GlyphDec 30, 2024

This is a great writeup of the continuing failure of passkeys to meet their potential. It demonstrates the gordian knot:

1. the ecosystem is confusing due to the plethora of different interacting layers
2. therefore, to simplify, every vendor attempts to own as many layers as they can, obscuring other vendors' tools
3. therefore, users are confused into thinking that passkeys are platform-specific, because their platform vendor is obscuring alternatives

https://arstechnica.com/security/2024/12/passkey-technology-is-elegant-but-its-most-definitely-not-usable-security/

Passkey technology is elegant, but it’s most definitely not usable security

Just in time for holiday tech-support sessions, here’s what to know about passkeys.

Ars Technica
Show threadGlyphDec 30, 2024
This is a particularly painful and comprehensive example of an industry-wide trend, which is that vendors are expected to deliver things as fully-formed, self-explanatory products. Users, already justifiably wary of the upgrade treadmill, reflexively flinch away from anything that looks like a big learning investment, which means "user education" is treated as a sort of taboo, something that *cannot* be made a prerequisite to using a product, because if you're explaining, you've already lost.
Show threadGlyphDec 30, 2024
The failure of passkeys to date is a particularly dramatic example of this because it's extremely high-stakes, visible, and black-or-white (you're either switching your auth to passkeys or you aren't, whereas other apps you may use in a casual or incorrect capacity). But the same problem exists in other domains, and it's almost as bad.
Show threadGlyphDec 30, 2024
Almost every communication technology is like this. Email is bad so we *still* keep getting new email clients that try to "solve" email (or chat apps; remember when slack was going to "solve" email?). Don't worry, don't change your habits, you don't need to learn anything, just click this button. We made a "promotions" tab, and an "important" tab for you, so now you won't be overloaded. Just consume product, don't learn to be a better communicator. Here are some suggested AI replies.
Show threadGlyphDec 30, 2024
People need to develop sophisticated strategies and think deeply about their values and goals when using social media, but the only response that social media companies have to this is to introduce features or to constantly tweak their recommendation algorithms. Disinformation? Oh, that's okay, we'll block the word "suicide" so now everyone starts saying "unalive yourself in minecraft", great, teen mental health is solved. No need to have a difficult conversation about norms and pedagogy.
Show threadGlyphDec 30, 2024
I can't blame companies; users really do reflexively avoid learning, and have been conditioned to see their primary feedback mechanism as switching apps. If your app requires learning, you'll see massive churn and be harshly punished for that. I definitely can't blame users, who avoid learning because developing deep expertise with modern apps is rewarded by having your brains scrambled with constant A/B tests of everything being reshuffled to suit the users who *don't* put in effort.
Show threadGlyphDec 30, 2024
In a way, you can see the passkeys community pushing *against* this trend, trying to acknowledge this need, developing resources like https://webauthn.io to allow users and developers to cultivate a structured understanding of the technology as a whole, decoupled from vendor-specific solutions. But the ingrained product development habits from every vendor undermine this.
A demonstration of the WebAuthn specification

Demonstration of the WebAuthn specification.

WebAuthn.io
Show threadmccDec 31, 2024
@glyph I'm going to add something, it's not as big as the other problems you raised but I think it's a problem: Someone, somewhere, set it up so the non-vendor-locked version of passkeys so it *requires*, per the spec, for you to use Bluetooth, which simply means I will never use it. This is probably childish. But I am probably not the only person who hears "bluetooth" and immediately tunes out.
Show thread✧✦Catherine✦✧Dec 31, 2024

@mcc @glyph i am using non-vendor-locked passkeys with zero bluetooth

(keepassx supports it)

Show threadmccDec 31, 2024
@whitequark @glyph 🤔 are the passkeys stored on the same physical device that they are utilized on
Show thread✧✦Catherine✦✧Dec 31, 2024
@mcc @glyph yes
Show threadGlyphDec 31, 2024
@whitequark @mcc I'm not really clear on what "non-vendor-locked" means here, but it sounds like people aren't paying attention to an extremely stupid corner of the spec, so: great
Show thread✧✦Catherine✦✧Dec 31, 2024

@glyph @mcc i am using a password manager with a browser extension that lets me do passkey logins in most places i've tried to do them

keepassx stores them in the password database, like everything else it stores

it's a normal file

Show threadCassandrichDec 31, 2024
@whitequark @glyph @mcc AFAICT passkeys are a half-baked solution to a non-problem that was already solved by "use a password manager and let it generate strong passwords".
Show thread✧✦Catherine✦✧Dec 31, 2024
@dalias @glyph @mcc PKI-based authentication is strictly better than what you're suggesting since you can no longer steal a credential (other than from the password manager), no matter what happens with the browser or the website
Show threadCassandrichDec 31, 2024
@whitequark @glyph @mcc That's assuming you want to store the keys on a separate device, which is a really bad idea for most normal users.
Show thread✧✦Catherine✦✧Dec 31, 2024
@dalias @glyph @mcc i said nothing about a separate device
Show threadmccDec 31, 2024

@whitequark @dalias @glyph I said something about a separate device (in a different part of the thread)

Continuing from here:

https://mastodon.social/@mcc/113748384835298072

…in addition to the website not being trustable with your password, it's also possible the machine on which the web browser is running cannot be trusted with your password. This is an important case to me personally, not on *all* machines, but on some machines separately.

Here I note something important and problematic:

(Post 2 of 4)

Show threadmccDec 31, 2024
@whitequark @dalias @glyph The thing I want out of passkeys is completely different from what Catherine wants out of passkeys, which is (I think) different from what Glyph wants! I want SRP. I want authentication without the shared secret (password) having to travel from its trusted home (whereever that is) to the authenticating party, thus hitting peril from lazy/malicious Twitter engineers, malwared Microsoft Windows, etc. Glyph wants anti-fishing. Catherine wants (I think) convenience. (3/4)
Show threadmccDec 31, 2024
@whitequark @dalias @glyph Because we all want different things, some of us don't get them. Catherine seems satisfied with her passkey implementation, but glyph is not satisfied because for convenience it's been watered down to being not quite anti-phishy enough, and I— who wanted SRP but do not care at all about "phishing"— don't get SRP, because the "anti-phishing" rules erect barriers to me using my passkeys in the way I want (without transferring the keys to certain untrusted devices). (4/4)
Show threadmccDec 31, 2024
@whitequark @dalias @glyph Passkeys were trying to be too many things to too many people and I think this made them worse.
Show threadGlyphDec 31, 2024

@mcc @whitequark @dalias I think there is some validity to what you're saying—in particular, I think that passkey implementations could do a better job respecting individual autonomy and allowing individuals to provide input to their threat model, which the big vendors cannot have and is not universal.

But to the extent that "passkeys" are trying to do a thing, it's to solve a big *social* problem of password reuse and account compromise, which other solutions have demonstrably not addressed

Show threadCassandrichJan 1, 2025

@glyph @mcc @whitequark It's my view that the "social problem of password reuse and account compromise" is a problem mostly for sites, not actual people, users, and trying to force users to change behavior & put themselves at risk of credential loss to solve it is hostile cost externalization.

Most compromised passwords are for garbage accounts people never wanted to have. They should have been offered ability to use service without account or with Craigslist style login.

Show thread✧✦Catherine✦✧Jan 1, 2025

@dalias @glyph @mcc don't a lot of people reuse passwords between "trash site nobody cares about" and "gmail with keys to their kingdon"? like this is how a bunch of high profile people got popped, afaik

i agree re: accounts being pointless, but also like... how would you enforce that? EU decree? no idea what else

Show threadCassandrichJan 1, 2025
@whitequark @glyph @mcc One obvious mandate: to put a clear warning on the signup page: DO NOT GIVE US YOUR EMAIL PASSWORD.
Show thread✧✦Catherine✦✧
@dalias @glyph @mcc the problem is that people ignore these things
Jan 1, 2025 at 10:03amWeb
Show threadCassandrichJan 1, 2025
@whitequark @glyph @mcc Yeah but there's only so much you can do. One other feature that would help on the browser/pw-manager integration side: tracking "important" site passwords and interrupting/warning you if you try to use the same password on another site.
Show threadKahanisJan 1, 2025
@whitequark @dalias @glyph @mcc Makes me wonder if it would be legal to attempt to log in to the provided email/password via imap, and if it succeeds - reject it and tell the user "no really, do not use your email password here".
Show threadCassandrichJan 1, 2025
@Kahanis @glyph @mcc @whitequark Almost surely not legal, but.. nice? 😁 If you did this you'd also need to submit compromised account report, which would probably lock the user out of their email...