This is a great writeup of the continuing failure of passkeys to meet their potential. It demonstrates the gordian knot:
1. the ecosystem is confusing due to the plethora of different interacting layers
2. therefore, to simplify, every vendor attempts to own as many layers as they can, obscuring other vendors' tools
3. therefore, users are confused into thinking that passkeys are platform-specific, because their platform vendor is obscuring alternatives
@whitequark @dalias @glyph I said something about a separate device (in a different part of the thread)
Continuing from here:
https://mastodon.social/@mcc/113748384835298072
…in addition to the website not being trustable with your password, it's also possible the machine on which the web browser is running cannot be trusted with your password. This is an important case to me personally, not on *all* machines, but on some machines separately.
Here I note something important and problematic:
(Post 2 of 4)
@mcc @whitequark @dalias I think there is some validity to what you're saying—in particular, I think that passkey implementations could do a better job respecting individual autonomy and allowing individuals to provide input to their threat model, which the big vendors cannot have and is not universal.
But to the extent that "passkeys" are trying to do a thing, it's to solve a big *social* problem of password reuse and account compromise, which other solutions have demonstrably not addressed
@mcc Yup, 100%. I *did* start my thread by saying that they were failing, and this is a big reason why :).
But they do also need to address a huge range of personal use-cases in order to bend the will of the population at large in a more beneficial direction, and that does necessitate being all things to all people.
(Also, by "SPI", I think you meant "SRP"? Or is there another more general SRP-like thing called SPI?)
@mcc @glyph I'm having trouble keeping up with this thread, but it does sound like what you want is a FIDO key, but actually well implemented by a given service provider. (Ideally a non-resident key, imo).
Secret never leaves the device (except the side channel Dan reported on a while back), isn't shared with the hardware, can't be enumerated (since the private key is derived from a thing the service provider holds), works over USB.
@mcc @glyph So yeah that's a whole thing.
Your phone *can* be a FIDO key, the secure element's capable of storing the secret, but there's some spiciness (which it sounds like you're already aware of) around providing the BLE interface to said key if it's present on the device.
There's nothing stopping Graphene, eg, for allowing usb-only support from a phone besides all the APIs for doing so being in Google Play services apparently.
@mcc Then you’re not the target audience for passkeys. The audience for passkeys is users who don’t want to have to know what password managers are or why 2FA is imposed on them, and the goal is to make auth easier and more secure than passwords.
The mere fact of passkeys trying to do so is laudable, because the goal of the alternatives (SMS or app 2FA, hardware tokens) is for nerds to assert their superiority over non nerds by making them miserable with the excuse of more security.
@glyph
@mcc I should note that within the spec, this *is* entirely possible to achieve with passkeys. Nobody has yet built the extremely specific device you want, because I think it is a fairly esoteric threat model. But nothing precludes it.
(I keep wanting to convince you to drop some of these constraints, because I wanted the same thing at one point and I was happier after _I_ was convinced to drop those aspects, but I do not think our threat models overlap exactly, so this impulse is misguided.)
@glyph What I'd really like:
- I say "Authenticate with passkey" in Firefox
- I get a notification on my phone*
- I tap "authenticate" on my phone
- My phone contacts the appropriate server and/or some anonymizing proxy hosted by whoever forwarded the push notification, and does the authentication handshake with the server
It should be possible to just do this over the internet.
* For anti-phishing, maybe there is a symbol or 5-digit code on both firefox and the phone & you check if they match
@glyph that’s a surprising motivation given that this article gives a really strong explanation for why this seems unlikely to ever happen with this technology.
I admit to being willfully obtuse, but I’m still not clear on what a passkey is, in the way that I understand what a password is and what a second-factor physical token like the blue fido usb key is or what a Authenticator-like number-producing second factor is. And maybe that’s because it’s not one thing?
@glyph @mcc @whitequark It's my view that the "social problem of password reuse and account compromise" is a problem mostly for sites, not actual people, users, and trying to force users to change behavior & put themselves at risk of credential loss to solve it is hostile cost externalization.
Most compromised passwords are for garbage accounts people never wanted to have. They should have been offered ability to use service without account or with Craigslist style login.
@dalias @glyph @mcc don't a lot of people reuse passwords between "trash site nobody cares about" and "gmail with keys to their kingdon"? like this is how a bunch of high profile people got popped, afaik
i agree re: accounts being pointless, but also like... how would you enforce that? EU decree? no idea what else
Glyph
mcc
✧✦Catherine✦✧
Cassandrich
cthos 🐱
Ölbaum
Wolf480pl
Irenes (many)
Rob
Claudius Link
Kahanis