My background is very much not in this world so caveat my questions/response below with that mind set. I do however try to practice decent personal opsec such 2fa (TOTP), password manager with random generation, etc.

I feel like a lot of what you stated was covered in the article. For example the article states that problem isn't the number of stakeholders, it's that none of them are consumer advocacy groups.

I understand that the author maybe leaned on the password sharing example too much but I think that was in an effort to present the material in a friendlier manner to the average reader. The closing statement makes it clear it's not really about Netflix, etc. The main concern is that attested passkey requirement will now be the easiest way to force specific software and hardware upon user. The GraphenOS example is a good one.

You might not use the attested flag in that manner but I have zero doubt that once passkey adoption rate passes a certain threshold Google will be more than glad to miss-use that flag to lock people out of their gmail account unless they have the most recent phone and software.

Do you have any examples of any public service requiring attested keys? No, because it really doesn't make sense. But because the protocol supports it, people shouldnt use passkeys? Shitty hot take.

I think this is a bad take. "Because this potential is not being misused right now it won't be a problem in the future" has not really served us well thus far.

My understanding is that the article is saying that passkeys are giving away too much control to the second party. That can and will be abused.

But again, layman's understanding from my end.

There are lots of reasons to like passkeys from a technical/enterprise standpoint, but I do think you're missing the critical issue the article is speaking to: digital sovereignty.

Passkeys, while more secure in the average usecase, shift the balance of control over your access to services. Yes, you can no longer write your password down on a post-it and leak it in a photo—thats's a good property. But trading that at the expense of your freedom to run software as you see fit on hardware you bought and paid for? For many people, myself included, that's not an acceptable tradeoff. There are plenty of tools and systems around passwords that folks can use to make passwords+2FA match or even exceed the security properties of passkeys.

The thing that should chill everyone is the fact that built into the standard is a switch (given to service providers, not users) that locks out the people that do want to have control of their digital infrastructure. Not everyone can or should be expected to run like that, but they should not be blocked from doing so. Similar with the Right to Repair; not everyone can exercise that right on their own, but no one should be prevented from repairing what they bought.

Similary, I do believe it's my neighbor's right to practice a religion of their choosing. So if the government tries to prevent them from doing that, I'm going to go grab my pitchfork, not because I share their religion, but because they should be able to make that choice. Likewise, while I might not want to exert control over how my credentials are backed up, I still reserve the right to do it, and support anyone else's ability to do it.

And to address the slippery slope objection, I have to point out that this is not particularly theoretical. When Big Tech has provided service providers with the opportunity to enforce restrictions on your device, service providers have used it. Widevine DRM, Google Play Protect, etc.. It's why my LineageOS phone can't use banking apps, which is a shame since some features like Zelle payments are specifically a mobile-only feature, and so I cannot use it anymore. I either run my phone to the exact specs and settings that my bank and Google prefer, or I'm denied access to basic banking anywhere but my desktop (and who knows how long until the block my access there, I run Linux afterall).

I do not trust Big Tech with my devices, and passkeys increase their capability to deny anyone who doesn't buy into their ecosystem, and further entrenches those who already are. I for one find that despicable, and an unacceptable tradeoff. There's no reason it has to be this way though, passkeys could have been the best of both worlds. However, they've been compromised with features that serve platforms at the expense of user freedom. It's the kind of disempowerment that happens when you give the reins to power-hungry, profit-seeking corporations.

Maybe you'll prefer more practical criticism then:

https://arstechnica.com/security/2024/12/passkey-technology-is-elegant-but-its-most-definitely-not-usable-security/

To put it simply, every passkey is locked into a large combination of factors: device + platform (OS) + app + the service being used. It is not trivial and often downright impossible to change any of these factors or to render them agnostic. This makes it complicated or impossible to backup passkeys or make them portable.

It's fine for them to not be portable when they're used on a work phone, running the company mandated OS, authentication app and passkey store, to login into a suite of apps that are also company-approved.

I do need portability and backup as an individual who wants to be able to login into multiple services across multiple apps running on multiple OS on multiple devices. But I can't, because the big tech players (Microsoft/Google/Apple etc.) are actively trying to capture passkeys into their platforms and make it hard to get out in any practical way.

With passwords and TOTP I can run something that will sync them across devices and fill them in into any app in a unified manner (or use copy & paste if all else fails). With passkeys I can't.

That is the issue of passkeys. They are hard to understand and without understanding there can be no trust.

You're not wrong to have that feeling.

Where is the passkey saved? Can I take it out and back it up? Can I use it on another device, running a completely different OS? If I lose this device the passkey is on, what happens?

The answers to most of these is negative.

So in order to log into most websites, you need your username/email address and a password.

You can save your username/password in your web browser or in the cloud.

Sometimes people get lazy and reuse passwords, sometimes people forget their passwords.

Passkey is a replacement for usernames/passwords. It does require that the passkey is saved somewhere, often on your device (in the cloud is possible, but non-standard).

When you "create" a passkey, this passkey is used only at a single place. For example, you'd have a passkey for your bank, another one for your email, another one for Lemmy. You have no say in the matter, that's just how it works.

When you log into a website that has passkey enabled, your passkey/password manager pops up, you click on the passkey and that's it. There is no email address, there is no password, no MFA.

edit: oh, you also asked about the difference between passwords.

It's all about improved security.

You go to certain websites, and they'll only allow a-zA-Z0-9, others require a minimum length of 8 characters, needs 3 symbols (except ! for whatever reason ;)

Then you have no idea how the website is storing your password. Are they encrypting it? Did they do it correctly?

If you look at the number of "breached/leaked" passwords on the internet, it's because it's hard to securely store passwords.

Passkey solves all this. Websites are just given "a public key" and it can be "just stored", no special treatment necessary.

Imagine if a romantic partner said "I will send you a unique string, probably exactly 8 characters" to verify that I am your partner. You would laugh and remind them it takes less than a second to generate every 8 character combination possible.

Instead, your SO makes a key and keeps it with them at all times, and you promise to talk to them using a machine that makes secret messages only their key can decipher. For fun, they give you a key and make a machine too... Explaining this shit is complicated I'm sorry for what you're about to read.

They send "heyy", You send "whatup", They send "send pics", You take one, encrypt and send the pic, They say "huh? Wtf?", You remind them about the secret key, They have no idea what you're talking about -fail OR they send something in return back (which you decrypt) -success

That's basically the same thing as authentication with a passkey oversimplified and only slightly wrong but good enough. There's shitloads of devices that do it, yubikeys, authenticator apps, but they're all doing that.

I've already been avoiding them because I don't see how there's any security advantage over TOTP...

I'm not going to challenge your choice in using passkey or not. However, I do want to set the "technical record straight": passkey is the successor to TOTP in every technical way*.

TOTP works by having a "shared secret" saved by both you and the place that your authenticating against. This shared secret is then mixed with current time to generate a rotating number that the client shares with the remote server. The remote server does the same calculation, if the rotating numbers match, the user is successfully authenticated.

With TOTP, this means that there are two attack vectors: your device and the remote server. If an attacker is successful in getting the "shared secret" from either, your TOTP is effectively broken.

Passkey works more like ssh-keys. The client generates a public and private keypair. The client only shares the public portion with the remote server and stores the private key locally (or in your password manager).

So the only attack vector (with passkey) is your device (this is often why it's bundled with attestation). Also passkey is not dependant on both the client and server having their time kept in sync. With TOTP, if you have more than ~30 seconds drift between the client and server, they will be generating different rotating codes and never match (which is confusing when you need to explain this to your Grandma).

• there is one thing TOTP can do, that passkey cannot: TOTP is 2FA, your TOTP can reside on a separate device (ie your phone when logging in using your PC). With passkey, you'd need to enable 2FA on the passkey manager (which varies from manager to manager).

...unless the passkey is the only way to access the account (which would be awful for account recovery).

Recovery options are never going to go away. With TOTP, you often have one-time use backup codes. Email, SMS recovery etc.

I wish SQRL was more commonly used.