What if the computer you want to log in on doesn't have Bluetooth? Probably most public computers (like ones in libraries) don't have it.
The number of people sharing GP's concerns for reasons of poverty rather than because of their personal security posture will be vanishingly small.
Only 85%¹ of the population are over the age of 4. Smart kids they've got.
These may seem like nitpicks, but there's probably a thousand rare scenarios like these that exist. You inevitably have to consider them when you're moving from punching in letters and numbers that you remember in the normal, low-tech way to a complex networked two-device workflow.
They use bank like Ally or Discover with no physical branches.
They use a mortgage provider like Rocket mortgage with no physical branches.
They use a medication delivery service with no physical customer facing pharmacies.
They have an employer that only facilitates reimbursement for expenses via online tools.
etc...
I guess "survive" has a sliding scale, but if I lost access to critical accounts... my life is going to FUCKING SUCK in a non-trivial and very impactful way almost immediately, on many fronts.
And if your answer to that problem is "well, just call them"... then we're right back to the point the article is making: "An account’s security is still dictated by the weakest recovery method"
Passkeys aren't a meaningful improvement in security - assuming you do actually have decent password hygiene like a password manager.
What am I missing? Either we retain passwords as backup for a lost or stolen device - in which case, all the security concerns are still there - or we only use passkeys, in which case we've added a clear nonrecoverable point of failure in the system.
Then we introduce all these "security" mechanisms that make it literally impossible to recover an account without backup codes.
Where do you store the backup codes? The average person, if they store it at all, will store it on a plain text file or in a sticky note.
Except that this creates a much more brittle system. Systems are safe when they are routinely tested/used. If you routinely have to enter your password, you are aware you need it. If you don't need your password, and you never have to enter your backup codes, you won't feel the importance of them until you actually need them.
It's the whole "I have backups" vs. "the backups actually work" problem except it's pushed onto the users who have zero technical knowledge.
Everything else which has ever given me a backup code... gets stored in a secure note in my password manager.
It is just another knowledge-based factor. It is one that they are reasonably sure you aren't spreading around the internet. It is one that the site gets to pick rather than the user. But in reality, they are a often just a way to try to reduce some support and identity verification costs.
The path to get to the password manager is the case where the backup codes truly matter, because without them there may not be a way for support to restore access. Those codes may be your only way of regaining the master encryption key.
But that also winds up being part of the trade-off of security vs user friendliness. Some password managers are way easier to get back into.
When I said "survival", I meant it in the "being able to make do with few resources in a time of crisis" way, not that you will literally die if you can't access an account. Losing a crucial device without a fallback of being able to log in somewhere else quickly can mean immediately losing access to payments (the most crippling, especially if you're not home), being stranded in an airport or even not having an identity document (in countries with digital ID systems). Any of these happening can lead to enormous losses in time, money or worse, depending on when and where this event hits you.
And when that happens I'm usually glad my credential is a passkey on my keyring, as chances are if I don't have my phone and I haven't auth'd on to some computer I almost certainly don't have access to my password vault. But hey, my passkey works just fine without my phone. And I can trust that once I unplug my authenticator and log out of that session, there's no long lasting credentials left behind. I don't get that with passwords.
Aren't passkeys great?
You get mugged.
They take your phone and keyring.
They can't do anything with it since it's locked, but you don't have it.
Aren't passkeys great?
I have a backup key at home
Mission accomplished
I have not yet done an actual test within Japan, however.
Abroad I’d head to the nearest consulate of my home country. Might be difficult to get to if it’s in a far away city. Hard to prepare for abstractly.
I know plenty of people who only have a phone, no other devices. They don't backup that phone, they should but they don't. They don't use a password manager either, maybe they should, but they don't.
My issue with passkeys are that they are designed for a reality that don't exist, or at least only exists for people who are already doing a lot to secure their devices.
They are designed for a wealthy technologically inclined user with a very stable lifestyle and trusted resources and connections to other people. You know, the exact people who developed them.
The individual passkey? Maybe not. But I don't really need to backup the passkey, I can just have backup passkeys or other backup authenticators, including complicated stored one-time passwords.
To answer your earlier hypothetical, I'm out traveling and I'm mugged. Well, hopefully, I'm not mugged in the part of the travels where I'm carrying truly everything at the moment, and I can just go back to the hotel room and re-auth with a device I saved there Problem solved, no big deal. If I lost truly everything while I'm out, I'd do as suggested elsewhere here and call home to get a trusted friend/family member to read me off the one time password saved at home or whatever, or figure out some way to get me money to get home. Chances are I'll end up having to work with the embassy anyway.
> My issue with passkeys are that they are designed for a reality that don't exist
The reality of passwords being hijacked is absolutely a reality of today and is a constant issue for tons of people.
> I know plenty of people who only have a phone, no other devices.
And I really don't get why we can't also teach these people to also have a little token they use that can also be a part of their online identity. And sure, for certain kinds of accounts have appropriate levels of recoverability, but for the normal authentication workflows its so much better in so many ways.
>They are designed for a wealthy technologically inclined user with a very stable lifestyle and trusted resources and connections to other people. You know, the exact people who developed them.
And here you go posting
> I'd do as suggested elsewhere here and call home to get a trusted friend/family member to read me off the one time password saved at home or whateve
If you read what I posted you see why you live at a particular place of privileged and are seemingly incapable of putting yourself in another persons position where these things do not hold true.
"If you are a white male earning over 100,000 a year in a stable relationship with living family members, excess savings in the bank, in a stable first world country everything is going to be fine and the rest of you can get fucked" --what you keep repeating in different ways.
Also, you're posting incredibly racist and sexist statements here. Why does race and gender matter here?
Stop being racist.
Quit being racist and projecting identities on people.
This is about people who would have a hard time recovering digital identities. I imagine there were lots of white males fleeing war in Europe who probably struggled to get access to accounts backed with things like passkeys and other forms of 2FA. But I guess to you their struggles don't matter.
Its almost like you including gender and race was just your own projections of your own hatred for a particular group. You should probably think about things when painting people with such a wide brush of "white males" when trying to paint people in a derogatory fashion.
I spent a chunk of my life homeless. Don't project some identity on me that's not valid, or that I just totally lack some perspective due to your assumption of my race or gender. Its not a fair thing to do, its literally racist and sexist.
You could have tried to make your point without throwing in racist and sexist comments by just saying "wealthy western software developers" or whatever.
With 2FA? Yes. 2FA is almost just as stupid and almost just as bad for regular users as passkeys are, but it got adopted due to historical loophole - by far the most popular form was TOTP delivered via SMS, then "authenticator" apps, both of which keep the code transferable - you can receive it on one device, transfer to yourself or someone else (which is a feature, not a bug) via any channel, and get it to work. Passkeys were created specifically to close that loophole.
Plus, SMS didn't allow for vendor lock-in, which is arguably why they're so hated in security circles (SIM-jacking is real, but doesn't scale anywhere near enough to warrant deprecating it as mechanism for regular users).
Passwords just don't provide a broad recoverability benefit once you commit to doing strong, unique passwords.
> Passkeys were created specifically to close that loophole.
Credential sharing? I have a family share with passwords and passkeys in it. Passkeys most certainly didn't stop this.
They did add friction to having a user being duped to share their password to someone claiming to be tech support, since you can no longer request plaintext secrets be sent over arbitrary channels.
> Plus, SMS didn't allow for vendor lock-in, which is arguably why they're so hated in security circles (SIM-jacking is real, but doesn't scale anywhere near enough to warrant deprecating it as mechanism for regular users).
SMS is an ugly user experience and more importantly is expensive. Now a lot of services do emailed codes when they don't have a regulatory reason to require SMS - an even worse user experience, but less expensive.
We have authenticator apps which use a standard OATH setup, and quite a few platforms which have integrated support to try to sand over the worst part of the UX. Unfortunately they just didn't become popular, and OATH fails the same regulatory requirements that emailed codes fail.
Passkeys are not meant to have a vendor lock-in story. Credential exchange allows for credentials stored in consumer credential managers to be imported into another credential managers. The platforms have added infrastructure specifically to make this easier for users.
The exceptions are when enterprises run their own passkey stores, or when the user explicitly picks a solution that doesn't allow export (like a physical Yubikey).
No, it's fine. Most common example, I log in to my bank, they send an SMS, I copy the code and paste it into the web site. Works fine and I don't have to pick up my stupid phone, like I would if I used an authenticator app instead.
"and more importantly is expensive."
Not for me. The bank made several billion dollars last quarter, don't think it's a big problem for them, either.
Or another example, someone hijacks my SMS'es, and then they log in as me.
SMS sucks. SMS is insecure.
The amount of times I've experienced customers complaining about SMS 2FA not working well despite it being on their carrier failing to deliver the messages in a timely fashion really showed me how terrible it is.
But for me, where I live now, with my bank, and my phone carrier, it works great. Never had a problem that I can think of. Typically, the SMS arrives within seconds. It's the least annoying and most reliable 2FA method I use.
I'm not that worried about potential security issues. Sure, it's a possible problem, but pretty low on the list of things to worry about.
In general, I do not have a "device currently in my hands" and having to pick one up and unlock it is annoying.
Good news then, this also works on desktops, even ones without cameras or touch sensors. That's a part of why I mentioned "typing in my PIN". But sure, keep moving goalposts. Maybe next you'll tell me real computers don't have numbers on the keyboards or something.
> In general, I do not have a "device currently in my hands" and having to pick one up and unlock it is annoying.
I agree, which is why SMS sucks so much for 2FA. Having to have my phone with me with signal just to auth into something sure is annoying, I don't know why anyone would prefer that compared to just using the authenticator physically inside their computer.
All of the 2FA methods forced on me by my employer and most online services that require it require a phone app. So no, it doesn't work on a desktop.
Which, while I can't speak to your specific employer, tons are moving to support passkeys. Largely because forcing these apps suck and SMS sucks.
No, that's not the way it went. I joined the conversation, such as it is, to respond to the guy who said "SMS is an ugly user experience" to say no, it's fine.
I haven't shifted any goalposts: I've basically just reiterated to you that I think it's fine and better than the alternatives. Not a word about passkeys from me.
It's not fine that SMS messages get delays. It's not fine that it requires a cell phone plan. It's not fine that it requires you to have cell service. Its not fine because it's insecure.
So many times I've had coworkers and clients frustrated they are pushed to letting their employer force SMS 2FA on their personal numbers. When they could just use passkeys these days baked into their work machines and not have those problems.
Then you decided, for some unknown reason, to jump in and... do something, but I'm not sure what. Seems like you're trying to convince me that my own view of my own experience is wrong somehow but — and one might think this would be obvious, but apparently not to you — that's not gonna work.
Are you talking about your phone here?
But, again, if you don't trust your phone then how likely is it that you will be prepared to trust a public computer?
I assume the QR code contains a token for the device, which is used by the app to authorize the login and the server automatically logs in the client on the device with the matching token.
Seems a lot safer to me than using my login credentials on a potentially unsafe device.
1. It might be on a voice network but not on a data network; for instance, if you don't have a data plan.
2. Modern smartphones are actually a hybrid of a traditional cell phone and a traditional PDA, and you might be using it for the PDA part.
1. Initiation (QR code, NFC in draft)
2. (Proximal) negotiation (BLE key exchange)
3. Communication (over websockets or a direct L2CAP channel)
The challenge is that a devices without bluetooth (at least today) don't have another common way to wirelessly judge proximity. A desktop/laptop without bluetooth likely either doesn't have NFC, or has bluetooth disabled by policy and would likely have cross-device passkeys disabled by policy as well.
The browser delegates passkey plumbing up to the core platform typically, so it already should have the appropriate permissions.
When every passkey interaction is a different variety of user interaction nightmare, it's not very convincing that it's a good idea in the first place
Passkey QR codes are only WebAuthn via CTAP hybrid transport (with BLE verified proximity)
A malicious website can display a QR code too. I think this "feature" could cause some of the security issues that passkesys were intended to solve.
I use Keepass and the free tier of Dropbox, to keep my passwords strong and available across multiple devices. (Dropbox not required, you can store the database on a thumb drive.) Backups are no problem.
Keepass (or KeepassXC) stores other data as well, including the correct URLs for sites. So my workflow is simply to click the URL from within Keepass, copy the username and password, and paste them into the login screen. So easy even an adult can do it! (Humor attempt)
For convenience, Keepass database can be unlocked with either a password or biometrics (your fingerprint).
(Not affiliated with Keepass, just a happy longtime user.)
Basically, it's very hard if not basically impossible to spoof a QR code to access the real passkey via a malicious site. (caveat, without already having compromised something like the user's DNS, maybe? Even then the site would likely fail the cryptographic checks.)
That means attackers need more than to display a QR code, they also need a local presence (radio).
> Only if they’re a bit old. Nowadays WiFi chips double as Bluetooth chips on newer platforms.
What if the computer you want to log in on doesn't have a WiFi chip?
It doesn't have to be an old computer; for instance, the desktop computer I built last year uses a wired gigabit Ethernet connection to the router right next to it, and doesn't have (or need) any WiFi or Bluetooth chip.
That's a technocratic reply, not one that is useful in the real world.
As noted by the person you're replying to, it's not his computer. It's a public library.
Most computers in non-residential settings will have various features locked down, including Bluetooth.
Hotels, clubs, airport lounges, various government facilities… there are thousands of places where you might really need to use a computer but don't control the technology.