- cross-posted to:
- linux@lemmy.ml
- cross-posted to:
- linux@lemmy.ml
A rebuttal to an anti-passkey, pro-TOTP post that has made the rounds on Lemmy as well.
You must log in or register to comment.
“TOTP is phishable.”
i can safely say both articles were made by insane people. all i can say is, to keep using generated passwords and offline 2fa codes. dont click on the naked lady in the spam folder.
have a good night, kids.
Not much of a rebuttal imho. We still have the problem that passkeys are ok in theory, but in practice they’re being pushed as a way to increase lock-in and don’t offer compelling advantages over well-managed passwords.
But that’s exactly the problem. Those that were the target audience for the article do not have well managed passwords. For them the passkeys arguably do increase security, while having a bit more “lock-in”.
For those that have well managed passwords (like probably most in this community), they are perfectly fine to use because they don’t have lock-in either. I have full control over my used passkeys.
Basically you’re not getting the “normies” to use proper password management, and for them they do provide additional security and convenience. They can always add more passkeys on different vendors, you’re not limited to just 1 per service. Yes, adding them is a hassle, but so it’s managing passwords and following higher security standards in general.
But most people don’t have well managed passwords. And me having good password hygiene doesn’t stop my data being hacked when someone working at a subcontracting firm to a company I use leaks all my data.
It also is annoying to have to log in over many steps with 2fa, often forced to email or SMS.
Collectively improving security benefits us all.
Passwords are protected (for now) by the first amendment. You can’t be compelled to tell what it is. Passkeys can be seized with a warrant. This only matters in the US but it does matter and I literally never see that addressed.
First time I am reading people orate their passwords🤣😂🤣😂🤣
Now you’re going to tell me the US has free press🤣😂🤣😂🤣🤣😂
The author of this post works in Apple, Passwords team. They do not deny that there’s attestation; they argue that it’s only used to prevent bad actors.
Cool, we’ll trust corporations then!
Corporations never, ever, act badly!
It is not like they are treated as people with rights but fewer consequences for their actions, right? Right, guys?
Hmmm, for someone complaining that another post makes logical leaps, this one has a pretty glaring contradiction that severely undermines their own argument:
The post is predicated on the idea that a feature of WebAuthn called “attestation”, which is only used in high-assurance and usually corporate scenarios, and usually with physical hardware security keys, will be leveraged to hurt people, somehow. The post posits that a website like X will bait and switch users: first, you get a passkey. Then, later, scary “attested” passkeys! This simply isn’t possible to do because attestation isn’t supported on the web for mass market, consumer authentication. Attestation for passkeys (software-based, syncable credentials) is antithetical to their mass market goals, and would freeze out independent, non-corporate-backed credential managers. It’s an explicit non-goal of the designers of passkeys, who work together in a forum anyone can join. And trust me, websites and apps like banks repeatedly asked for attestation at the beginning of the industry’s passkey journey. The platforms, browsers, and credential management apps have held firm that the goal of passkeys is reducing phishing and not some kind of trusted computing scheme. (And I will note: over my dead body!)
In other words, “attestation is bad and everyone is against it, but it’s a feature of the standard.” What they are really claiming is that there is something that for now is stopping governments and corporations from pushing attestation, but how long will that hold? I didn’t have a horse in this race when I first started reading these posts, but this counter-argument is flawed and it makes me lean toward the camp against passkeys.
Attestation for passkeys (software-based, syncable credentials) is antithetical to their mass market goals, and would freeze out independent, non-corporate-backed credential managers. It’s an explicit non-goal of the designers of passkeys, who work together in a forum anyone can join.
The web wasn’t supposed to be controlled by corps either, and look where we are now.
If passkeys were to follow the same path as the web, here’s what it would look like. Corporate passkeys get the most users because of OS integration and convenience. Now that they have all the users they can commandeer the standards, and make them so complex and evolve so quickly that non-corporate implementations can’t keep up (think Firefox vs Chrome). Corporations convince websites to drop support for outdated passkeys, citing security issues. Non-corporate implementations are locked out. Monopoly is established.
And now that passkeys are centralized to corps, the government can exert power on them, mandating hardware attestation for things like hardware-backed id and age verification. They push for backdoors, so they can log into anybody’s account. Bye bye privacy.
Question: Why did these corps implement TOTP? You should be able to answer this from an economic perspective of them trying to save money.
Another question: why aren’t these corporations locking down TOTP to restrict them to their own validator apps, in the same way you’re proposing that they might do for passkeys?
why aren’t these corporations locking down TOTP to restrict them to their own validator apps
But they do. There are TOTP implementations that have been intentionally modified to prevent using standard apps. I don’t remember other examples right now, but I think Steam Guard is one.
Why did these corps implement TOTP?
To reduce support load from people getting their accounts hacked and asking support to get them re-instated. I don’t doubt that these incentives also drive the push for passkeys, but passkeys are much more opaque and tightly integrated with the OS, and is thus more vulnerable to centralization.
why aren’t these corporations locking down TOTP to restrict them to their own validator apps
They are. Authy is the biggest offender I know.
Edit: some info about how Authy locks you in: https://www.bentasker.co.uk/posts/blog/general/switching-to-aegis-for-totp-codes.html. Note that some websites integrate directly with Authy and force you to use Authy to set up the TOTP. The only way out is to use a rooted phone to transfer the codes to another app like Aegis.
I don’t doubt that these incentives also drive the push for passkeys, but passkeys are much more opaque and tightly integrated with the OS, and is thus more vulnerable to centralization.
I’m not sure what you mean by integrated into the OS. I use a FOSS password manager on android (keepassdx), storing passkeys both for apps and websites. When the browser or an app asks for a passkey, android uses the password filling service you’ve chosen (in my case keepass), and it loads up, no differently from when there’s a password prompt. I’m not sure how it works on other platforms like iOS, windows, or linux, but at least on android, you can use a FOSS password manager not integrated into the OS.
They are. Authy is the biggest offender I know.
Specific sites aren’t locking down TOTP, this seems to be an EEE scheme of Authy specifically, since as you say the TOTP codes provided by sites still work with other authenticators. I’m referring to the case where say, amazon forces you to use their app to login, or creates their own custom TOTP or passkey app, and won’t let you log into their site without it, and then you have no control over your login method or codes.
By integrated into the OS, I’m talking about the major corporate implementations, like Apple, Microsoft Windows, or Google Android. The advantage is that you don’t need to install an app or browser extension, and then give that app permissions. Everything is already set up. I’ve seen some websites like Amazon try to automatically set up passkeys for you, so it’s likely that a good portion of the population already has passkeys set up in these corporate passkey managers, before they have the opportunity to learn about alternatives.
Speaking of Keepass, you should check out these discussions:
https://github.com/keepassxreboot/keepassxc/issues/10407#issuecomment-1994673954
https://github.com/keepassxreboot/keepassxc/issues/10406
In short, keepass had a way of exporting passkeys unencrypted to disk, and some people did not like that, threatening things like:
This implementation is not spec compliant and has the potential to be blocked by relying parties.
The unfortunate piece is that your product choices can have both positive and negative impacts on the ecosystem as a whole. I’ve already heard rumblings that KeepassXC is likely to be featured in a few industry presentations that highlight security challenges with passkey providers, the need for functional and security certification, and the lack of identifying passkey provider attestation (which would allow RPs to block you, and something that I have previously rallied against but rethinking as of late because of these situations).
This is exactly what the “passkeys are a trap” article warned about. Passkey attestation allows websites to reject specific clients, just like how SafetyNet allows apps to block GrapheneOS users. In the future, banking websites or google.com could force usage of passkeys, and block usage of keepass. Are there enough keepass users to protest this? Certainly hasn’t worked well for GrapheneOS and SafetyNet.
this seems to be an EEE scheme of Authy specifically
Functionally, it’s locked down because it’s nearly impossible to migrate the TOTP codes to another app.
You don’t really see custom TOTP apps because users don’t want to have to install an app just to generate TOTP codes for a specific website. Google Authenticator could have done this, but I think Google decided to start moving towards passkeys instead of enshittifying Google Authenticator.
There is much more incentive to do this with passkeys, because you can lock down passkey sharing in ways that can’t be done with TOTP. For example, Netflix could block passkeys from any client that allows passkey copies and exports, like Keepass, in order to block account sharing.
Passkeys are 100% not a trap, but they’ve been fucked over by being allowed to be portable. Now your passkey is only as good as the portable password solution you’re using to store it. They’re meant to be 1:1 computer->service. Then there’s the issue that most of the sites that accept passkeys let you bypass them with passwords or TOTP anyway.
TOTP, however, is REALLY fucked. Even a rudimentary phishing email can get your time-based key, get in and fuck your account over in real time.
Passkeys are extremely phishing-resistant. They are the best thing we have short of a YubiKey at the moment.
Yubikeys are amazing, But they’re not meant to be permanently carried, just used to stitch your securred devices together.
I use hardware keys to connect to my own self-hosted services and login on (some of) my devices. There is no 3rd party involved.
Some of them like NitroKey are even open hardware. I have backup hardware keys.
It’s amazing. I can’t believe it took me so long to rely on them.
So… IMHO if you don’t like (hardware) passkey it’s because you dislike services relying on them, no the keys themselves.
The biggest problem I have with passkeys is big companies aren’t implementing them to improve your security - they’re implementing them because it absolves them of liability and responsibility for implementing good security on THEIR end and allows them to implement whatever the fuck vibe-coded bullshit nonsense they want without any knowledgeable or skilled staff, and even if it’s good for me too, I’m not inclined to do these assholes any favors. It’ll just make them sloppier and lazier on other elements of security and they’ll turn around and put the blame on the user, and courts will go right along with it because nobody in the legal system can find their asses with both hands.
Exactly, people keep focusing on whether passkeys are secure as a concept, and they are. However, what we actually need to talk about is how they’re going to be used in the wild, and what companies are likely to do with them. That’s what’s going to affect vast majority of the people.
Nah, lock-in is not a safety feature. 16+ random chars are plenty, and if cracking gets better I’ll go to 20 or 30 chars. My pw manager doesn’t care what strings go in it or which device opens it up.
That’s my workflow as well 26 random characters, a yubikey (and Aegis TOTP for sites that don’t have fido or similar) and I’m good.
I like the idea of a Yubikey but there is no way it would survive more than a month on me due to the conditions where I work. And getting a physical key then not having it on my body at all times is a non-starter.
I keep my keepass .kdbx in on a webdav server and that covers any device I can think of.
Do you work in a blender? It’s a pretty solid bit of plastic, should be fine in a pocket or wherever the device you’re using it with is.
Maintenance at a blast furnace. I am exposed to acidic vapours, caustic vapours, ambient heat in the 60c range, radiant heat in the 1000c range, rock from the nanometer up to 30cm size, phenolic resins, oil mists, and metal powders. And then there’s the crawling around over, under, and between equipment.
Not every tech-savvy person works in an office.
Cool. Hope it’s ok on your health. I suppose you have some way to keep your phone safe, and don’t need to do 2FA while exposed to all of those things. You could probably wrap one up pretty well and still have the NFC work too.
Totp with a backup of the secrets/seed qr stored in a kdbx. If my phone melts it’s a 24hr problem at most.
Reads like Ricky Mondello stopped explaining half-way through why the other essay’s “theory of the case being fundamentally wrong.”
Let’s get back to after 10 years because this was the same debate about drm in browsers and now we have this https://www.w3.org/TR/encrypted-media-2/
FWIW I don’t have DRM enabled and I can don’t even remember what part of the Web I can’t browse.
Before you ask, no I don’t use Netflix, or Disney+ or audio streaming service nor do I plan nor want to.
When you use librewolf it pops up when websites try to access drm, ex. finance.yahoo.com wants to access it. It’s not streaming services but lots of news webistes that also serve video.
