Passwordless - Passkeys

[Ice Tea]

Opinions, are they fit for purpose yet?

From a quick read around some people find it daft that you still need to sign up to some sites with the conventional username,password and mobile number to access the Passkeys.

 

[mid_gen]

I use Yubikeys for my important accounts. One on my keyring, one on my desk.

For less important stuff I'm fine with using FaceID passkey on my phone.

Anything is better than username/password/phone.

 

[Philtor]

When I first got an iPhone with Face ID I was blown away with how handy they are.

I use Bitwarden to manage everything and it’s seamless. Are they fit for purpose? I hope so

 

[kindai]

I use passkeys where ever they are available, such as the ocuk forums

 

[Philtor]

I use passkeys where ever they are available, such as the ocuk forums

Work in progress?

 

[mid_gen]

I use passkeys where ever they are available, such as the ocuk forums

I didn't actually know we had passkeys on OCUK now, added!

 

[Glanza]

Work in progress?

On here no you've been able to use one since I want to say middle of last year if not earlier.

 

[andshrew]

I think Apple (iOS and MacOS) is still the only platform that has a pretty decent implementation.

Google, I wouldn't trust them. Google Password Manager decided to nuke my passkeys for no apparent reason: https://redd.it/1fkuwb7

Bitwarden is pretty good now for a cross-platform solution. But consider that since you're now storing your passkeys in a service which is automatically synced to all your devices, on the surface this seems to be less secure than a traditional password manager + 2FA authentication app. If all my passkeys are in Bitwarden, now if my Bitwarden account is compromised the attacker immediately has the passkey and can log straight into services. Before if my BitWarden account were compromised then they would also need to steal my physical phone where my 2FA authentication app was, because those tokens were not automatically synced anywhere. You can probably try to replicate that with passkeys, but pretty much every service is pushing you to sync between devices automatically.

 

[f666]

Bitwarden here also and yubikeys for important and key accounts

Still using 2FA also and aegis for that

 

[Ice Tea]

Unless thing have changed recently i see that PayPal has annoyed Yubikey users as they only allow a single key to be used.

 

[kindai]

I think Apple (iOS and MacOS) is still the only platform that has a pretty decent implementation.

I use Proton pass and its been fantastic with passkeys across all my devices.

 

[IAmATeaf]

Don’t know this supported them, off to have a look

 

[Tram]

I use Proton pass and its been fantastic with passkeys across all my devices.

what if they get hacked?

 

[Pulseammo]

I think Apple (iOS and MacOS) is still the only platform that has a pretty decent implementation.

Google, I wouldn't trust them. Google Password Manager decided to nuke my passkeys for no apparent reason: https://redd.it/1fkuwb7

Bitwarden is pretty good now for a cross-platform solution. But consider that since you're now storing your passkeys in a service which is automatically synced to all your devices, on the surface this seems to be less secure than a traditional password manager + 2FA authentication app. If all my passkeys are in Bitwarden, now if my Bitwarden account is compromised the attacker immediately has the passkey and can log straight into services. Before if my BitWarden account were compromised then they would also need to steal my physical phone where my 2FA authentication app was, because those tokens were not automatically synced anywhere. You can probably try to replicate that with passkeys, but pretty much every service is pushing you to sync between devices automatically.

Best thing about Bitwarden is you can also store your 2FA seed on that also to let the attacker have extra easy access!

Anyway, yeah I've started to use passkeys on a couple of services - mostly to stop it bugging me to generate them.

I've found them to be largely pointless since I was using biometric unlock on bitwarden, but what they do seem to be better at is being more seamless in knowing what services they are applicable to.

 

[kindai]

what if they get hacked?

Everything is encrypted client side, if proton gets hacked all they get is your encrypted information.