this post was submitted on 16 Oct 2024
262 points (86.0% liked)
Technology
59436 readers
4161 users here now
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related content.
- Be excellent to each another!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, to ask if your bot can be added please contact us.
- Check for duplicates before posting, duplicates may be removed
Approved Bots
founded 1 year ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
If you've ever used ssh it's very similar to how ssh keys work. You create a cryptographic key for the site; this is the passkey itself. When you go to "log in" the client and server exchange cryptographic challenges, which also verifies the site's identity (so you can't be phished...another site can't pretend to be your bank, and there are no credentials to steal anyway). Keys are stored locally and are generally access restricted by various methods like PIN, passphrase, security key, OTP, etc. When you're entering your PIN it's how the OS has chosen to secure the key storage. But you've also already passed one of the security hurdles just by having access to that phone/computer. It is "something you have".
So one password to access them all basically?
That's quite a weakness.
That's essentially how all password managers work currently though?
True, I hoped for something better :-/
If it makes you feel better, most PINs on modern devices are hardware backed in some way (TPM, secure enclave, etc) and do things like rate limiting. They'll lock out using a PIN if it's entered incorrectly too many times.
It''s really up to the end device (and the user of said device) to decide how much security to put around the local keys. But importantly, it also requires access to the device the passkeys are stored on which is a second factor. And notably many of the implementations of it require biometrics to unlock.
The "one password" thing is also true of password managers, of course. One thing about having one master passphrase is that if you do not have to remember 50 of them, then you can make that passphrase better then you otherwise might, plus it should be unique, which prevents one of the most common attack vectors.
If you get my master keepass password, you have all my passwords, too.
As I said to Spotlight7573 yes true, I just hoped for something better.
If you're paranoid about this, go buy a yubikey and use that to secure your device/access to your passkeys. Being able to secure your own data instead of relying on the admin who may or may not know what they're doing to secure the server is an advantage of passkeys.