FIDO Alliance Working on Making Passkeys Portable Across Platforms (macrumors.com) 23
The FIDO Alliance is developing new specifications to enable secure transfer of passkeys between different password managers and platforms. Announced this week, the initiative is the result of collaboration among members of the FIDO Alliance's Credential Provider Special Interest Group, including Apple, Google, Microsoft, 1Password, Bitwarden, Dashlane, and others. From a report: Passkeys are an industry standard developed by the FIDO Alliance and the World Wide Web Consortium, and were integrated into Apple's ecosystem with iOS 16, iPadOS 16.1, and macOS Ventura. They offer a more secure and convenient alternative to traditional passwords, allowing users to sign in to apps and websites in the same way they unlock their devices: With a fingerprint, a face scan, or a passcode.
Passkeys are also resistant to online attacks like phishing, making them more secure than things like SMS one-time codes. The draft specifications, called Credential Exchange Protocol (CXP) and Credential Exchange Format (CXF), will standardize the secure transfer of credentials across different providers. This addresses a current limitation where passkeys are often tied to specific ecosystems or password managers. Further reading: Passwords Have Problems, But Passkeys have more.
Passkeys are also resistant to online attacks like phishing, making them more secure than things like SMS one-time codes. The draft specifications, called Credential Exchange Protocol (CXP) and Credential Exchange Format (CXF), will standardize the secure transfer of credentials across different providers. This addresses a current limitation where passkeys are often tied to specific ecosystems or password managers. Further reading: Passwords Have Problems, But Passkeys have more.
Re: (Score:2)
It's what Apple calls PIN.
Re: (Score:2)
The key difference between a Passkey and a password is that Passkeys are much more secure because they use public key cryptography.
For passwords to work the website needs to keep at least a hash of your password. The site can do a lot to make the hash harder to reverse into a password, but the reality is that whenever a site is hacked a large proportion of the hashes get reversed in very short order due to things like password reuse, poor choice of password, or flaws in the hashing scheme.
Passkeys use well
Walking back the design... (Score:2)
The initial pass was basically handing the 'security' people everything they wanted:
- A private key that is generated in one place and *cannot* be extracted (within reason). E.g. a 'huge' yubikey "vulnerability" was that folks figured out a way to get the private key material to come out of some pins that could actually be reached if you disassembled the devices.
- A way for authenticators to limit the passkeys they trust to manufacturers the service considers trusted. In principle, you could demand that th
Re: (Score:2)
Note that this is an optional feature, and whenever I implement it, I ignore this. It's also a bit more work to explicitly limit your implementation to only trust "valid" devices.
I will say it's interesting that browsers have broadly opted not to directly support PassKeys, unless they can make use of a TPM or equivalent device. In principle the browser password management could implement all the client side stuff in pure software, similar to the usual implementation people use for GPG and SSH
Re: (Score:2)
Secure enclaves are fairly universal now. CPUs have had them built in for years, both for computers and mobile devices. It makes sense to implement Passkeys using them, and not expend effort supporting systems that are so old they likely have other security issues anyway.
Re: (Score:2)
But does it continue to make sense when they are going to be transferring passkeys anyway? The whole design point was that the private key would be generated and never leave that chip, meaning you could be reasonably confident that as long as you know where that device is, there's no surprise copies floating around anywhere.
Now if you are allowed to copy your passkeys around, that seems like those facilities wouldn't have as much value.
Still having trouble groking passkeys (Score:2)
Your passkey is bound to one or more physical devices, like a phone, such that without the device you are screwed, right? Where you still have to either have a biometric read or enter a password/pin, right? So it's really no better than those dongles we used to carry around in the 90s that generated a new code every minute?
If everything is protected by passkeys, how do I get my life back if I'm traveling, have to evacuate my hotel due to a fire and am on the street with nothing but the clothes on my back?
Re: Still having trouble groking passkeys (Score:2)
You either use the recovery process like you do now, or you already have another key registered and stored in another location.
Passkeys which depend on not being read by even the user are just security by obscurity though, so they only really delay attacks and don't prevent them.
Re: (Score:2)
It's not security through obscurity in the traditional sense.
Traditionally security has always replied on secret knowledge.
Security through obscurity generally involves obscuring the algorithms and workings of a device, not the key.
If the device itself is well documented I would argue it's not security through obscurity.
Now if the device has a back door to extract the information that they're relying on people not knowing about, or there are chips doing things that are not documented and the doings of those
Re: (Score:2)
It's more like security through preventing stupidity rather than through obscurity.
Something this passkey portability is trying to work around for some reason. The better fix would be to allow multiple passkeys from the beginning. There should be no web site that allows just one form of 2FA. You should be able to add and revoke at will. Especially if it's a Passkey where my laptop might use my face and the CPU secure enclave but I still need to log in from my phone.
I don't like Passkeys replacing passwor
Re: (Score:2)
That's why they are adding the ability to export Passkeys, so you can make a backup. Most browsers have the ability to back them up in some form already. Sites can also offer recovery codes that you can download and keep safe, or other means of recovering your account.
It's not really any different to using a password manager to store complex passwords or OTP codes. If you lose access to it and didn't create a backup, you better hope the sites allow you to do a password reset.
Re: (Score:2)
Literally every service provides secondary recovery processes for passkeys or 2FA devices being unavailable. Make sure you set them up.
Some services use passkeys differently from passwords giving you the option of signing in with both. The former being device specific and sending only auth tokens around, the latter being you transmitting your password over the internet, hopefully securely, but still with the ability for its compromise to affect your entire account, not just your single device access.
Fix The Implentation (Score:2)
The underlying tech? Freaggin awesome, I love the passwordless lifestyle.
But in the past month or two, I've noticed that Windows, MacOS, Bitwarden and others are overly aggressive in trying to take over the role of the passkey god on a local machine.
I use Yubikeys for this purpose, and have several workstations and laptops I hop between. But its been frustrating to the point of pissing me off that I have to hunt down the NEXT checkbox to disable local passkey storage so I can continue to use my hardware tok
Re: Why is a passkey more secure? (Score:2)
Re: (Score:2)
Passkeys can be used as a second factor. They don't have to replace the password too. I don't by choice have any passwords replaced with just passkeys.
Can we get different types of passkeys? (Score:2)
Can we get different types of passkeys?
Initially, all passkeys were locked to devices. Pop a passkey on an iPhone, it follows that device. Save it to a Windows PC, it stays there. It is bound to something.
Then PW managers started allowing them to be portable.
Now we are going to have passkeys similar to Google Authenticator shared secrets -- easily backed up and synced.
All of this is good, but it would be nice to have different security levels. For example:
Tier 1 passkeys would be allowed to be shuffled