The site is actually asking me for login now via Google or something else. In recent times, many sites like Howtogeek or MakeUseOf have kinda paywalled unless you login. It works properly with adblocker (uBlock Origin) once I login though.
The point is its a shitty thing to do and I would rather not give them any attention especially since the entire thing is explained in a blog post on bitwardens site.
I have had three of them on my keyring for years (one old personal, one newer personal and one for work) and even though they sometimes get lodged between the keys and a separate ring I have on the main ring none of them ever even got close to looking damaged (excluding some mild fading of the print on the oldest one).
And if you only need FIDO2/passkeys, the Security Key series is half the cost ($25) of the Yubikey 5 ($50) and all you really lose is OpenPGP and PIV (smart card) functionality.
Now I like playing with all the features of the 5, but most people should just need FIDO2.
I looked into this a year ago and most sites did not offer to register a second key, so if you lose your key, you can kiss many of your accesses goodbye. I would never have the key to my digital life on a keychain… The idea is good, but it will cause huge damage if you lose your HW key. On the other hand, if you are cautious and use different PWs and a password manager with 2FA, you are quite safe.
Hear hear. Not allowing spare keys doesn’t make sense. I have as many spare keys for my digital stuff as my apartment. But yeah, too few sites support that
The main advantage is that, like hardware security keys, they’re immune to Man in the Middle phishing attacks, but are far simpler to use so should hopefully see much more widespread use.
Passkeys are like a password + 2FA mashed together. If someone steals your “passkey password” they still can’t use it to login without the hardware component. That means phishing is harder. Since passkeys are generated for the user from their hardware it also forces better hygiene on the user by not allowig any password duplication.
A downside is it is tied to hardware and a provider that can cause problems witb loss of device or when you change devices but it is hard to say how painful that is going to be.
It’s more about supporting a new standard. Plenty of folks are using same credentials everywhere, and passkeys could potentionally change that. Also, entering 1 thing is easier than entering 2.
Continuing on what Rolling Resistance said (sorry for the delay, had to step away for a while), I know plenty of people who do use a password manager and still use a static password in some places (hell, I’ve been guilty of that in a few places - but generally on network-isolated systems). Some people also don’t use 2FA because they find it inconvenient.
Passkeys are more or less very similar to how SSH keys work if you’re familiar with those, your device (or password manager) generates a secret key that it only has access to, and then gives the public key to the website (and a new keypair is generated for every single website). When you login to a website, the website sends you a challenge which you sign with your private key, that the website can then verify using the public key that you used when enrolling the passkey. This way, a website never has any form of secret - making say password hash leaks less relevant, whereas in theory you could give your public key(s) and post it on Google’s homepage without any repercussions… but don’t quote me on that one.
So even if you use a password manager, if you still have a few websites that share the same password, and one of those gets compromised - those other websites may still be vulnerable which wouldn’t be possible with a passkey.
When you visit a website you’d like to login to, your browser generates a public/private key pair and gives the public key to the site.
When you want to login:
The browser uses the website domain name to generate a challenge and sends it to the website.
The website verifies the challenge by sending back a randomly generated long text, encrypted with the public key.
Browser confirms by sending back the decrypted text as proof.
Now both website and browser are sure the other is legit, there are no passwords involved, the login process is standardized and can be upgraded with new protocols and cyphers whenever needed, you can’t be phished, you can’t be tricked by a fake domain that looks in Unicode like the correct one, and if anybody breaks in and steals the public key they can’t do anything with it.
Add comment