PayPal is Getting More Secure Passkey Logins (theverge.com) 25
PayPal has announced today that passkeys are being added as a new, password-less login method to secure PayPal accounts for iPhone, iPad, and Mac users on PayPal.com, with plans to expand passkeys to other platforms as they add support. From a report: PayPal passkeys are rolling out to US customers today and will be available to "additional countries" in early 2023. Passkeys are a new type of login credential that replaces passwords with cryptographic key pairs. They are resistant to phishing attempts and are designed to avoid sharing passkey data between platforms, addressing the weakness of current password-based authentication.
Passkeys are supported by Apple, Google, and Microsoft, who have pledged to bring the FIDO Alliance standard to their respective OSes. Reusing passwords across online accounts leaves users open to hacking and other vulnerabilities, but remembering individual login details is no easy task without a secure password manager. A study from Verizon shows that over 2.6 billion records were hacked in 2017, with 81 percent estimated to have been caused by password stealing and guessing.
Passkeys are supported by Apple, Google, and Microsoft, who have pledged to bring the FIDO Alliance standard to their respective OSes. Reusing passwords across online accounts leaves users open to hacking and other vulnerabilities, but remembering individual login details is no easy task without a secure password manager. A study from Verizon shows that over 2.6 billion records were hacked in 2017, with 81 percent estimated to have been caused by password stealing and guessing.
I can memorize many passwords (Score:2)
I doubt I can memorize a practical cryptographic key pair.
Re: (Score:2)
Would you like to bet that passkeys are not going to be available on rooted phones?
Re: (Score:3)
That seems unlikely. The Android security verification system, which is what causes certain apps not to run on rooted devices, is there because certain institutions demand it. Banks* are a classic example, some of them want to be sure the device wasn't hacked. But there is no indication that Google will require it for this, given that Chrome doesn't use it for saved passwords and neither does Google Authenticator.
* Some of my banks do, but they are idiots when it comes to security. "You must use our app to
Re: (Score:2)
My bank luckily allows me to use a separate, bank-specific hardware authentication token.
Re: (Score:2)
Mine offers that too but it's just one more thing I need to keep around. These days I do all my banking on my phone, except the one or two things that you still need a browser for.
Re: (Score:3)
I'd never use a banking app. Having spent a significant portion of my life working in cybersecurity, I would simply never trust a mobile platform with so much valuable data.
Re: (Score:2)
I know a few people like you, but the banks clearly disagree. If you use Google Pay your contactless payment limit is effectively unlimited compared to IIRC £40 if you use the physical card.
It's considered by the bank to be as secure as entering your PIN.
You can use your banking app to generate a log in code for your bank's website too. They are not wrong, your phone is likely much more secure than your computer. Heavily sandboxed, locked down OS...
Considering the dire state of security on their
Re: (Score:2)
Not really. My phone is jailbroken, rooted and with applications requesting excess information beyond what they should. Also, I know what can be done with phones from the pentesting point of view, and if the public had the same level of awareness, I guarantee they would never use their phones for anything sensitive.
Re: I can memorize many passwords (Score:2)
Storing one [a passkey] on your phone is pretty dumb
Storing passwords in your browser on your phone is dumb too. How many people don't disable that or are simply unaware of the risks?
Passwords have had their day. There ok on a intranet, they're ok for (most) file server authentication. But we rely on passwords to secure things of much more value nowadays.
Re: (Score:3)
Plus, that memorized password can be used from multiple devices. What if I'm sitting at my laptop and want to buy something with PayPal - am I supposed to now somehow find that same site and shopping cart on my phone so I can use a "Passkey" with my payment provider?
If I can store this passkey on multiple devices which are only secured with a password, doesn't that kind of defeat the point?
Re: (Score:2)
That's the point. You can only remember so many passwords, so you reuse them. Human memory makes for weak security.
For many years the standard advice has been to use a password manager. The problem with passwords is that every site has different requirements for minimum and maximum length, require characters and so forth. Using a standardized crypto key allows the whole process to be easily automated and more secure.
Re: (Score:2)
being able to have access to zero cryptographic keys when my phone is lost, stolen, or broken seems less useful than knowing 30 passwords at all times.
P.S. you can also start my car or open my front door if you know where I hid the key. But you probably won't bother to find it.
Re: (Score:1)
being able to have access to zero cryptographic keys when my phone is lost, stolen, or broken seems less useful than knowing 30 passwords at all times.
Don't worry, you'll probably be able to get a new passkey by calling them up and giving them your mother's maiden name.
Re: (Score:2)
That's what backup codes are for. When you generate the Passkey you get a set of single use codes that you can store securely somewhere, in case you lose access to your Passkey. Google will also save them to your Google account, but I assume you are too paranoid to trust that.
Anything like TLS client certificates? (Score:3)
From the featured article:
Passkeys are a new type of login credential that replaces passwords with cryptographic key pairs.
It links to a previous article [theverge.com] stating:
Is this the same concept as TLS client certificates, just with better user interface for enrollment, selection, and sharing across a user's devices? Also, the article lists macOS, iOS, Windows Hello, and Android, leaving other operating systems conspicuous by their absence. Is X11/Linux not invited?
Re:Anything like TLS client certificates? (Score:4, Interesting)
It's a bit different to TLS client certificates. In the case of TLS the client certificates are handed out by the server, and signed with a private key. That's not ideal for user sign up, because a certificate would need to be generated for each user from the private key, meaning the private key needs to be somewhere accessible to an internet facing server that handles the sign up process. Ideally with TLS you want to keep your private key offline where it can't be hacked so easily.
I suppose you could generate loads of certificates in advance and make those available the the public server, but then you risk having loads of certificates stolen, i.e. every new account that gets created is already 0wned, or you can create fake accounts etc.
With Passkeys the browser handles the secret. If you computer is hacked to the point where the secret can be extracted then it's game over anyway, and only one person's accounts were compromised.
tracking (Score:3)
Re: (Score:2)
These damn apps track you everywhere
Security through in-obscurity.
Just in time (Score:4, Interesting)
Great timing on PayPal's part. I deleted my PayPal account a couple of years back when eBay no longer required it. PayPal has been insecure since the start, and by inserting themselves as middlemen they not only add cost, they make it harder to do chargebacks.
Is there any reason to have a PayPal account now? You don't need it for eBay, and you can pay via PayPal without an account for sites that are stuck on it. Most banking apps have similar money transfer features for paying friends, the original ideal and source of the name.
Re: (Score:1)
I've stopped using it in the last month. Suddenly they produced a demand, out of nowhere, for a photograph of me. WTF?
In a year where state hackers have broken open and stolen my personal information from telephone company, medical and government institutions, Payfukinpal wants me to make me even more vulnerable. There is no reason, nil, nada, that a 20 year old account in good order suddenly needs a photograph "to keep it safe".
F them.
Re: Just in time (Score:3)
I tried to delete my account and they not only wanted a photograph but also a govt issued id card.
It was easier to cancel the associated credit card account and filter out their email than to work through their "customer support."
Re: (Score:2)
Paying friends on a desktop computer (Score:2)
Is there any reason to have a PayPal account now?
PayPal is still useful for person-to-person payments from a desktop or laptop computer.
Most banking apps have similar money transfer features for paying friends
Cash App, for example, requires either an iPhone or an Android phone with Google Play. It is not available on Amazon Appstore (I checked 5 minutes ago) and therefore not compatible with Windows 11 WSA or other Android implementations for computers that use Amazon Appstore. There appears to be no way to sign up or pay friends from a computer running Windows, macOS, or X11/Linux.
Rancid shit (Score:2)
Is it still a fake bank that want you to buy crypto?