I like passkeys*

[whitequark@social.treehouse.systems]

I like passkeys*

* resident, non-hardware-token-based public key authentication mechanism for websites and Android apps, not to be confused with other things also called "passkeys" indiscriminately

[theartlav@anarres.family]

@whitequark Hm, are they actually removable once installed?
Like, if that phone flies down a cliff, would i typically still be able to log in with the password on a new device or a computer?

[whitequark@social.treehouse.systems]

@theartlav yes (otherwise I would not use them as I value availability far more than security)

[whitequark@social.treehouse.systems]

all of my passkeys* live in a KeePassXC database and I am both safe from phishing and from the services becoming unavailable because I lost a hardware token, which is why I like them

[dlakelan@mastodon.sdf.org]

@whitequark
so, like, who has these things and how do they work? they send you a nonce and you sign it?

i haven't seen this as an option on any site or within keepassxc but I haven't been looking either.

[whitequark@social.treehouse.systems]

@dlakelan you have to enable it within the keepassxc browser extension; most major webtech companies (starting with google) have been pushing passkeys for a while

cryptographic details are explained on a high level here: https://www.passkeys.io/technical-details

[magnetic_tape@infosec.exchange]

@whitequark
I get the lost hardware token situation which is bad, but IMO the underlaying issue is that there's not many services that accept more than one hardware token which is a shame. Having at least two token registered, where one is with somebody at all time and the other one in a safe and is never out unless the first one is missing, would fit many threat models (not all, granted)

[whitequark@social.treehouse.systems]

@magnetic_tape I agree with this in principle but personally since the effort to register/replace one hardware token is already too high, two is worse, not better

[dlakelan@mastodon.sdf.org]

@whitequark
got it. my impression was these required some TPM and or proprietary stuff from windows etc I was treating them as trash. but if keepassxc can be the secure store I am on board

[whitequark@social.treehouse.systems]

@dlakelan a lot of people have this misconception thanks to some enormous communication failures by the big tech companies. the underlying technology is fine, it's just described in a completely unhelpful and misleading manner

[dlakelan@mastodon.sdf.org]

@whitequark
yeah my impression was a third party holding keys or proprietary hardware stuff was how they work. if you think I'm gonna let someone else have all my keys then forget it. but yeah I'll be looking for the keepassxc browser extension settings now... thank you for clarifying this

[lnl@screaminginsi.de]

@whitequark you can still lose your KeePassXC database or missync it

[whitequark@social.treehouse.systems]

@lnl i have hourly backups and multiple replicas within a literal arm's reach

[claudius@darmstadt.social]

@whitequark same here.

[gibwar@infosec.exchange]

@whitequark I want to like them, but when I recently went to go register a different hardware token to my Google account it decided that Firefox on Linux isn't supported to register a passkey, so I got locked out. I'm now in the process of removing my passkeys from other accounts since I can't trust them. That and Microsoft's dark pattern of forcing you to enroll one on login if you don't have one.

That being said, I also want a clean export opportunity. The fact that KeePassXC supports them gives me a little hope but I would like a format that I can export, archive, and import in to another program without having to do some double fiddly import/export on my phone or whatever. I think the latest Apple iOS version lets you transfer between apps using their own propitiatory process but I want something cross platform.

[whitequark@social.treehouse.systems]

@gibwar I think sites can and do sometimes place additional (mostly ridiculous) requirements, Google being the main one in my experience; but then if you don't trust the website it's kind of a lost cause to expect it to reliably authorize you

KeepassXC does let you export passkeys but I can't tell if it's a standard format or if there is even a standard format

[david_chisnall@infosec.exchange]

@dlakelan @whitequark

The downside of a pure software implementation is that a kernel vulnerability can still exfiltrate all of your keys. Hardware (including TPM)-based implementations are robust against this because the kernel can ask the device to do the signing, but that only allows online attacks: while someone compromises your machine, they can log in as you, but they can't exfiltrate your credentials.

Apple's design is nice because the keys are resident only in the secure element, but they do have a flow for copying them to another secure element (encrypted with a key that's negotiated during the exchange), but that locks you into their ecosystem.

The problem that they're trying to solve is a very hard one: How do you make it easy to copy your keys to another device but make it hard for a malicious person to force or trick you into copying the keys to their device? This is relatively easy within a closed ecosystem, but it's much harder to do in an open model.

[whitequark@social.treehouse.systems]

@david_chisnall @dlakelan for sure, there is a tradeoff; in my nearly 20 years of actively being on the Internet I've been phisned 0 times and stranded in a country whose language I don't speak because of a stupid 2FA login issue... significantly more than that. so I don't value security all that much, and I think the focus on preventing key exfiltration at all costs (including a significant cost to availability) is both myopic in general and too easily turned anti-end-user

[dlakelan@mastodon.sdf.org]

@whitequark @david_chisnall

With Catherine 100% here. The number of times that I've had my Linux laptop or desktop kernel compromised is ZERO in 30 years while the number of times I've been locked out of my brokerage account because of a failed piece of hardware that was the only hardware 2FA they allow is non-zero in the last year. It would be significantly easier to catfish the fallback security overrides with the brokers on the phone than it would be to kernel compromise my infrastructure.

[siroj42@troet.cafe]

@whitequark It doesn't do it any more, but when I registered my Yubikey as a second factor on my Google account, it would for quite a while prompt me to use it as a standard passkey (as a replacement for, not in addition to, my password). So that has certainly diminished my view of their implementation.