The authors concern is primarily about attested and user-verified passkeys.
I’m taking a wait-and-see approach to passkeys, myself, but the author omits what seems to be the greatest advantage of passkeys over a password + TOTP combo from a user perspective: they offer resistance against phishing attacks.
TOTP protects you against attacks where an attacker manages to get hold of your password and attempts to log in remotely, since the TOTP presents an additional barrier, and you’re probably not going to respond to a random text or email that says, “Uhhhh can you send me a code from your authentication app real quick?”. But if you get phished and unknowingly attempt to log into a malicious server, you’ll happily give them your password and TOTP.
With passkeys, the challenge presented by a website is cryptographically signed and tied to the domain for which you originally generated the passkey. Even if you end up on a phishing website, if the site sends you a challenge that is either not originating from the domain associated with your passkey (e.g. from the phishing domain itself) or not originating from the domain you’re currently on (as would be the case if the phishing server were passing on a challenge from the legitimate domain), it can be trivially detected and refused by the client.
Whether security against that particular kind of attack is worth the privacy/control trade-offs to you is a personal decision[1]—thus far, I’ve decided it’s not worth it. My policy has long been to never click links in email/texts/etc. that will require authentication—I go directly to the website, sign in, and then navigate to the indicated page. That wouldn’t protect against an attack where a malicious actor gains control of the legitimate website, but neither would a passkey, to my knowledge.
I recognize that this may stop being a decision that I’m even allowed to make, which is kinda the whole point of the article, but I’m just talking in the near term. ↩︎
Mozilla wants to avoid having to die on any particular hill.
Yeah that’s liberals for you.
What’s important to know is that unlike with any other kind of login credential, you do not have ultimate control over your passkeys.
I get where they are coming from, when using the Apple or Google provided storage, but this is just plain false, bordering on misinformation, when generalized like this.
I have full control of all passkeys that I’ve manually created. They are stored on my physical, usb-security-key. I have some stored in a self-hosted vaultwarden instance. I understand not everyone cares enough to go these routes, but they are possible and part of the standard. They work. Nobody but me controls them. I can give access to others, either by handing them the physical key with the associated pin, or by letting them access them via a vaultwarden account on my instance. Nobody but me controls them.
As is explained in the article.
Kinda, but it’s basically a footnote. I wanted to highlight it since the headline and most discussions completely ignore it. Someone who only reads those will hopefully come across my comment as well.
What’s important to know is that unlike with any other kind of login credential, you do not have ultimate control over your passkeys.
You only have as much control over any login credential as the provider gives you. At the end of the day, if you have a password or TOTP seed registered with me, I can revoke the binding for any reason and make you re-register. Writing it down somewhere or sharing it with somebody doesn’t matter if it’s not bound to your account anymore.
If you won’t trust a service provider with a passkey, I’m hard pressed to think why you’d trust that service provider with anything.
The conspiratorial angle is also kinda strange: https://commission.europa.eu/topics/digital-economy-and-society/european-digital-identity_en A digital ID with identifiable PII that the surveillance capital state can abuse via central management and is associated with every transaction is the desired end-state for capital and other wielders of power.
The problem is not passkeys in themselves, but the role they might play in making remote attestation ubiquitous. Remote attestation locks in an oligopoly from hardware through operating system, and the operating system vendor can apply any restrictions they want. Remote attestation is already a problem for users of aftermarket operating systems on phones, but not a ubiquitous one because it mostly only affects payment and some banking apps.
Every time passkeys come up, I am roundly assured that attested passkeys are DOA, because starting to require them would force Apple to revoke all of its existing passkeys. But I don’t have confidence that that’s a sufficient deterrent.
The conspiratorial angle is also kinda strange: https://commission.europa.eu/topics/digital-economy-and-society/european-digital-identity_en A digital ID with identifiable PII that the surveillance capital state can abuse via central management and is associated with every transaction is the desired end-state for capital and other wielders of power.
What now? Is it strange or is it entirely expected?
Specifically the conspiracy theory that passkeys are some kind of backdoor is strange to me:
For intelligence agencies, and for corporations like Microsoft, Google, Apple, Facebook, Amazon – giving you convenience and security is likely not their primary goal. I think they have an entirely ulterior motive. They can use passkeys to prevent you from running unapproved software.
And:
I’m not one to argue about slippery slopes, so I won’t claim that the campaigns to protect children online today will tomorrow turn into laws designed to make it easy to identify political dissidents. But I will say that the widespread adoption of the passkey technology being advertised to you as convenient and secure is capable of permitting such laws to be easily enforced.
The ulterior motives are really around cost of managing credentials and having better assurance that a user is who they claim to be. Instead of paying to have a help desk or a password reset service they can offset the cost to you to have the necessary computing modules or hardware keys to authenticate. Passkeys will fall out favor quick when the major governments have the digital IDs deployed en masse. And there are better and more effective means to achieve the other ends the author is worried about, like having a monopoly on 96% of web browsers or killing the market for PCs.
Passkeys will fall out favor quick when the major governments have the digital IDs deployed en masse.
These are literally the same thing. Digital ID is a policy, passkeys are a mechanism. By combining them, you implement a digital ID policy. I grant you that the implementation of a digital ID policy doesn’t necessarily need to use this technology, nor does this technology lack other useful purposes, but we live under the regime of technological capitalism, where innovation is driven purely in the pursuit of maximizing profit and consolidating power.
The author is fully justified in being suspicious of the motivations of such an infamous coalition including the likes of Apple, Google, Microsoft, Meta, American Express, MasterCard, Bank of America, Wells Fargo, JP Morgan Chase, HSBC, Softbank, Binance, and Coinbase, among others. This is a substantial confluence of Wall Street finance, Silicon Valley venture capital, and every tech company large and small who is lined up to sell shovels in the gold rush of a pending transformation of digital power relations. The threat should be taken seriously, at least.
None of these firms are concerned with our best interests. By now we should assume any implementation which leaves room to further encroach on individual autonomy is a deliberate strategy.
Great article. I’ve ranted about passkeys before but this does a way better job explaining why they’re such a problem. Its always about removing autonomy with these fuckers
The only part that is relevant re: trap is about a specific kind of passkey that is restricted to certain hardware, meaning if you have to authorize with it you are giving up control on how it can be used over to that hardware. Like a TPM chip or one of those USB keys.
It’s true that having that required could be a slippery slope, like requiring biometrics. Though even then current standards don’t pass biometric data out of the security chip.
At the same time there are companies and governments that have required similar things since before passkeys were common. They were just more expensive and less standard. They are just different levels of proving identity. The risk or absurdity is in the level of identity they could ask you to provide, the hoops you have to jump through, and the slippery slope of what more they could keep trying to ask for. But I really think that’s independent of this technology, it’s just a vehicle for the author to raise concerns about it and in that case their focus is on the wrong thing.
They should be focused on banning PII collection. Passkeys are actually an enabling technology for privacy and anonymity in nearly all of their iterations. They are basically a combo of username and password that can be put in a secure vault, so you can in theory just rely on having a few registered at a website and never need an email, phone number, etc. Your login is any registered passkey. Your recovery method is to use any of the backup keys you registered. But consider the current status quo of websites where you pay for something. You have to provide email, name, phone number, and billing info. You are fully personally identified. Passkeys provide much less information than that.
They should be focused on banning PII collection.
Fat chance.
TOTP is great and works great. I can maybe see passkeys for an org where they want control over access at an org level, but at that point you’re probably using Kerberos or something.
This is a solution in search of a problem (the problem being people sharing passwords for services)
I gotta start signing my posts with this. what the fuck
