I’m curious to know what you’re thinking as far as what bad outcome(s) will or may result from people choosing this over some other password manager.
Suppose your Apple ID gets compromised. The attacker is a jerk and decides to remote erase your device. Then they use your account for black hat stuff and get it permanently banned, or just erase everything on iCloud too.
If the password manager was a different service then you'd still have the password for that service and could get in and recover your accounts on everything else. If it isn't, where's your stuff? The device and the cloud backups are both gone because they were both tied to the same compromised account.
Or you just break your phone and then realize you don't know your password. You can reset your password with your email, so now you just need your email password, which is iCloud, which is the same password. Uh oh.
Whereas if your eggs aren't all in the same basket, you can get a foothold somewhere. If you use a third party email service and haven't forgotten that password, you can still get your email on another device. If your password manager backs up to a third party service or your very own Raspberry Pi, you have access using a different set of credentials than the ones you forgot.
- A lot (most?) people’s Apple Account name is actually their main email address (e.g. Gmail), so they would still control their email address even if their Apple Account was compromised.
- You can still recover your Apple Account and iCloud Keychain without any devices (e.g. if phone broke like in your scenario).
- Your passkeys stored in iCloud Keychain are still protected even if your Apple Account has been compromised.
But the login for the Gmail address is a passkey that's on the Apple account...
> - You can still recover your Apple Account and iCloud Keychain without any devices (e.g. if phone broke like in your scenario).
So what's the point of passkeys if you can get access to them without passkeys?
> - Your passkeys stored in iCloud Keychain are still protected even if your Apple Account has been compromised.
How can something be protected when the thing that controls access to it has been compromised?
A passkey is just a replacement for a password. Google (and other apps/websites) have account recovery processes for users who get locked out of their accounts. The way you get back into your Google account doesn’t change much just because you’re signing in with a passkey vs. a password.
Account recovery is a problem that service providers have to solve (and do solve) regardless of whether a user authenticates to their account with a password or a passkey.
> So what's the point of passkeys if you can get access to them without passkeys?
Some huge benefits are:
1. They are highly phishing resistant. Unlike passwords and popular forms of 2FA (TOTP and SMS), users can’t be tricked into sending their credential to a fake/malicious server. A passkey is bound to the server domain at the time the credential is created, and your OS/browser will simply not send it to the wrong place.
2. There is no credential for attackers to steal from servers in the case of server breach. This is because only a public key is stored on the server, instead of password hashes (or worse, plaintext, if the app/website developers don’t know what they’re doing).
3. Passkeys are guaranteed to be unique and secure. The same cannot be said for passwords. Even a password manager cannot guarantee that every single credential stored in the password manager is both unique and secure. And password complexity requirements often make it a painful game of trial and error to create a secure password, even when using a password manager.
4. Because of annoying password complexity requirements, the process of creating a new password can be annoying and take up to a minute or two of fiddling around, even when using a password manager. With a passkey, the process takes as long as Face ID or Touch ID (or equivalent on other platforms) every time. Every single credential creation and authentication is a fantastic user experience (both fast and easy).
I suggest watching Apple’s WWDC videos. There you will find a very very in-depth answer to this question.
All of the points I’ve made above (and more) are covered in the linked videos.
Move beyond passwords: https://developer.apple.com/videos/play/wwdc2021/10106/
Meet passkeys: https://developer.apple.com/videos/play/wwdc2022/10092/
Deploy passkeys at work: https://developer.apple.com/videos/play/wwdc2023/10263/
If you won’t watch any of the above then you should at least read the FAQ on passkeys on the FIDO website here, which should answer many of your questions:
https://fidoalliance.org/faqs/#PasskeysFAQs
> How can something be protected when the thing that controls access to it has been compromised?
This is answered in the article I already linked above. Here is the link again.
About the security of passkeys: https://support.apple.com/en-us/102195
Specifically, carefully read the following sections titled “Synchronization security” and “Recovery security”. The short answer is that gaining access to the user’s iCloud Keychain contents requires more than just having access to the Apple Account.
> 1. They are highly phishing resistant. Unlike passwords and popular forms of 2FA (TOTP and SMS), users can’t be tricked into sending their credential to a fake/malicious server. A passkey is bound to the server domain at the time the credential is created, and your OS/browser will simply not send it to the wrong place.
So why does my browser or password manager send saved normal passwords to a different domain than the one they were saved for? This is not a limitation of passwords but of the software that encourages saving passwords. It didn't need switching to machine only passwords to fix.
> 2. There is no credential for attackers to steal from servers in the case of server breach. This is because only a public key is stored on the server, instead of password hashes (or worse, plaintext, if the app/website developers don’t know what they’re doing).
What has stopped developers from using irreversible transformations on stored passwords in the past? The math was there.
> 3. Passkeys are guaranteed to be unique and secure. The same cannot be said for passwords. Even a password manager cannot guarantee that every single credential stored in the password manager is both unique and secure. And password complexity requirements often make it a painful game of trial and error to create a secure password, even when using a password manager.
If it's generated by software, any software should be able to assure uniqueness. This is again a failure of saved passwords / password managers.
> 4. Because of annoying password complexity requirements, the process of creating a new password can be annoying and take up to a minute or two of fiddling around, even when using a password manager. With a passkey, the process takes as long as Face ID or Touch ID (or equivalent on other platforms) every time. Every single credential creation and authentication is a fantastic user experience (both fast and easy).
Yes and here we get to the elephant in the room.
You become dependent on an easily stolen or destroyed device for authentication. It is a fantastic user experience until you're a plane flight away from home, your phone gets stolen. Your passkeys are safe in the secure enclave. Too bad you can't access them any more. How do you get home? You don't have any other devices to prove your identity, if you even have backup devices, they're at home. The flight options are in an app that you don't have the passkeys any more for. Your flight may get canceled or rescheduled and you have no way of knowing. If you didn't bring any physical credit cards or backup cash, you can't even eat.
Passkeys are all fine in your average techie environment, but can be a disaster outside it.
Any kind of authentication method that relies on a string that can possibly be manually typed into a box by an end-user can never be made to be highly resistant to phishing.
> What has stopped developers from using irreversible transformations on stored passwords in the past? The math was there.
I don’t understand what point you’re making here. Are you saying “why didn’t people create a different standard than WebAuthn?” or are you saying “strong password hashing methods exist, so why do so many websites use bad ones”? Or are you saying something else?
> You become dependent on an easily stolen or destroyed device for authentication.
No, you don’t, because passkeys on Apple platforms are stored in iCloud Keychain, which syncs across all your devices with end-to-end encryption. They’re not solely on your phone.
> It is a fantastic user experience until you're a plane flight away from home, your phone gets stolen. Your passkeys are safe in the secure enclave.
They are stored in iCloud Keychain, not the Secure Enclave. And you can recover access to your iCloud Keychain is even if you lose your phone, and even if you lose all of your devices.
> The flight options are in an app that you don't have the passkeys any more for.
You could just go through the account recovery flow for the airline app to regain access to your account. Whether you use a password or a passkey as your primary credential for logging in has very little to do with account recovery logging into an airline app. The app needs to continue to handle users who get locked out of their airline account for a variety of reasons.
On which device? You can't use a public pc (or a local friend's) because you'd need to get your new passkeys on it and that's not safe.
Buy a new laptop/phone on the spot?
I'm going to make up a new conspiracy theory that says this push for passkeys is there to sell more devices, because shared devices aren't safe any more.
But this is an example of not putting all your eggs in one basket. An all-in Apple customer is using Apple as their main email.
> You can still recover your Apple Account and iCloud Keychain without any devices
This assumes that you remember your password, and that the attacker has not changed your password, and that the account has not been permanently disabled for abuse.
> Your passkeys stored in iCloud Keychain are still protected even if your Apple Account has been compromised.
"Protected" means someone needs more than just the iCloud account to get access to them, not that you can re-download them if you lose access to your iCloud account.
It also depends on how your account was compromised. For example, if a thief observes you entering your unlock code and then steals your phone, they have the device they need to access all your passwords too.
Someone use their phone as their only computing device (e.g. only other device is their school or work computer).
Their phone dies and the shop convinces them to go for a Pixel 9.
How screwed are they if everything was in iCloud, vs they were using 1Password ?
> How screwed are they if everything was in iCloud, vs they were using 1Password/{own,next}Cloud/Evernote/Meta/Dropbox/web apps...?
That would be a more appropriate picture.
> How screwed are they
Not much. Annoyed maybe but as long as they have access to their email and phone number they can reset their passwords.
What about the other way around? If a person broke their Android phone and a friend convinces them to move to Apple? You could argue that then they may have everything in Google and that they could log in on an Apple device with their Google account and use Chrome and Gmail and whatnot, but then they'd be storing everything in Google.
What if Google sunsets a product? Or Google unilaterally decides to close their account overnight with no human in reach for support?
I'm all for interoperability. I do get the risks at hand. But the hodgepodge of separate solutions forming a duct-tape held system is hardly usable for the "mere mortal", let alone integrating the together in reliable ways.
People want technology to disappear so they can go on with their lives and do stuff that matters to them (which integrating platform-independent third party solutions is not). So "all eggs in same basket" is an extremely valuable feature for most.
At best they spend hours and hours up to days resetting the passwords for all the account they ever had. Looking at my password list, there's 700 or them, it would take me a week of my life, if I ever get to do it at all.
At worst they actually can't access their email and it's the end (or a week or two of back and forth sending official documents to get it back ?)
As a first point: they don't have to go all Google. They can have a Google account solely for their phone, and have everything elsewhere. That's a nobrainer as long as they have a solid password manager. You call it hodgepodge, but that's just what we've doing for the last centuries.
The issue of a service unilaterally killing an account isn't limited to Google. Apple will also kill your account if they assume you misbehave, and you might get someone on the phone, while not getting any resolution.
Do we hear it more about Google ? sure. But Google is also in the biggest service provider on earth at this point.
Someone uses their phone as their only computing device.
Their phone gets destroyed or stolen while they're far away from home to require a plane flight to get back. Perhaps stolen along with their ID.
How do you recover when your logins are passkey only and the passkeys are gone with the stolen phone?