, untraceable smartcard. PIN or Matching-on-card fingerprint for the second factor Everything else can go directly into the garbage bin

Would love for you to describe exactly how it's more complicated. From my perspective I click a single button and it's set up. To log in I get a notification on my device, I click a button and I'm logged in.

It's not skipping MFA cos some media can provide more than one factor.

E.g. YubiKey 5 (presence of the device) + PIN (knowledge of some credentials) = 2 factors

Or YubiKey Bio (presence of the device) + fingerprint (biological proof of ownership) = 2 factors

And actually unless you use one password manager database for passwords, another one for OTPs, and never unlock them together on the same machine, it's not MFA but 1FA. Cos if you have them all at one place, you can only provide one factor (knowledge of the manager password, unless you program an FPGA to simulate a write only store or something).

That was my take too.

Security training was something you know, and something you have.

You know your password, and you have a device that can receive another way to authorize. So you can lose one and not be compromised.

Passkeys just skip that "something you have". So you lose your password manager, and they have both?

I find phones the least secure devices simply because of how likely they are to be damaged or stolen

I love storing 2FA in the password manager, and I use a separate 2FA to unlock the password manager

If we all had big passwords, this may not have been an issue to begin with lol

Any of the multi-platform password managers that support pass keys will solve this.

You walk into the vault on every platform and your pass keys are magically shared between every platform you're logged into.

In any system that I've used pass keys for (which is every system that supports them), you can go into the password section and delete devices/passkeys.

To regenerate new passkeys they either support it directly in the spot where you deleted it or you log out log back in with username password and 2FA and it asks you again if you want to set up a passkey. I've not run into anything else.

The only way I ever used passkeys is with bitwarden, and there you are sharing them between all bitwarden clients.

From my very limited experience, pass key allows to login faster and more reliable compared to letting bitwarden enter passwords and 2fa keys into the forms, but I still have the password and 2fa key stored in bitwarden as a backup in case passkey breaks.

To me, hardware tokens or passkeys are not there to replace passwords, but to offer a faster and more convenient login alternative. I do not want to rely on specific hardware (hardware token, mobile phone, etc.), because those can get stolen or lost.

I think that passkeys are simple, but no-one explains what they do and don't do in specific terms.

Someone compared it to generating private/public key pairs on each device you set up, which helps me a bit, but I recently set up a passkey on a new laptop when offered and it seemed to replace the option to use my phone as a passkey for the same site (which had worked), and was asking me to scan a QR code with my phone to set it up again.

So I don't know what went on behind the scenes there at all.

you can't just share passkey between your devices like you can with a password

Either you enroll a system that shares them between devices without the need for special interaction (password manager, iCloud etc) or you enroll each device separately into your account.

You can have more than one passkey for a service. This is a good thing.

Yes, use a password manager to store your passkeys.

Passkeys are a solution looking for a problem that hasn't been solved already, and doing it badly.

You say that and then

hoping every service they log into with "password123" has it's own TFA. And since nearly every site uses shit TFA like a text or email message

That’s literally a problem passkeys solve and password managers don’t lol

As I understand it (and assuming you know what asymmetric keys are)...

It's about using public/private key pairs and swapping them in wherever you would use a password. Except, passwords are things users can actually remember in their head, and are short enough to be typed in to a UI. Asymmetric keys are neither of these things, so trying to actually implement passkeys means solving this newly-created problem of "how the hell do users manage them" and the tech world seems to be collectively failing to realize that the benefit isn't worth the cost. That last bit is subjective opinion, of course, but I've yet to see any end-users actually be enthusiastic about passkeys.

If that's still flying over your head, there's a direct real-world corollary that you're probably already familiar with, but I haven't seen mentioned yet: Chip-enabled Credit Cards. Chip cards still use symmetric cryptography, instead of asymmetric, but the "proper" implementation of passkeys, in my mind, would be basically chip cards. The card keeps your public/private key pair on it, with embedded circuitry that allows it to do encryption with the private key, without ever having to expose it. Of course, the problem would be the same as the problem with chip cards in the US, the one that quite nearly killed the existence of them: everyone that wants to support or use passkeys would then need to have a passkey reader, that you plug into when you want to login somewhere. We could probably make a lot of headway on this by just using USB, but that would make passkey cards more complicated, more expensive, and more prone to being damaged over time. Plus, that doesn't really help people wanting to login to shit with their phones.

It uses asymmetric cryptography. You sign a login request with the locally stored private key and the service verifies the signature with their stored public key. The PIN on your device is used to unlock access to the private key to sign the login request.