If you really want passkeys, put them in a password manager you control. But don’t use a platform controlled passkey store, and be very careful with security keys.
Amazing article. Lots of great inside baseball. I’m a big proponent of hardware security keys, the whole pass key thing didn’t make sense to me. Especially the resident keys. If you user workflow is terrible, nobody is going to use them. Which is even worse than not existing
The hardware keys are great but so far don’t have enough storage. For example, Yubikey as a second factor dynamically generated its responses, but now that it’s storing them it’s very limited to at most 25. It’s a known issue that will be solved though.
Passkeys are FIDO2. The issue is the tokens don’t have much storage for them. For passwordless vs use as a second factor, it has to store it instead of dynamically generating a response to a challenge. They are two features of the protocol.
While non-discoverable credentials are not considered passkeys, you should still be aware of them as there are still a number of valid scenarios where your application will need to support the use of them - especially as they are still valid WebAuthn credentials. These are credentials that cannot be generically invoked by a relying party. Instead a user will need to prompt the relying party with a username (user handle) to have the application provide a list of credential IDs to denote which credential(s) can be leveraged for authentication.
Fido2 webauthn non-discoverable credentials are completely unlimited. Because the private key is on the yubikey directly. The only downside of this, is you have to type in your username first, but I think that’s an upside personally. I do not want anybody who compels disclosure of my hardware security key, to see all the accounts on it.
Are your non-discoverable credentials also locked on the key, or can someone who knows your handle and possesses your key access your accounts? Online usernames are not well protected, I’d rather my key lock out after a few failed attempts to access it.
The non-discoverable keys cannot be removed from the device. The secret is non-transferable.
In the yubikey bio series, this is implemented as a second factor. So you log in, and then present your hardware key as a second factor. You need your fingerprint, the key, your username. Fairly secure.
I think this is a more secure model than pass keys as they’re being promoted today
Yes, but do you need to unlock your key to use it? Possession is not enough to access discoverable credentials.
You edited, but I don’t see this as significantly more secure than the Passkeys, and most keys are not the bio series (not that I trust fingerprint readers anyway).
My biggest problem with hardware keys are replacement. If I lost one of my keys and get a replacement I would now need to go to a hundred sites and enroll the new key (and remove the old one). Until this workflow is automated I can only reasonably use hardware keys with a small number of “critical” accounts.
So for 99% of sites I’m going to use a synced software key.
Amazing article. Lots of great inside baseball. I’m a big proponent of hardware security keys, the whole pass key thing didn’t make sense to me. Especially the resident keys. If you user workflow is terrible, nobody is going to use them. Which is even worse than not existing
The hardware keys are great but so far don’t have enough storage. For example, Yubikey as a second factor dynamically generated its responses, but now that it’s storing them it’s very limited to at most 25. It’s a known issue that will be solved though.
Fido2 solves this already …
Passkeys are FIDO2. The issue is the tokens don’t have much storage for them. For passwordless vs use as a second factor, it has to store it instead of dynamically generating a response to a challenge. They are two features of the protocol.
https://www.yubico.com/blog/a-yubico-faq-about-passkeys/
https://developers.yubico.com/Passkeys/Passkey_concepts/Discoverable_vs_non-discoverable_credentials.html
Fido2 webauthn non-discoverable credentials are completely unlimited. Because the private key is on the yubikey directly. The only downside of this, is you have to type in your username first, but I think that’s an upside personally. I do not want anybody who compels disclosure of my hardware security key, to see all the accounts on it.
Are your non-discoverable credentials also locked on the key, or can someone who knows your handle and possesses your key access your accounts? Online usernames are not well protected, I’d rather my key lock out after a few failed attempts to access it.
The non-discoverable keys cannot be removed from the device. The secret is non-transferable.
In the yubikey bio series, this is implemented as a second factor. So you log in, and then present your hardware key as a second factor. You need your fingerprint, the key, your username. Fairly secure.
I think this is a more secure model than pass keys as they’re being promoted today
Yes, but do you need to unlock your key to use it? Possession is not enough to access discoverable credentials.
You edited, but I don’t see this as significantly more secure than the Passkeys, and most keys are not the bio series (not that I trust fingerprint readers anyway).
Yes you need to unlock the The hardware key
My biggest problem with hardware keys are replacement. If I lost one of my keys and get a replacement I would now need to go to a hundred sites and enroll the new key (and remove the old one). Until this workflow is automated I can only reasonably use hardware keys with a small number of “critical” accounts.
So for 99% of sites I’m going to use a synced software key.
That is a reasonable use case for software keys, maybe the sweet spot is using a hardware key to lock your software keys.
ive been saying dont trust corpos on this one, and being downvoted every time.
I use passkeys stored in my proton pass app when I don’t have my yubikey next to me