I’m taking a wait-and-see approach to passkeys, myself, but the author omits what seems to be the greatest advantage of passkeys over a password + TOTP combo from a user perspective: they offer resistance against phishing attacks.
TOTP protects you against attacks where an attacker manages to get hold of your password and attempts to log in remotely, since the TOTP presents an additional barrier, and you’re probably not going to respond to a random text or email that says, “Uhhhh can you send me a code from your authentication app real quick?”. But if you get phished and unknowingly attempt to log into a malicious server, you’ll happily give them your password and TOTP.
With passkeys, the challenge presented by a website is cryptographically signed and tied to the domain for which you originally generated the passkey. Even if you end up on a phishing website, if the site sends you a challenge that is either not originating from the domain associated with your passkey (e.g. from the phishing domain itself) or not originating from the domain you’re currently on (as would be the case if the phishing server were passing on a challenge from the legitimate domain), it can be trivially detected and refused by the client.
Whether security against that particular kind of attack is worth the privacy/control trade-offs to you is a personal decision[1]—thus far, I’ve decided it’s not worth it. My policy has long been to never click links in email/texts/etc. that will require authentication—I go directly to the website, sign in, and then navigate to the indicated page. That wouldn’t protect against an attack where a malicious actor gains control of the legitimate website, but neither would a passkey, to my knowledge.
I recognize that this may stop being a decision that I’m even allowed to make, which is kinda the whole point of the article, but I’m just talking in the near term. ↩︎
I’m taking a wait-and-see approach to passkeys, myself, but the author omits what seems to be the greatest advantage of passkeys over a password + TOTP combo from a user perspective: they offer resistance against phishing attacks.
TOTP protects you against attacks where an attacker manages to get hold of your password and attempts to log in remotely, since the TOTP presents an additional barrier, and you’re probably not going to respond to a random text or email that says, “Uhhhh can you send me a code from your authentication app real quick?”. But if you get phished and unknowingly attempt to log into a malicious server, you’ll happily give them your password and TOTP.
With passkeys, the challenge presented by a website is cryptographically signed and tied to the domain for which you originally generated the passkey. Even if you end up on a phishing website, if the site sends you a challenge that is either not originating from the domain associated with your passkey (e.g. from the phishing domain itself) or not originating from the domain you’re currently on (as would be the case if the phishing server were passing on a challenge from the legitimate domain), it can be trivially detected and refused by the client.
Whether security against that particular kind of attack is worth the privacy/control trade-offs to you is a personal decision[1]—thus far, I’ve decided it’s not worth it. My policy has long been to never click links in email/texts/etc. that will require authentication—I go directly to the website, sign in, and then navigate to the indicated page. That wouldn’t protect against an attack where a malicious actor gains control of the legitimate website, but neither would a passkey, to my knowledge.
I recognize that this may stop being a decision that I’m even allowed to make, which is kinda the whole point of the article, but I’m just talking in the near term. ↩︎