“Passkeys,” the secure authentication mechanism built to replace passwords, are getting more portable and easier for organizations to implement thanks to new initiatives the FIDO Alliance announced on Monday.

  • Gutless2615@ttrpg.network
    link
    fedilink
    English
    arrow-up
    78
    arrow-down
    15
    ·
    edit-2
    21 days ago

    Literally just use a password manager and 2/MFA. It’s not a problem. We have a solution.

    • shortwavesurfer@lemmy.zip
      link
      fedilink
      English
      arrow-up
      45
      arrow-down
      3
      ·
      21 days ago

      Actually, it is still a problem, because passwords are a shared secret between you and the server, which means the server has that secret in some sort of form. With passkeys, the server never has the secret.

      • Gutless2615@ttrpg.network
        link
        fedilink
        English
        arrow-up
        15
        arrow-down
        5
        ·
        21 days ago

        The shared secret with my Vaultwarden server? Add mfa and someone needs to explain to me how passkeys do anything more than saving one single solitary click.

        • 4am@lemm.ee
          link
          fedilink
          English
          arrow-up
          23
          ·
          21 days ago

          When a website gets hacked they only find public keys, which are useless without the private keys.

          Private keys stored on a password manager are still more secure, as those services are (hopefully!) designed with security in mind from the beginning.

          • weststadtgesicht@discuss.tchncs.de
            link
            fedilink
            English
            arrow-up
            4
            ·
            20 days ago

            If a website with old-school passwords gets hacked, the hacker only gets salted hashes of passwords - this does not seem to be much worse?

            (Websites that store plaintext passwords surely won’t implement passkeys either…)

        • shortwavesurfer@lemmy.zip
          link
          fedilink
          English
          arrow-up
          12
          arrow-down
          1
          ·
          21 days ago

          Pass keys are for websites such as Google, Facebook, TikTok, etc. And then they go into what is currently your password manager or if you don’t have one, it goes into your device. You still have to prove to that password manager that you are, who you say you are, either by a master password of some sort or biometrics.

      • Programmer Belch@lemmy.dbzer0.com
        link
        fedilink
        English
        arrow-up
        18
        arrow-down
        9
        ·
        21 days ago

        Best password manager is offline password manager.

        KeepassXC makes a file with the passwords that is encrypted, sharing this file with a server is more secure than letting the server manage your passwords

        • hikaru755@lemmy.world
          link
          fedilink
          English
          arrow-up
          15
          arrow-down
          1
          ·
          20 days ago

          This is not at all relevant to the comment you’re responding to. Your choice of password manager doesn’t change that whatever system you’re authenticating against still needs to have at least a hash of your password. That’s what passkeys are improving on here

        • shortwavesurfer@lemmy.zip
          link
          fedilink
          English
          arrow-up
          4
          arrow-down
          1
          ·
          21 days ago

          I agree, and that’s my method as well. Although I do not ever share the file with a server either. I only transfer it from device to device with flash drives or syncthing.

          • a baby duck@lemmy.world
            link
            fedilink
            English
            arrow-up
            1
            ·
            20 days ago

            How do you handle merging between devices? Do you manually transfer/sync every time you add a new password?

            Not trying to sell you on putting it in cloud storage or anything, but one really nice benefit to doing so is automatic merging through clients like Keepass2Android. If I add a new site to my phone and it doesn’t already have the latest copy of my vault, it’ll fetch and merge that first.

            • shortwavesurfer@lemmy.zip
              link
              fedilink
              English
              arrow-up
              1
              ·
              19 days ago

              Technically yes I don’t have to use a desktop or laptop very often and do most of my computing from my mobile phone running lineage OS obviously and so what I do is if I add a password once every quarter at least I back it up to a flash drive so that if nothing else I will only lose a few months worth of data. I also don’t go signing up for accounts and services all that often since I am particularly interested in keeping my privacy. So very few modifications occur with my passwords in three months. If I absolutely must get a new password onto my laptop immediately, then I will go ahead and plug in my flash drive and manually synchronize whenever that is required as well.

      • huginn@feddit.it
        link
        fedilink
        English
        arrow-up
        7
        arrow-down
        3
        ·
        21 days ago

        You can share passwords without the server seeing them. Many managers don’t but there’s nothing infeasible there. You just have a password to unlock the manager. Done.

        • shortwavesurfer@lemmy.zip
          link
          fedilink
          English
          arrow-up
          9
          arrow-down
          4
          ·
          21 days ago

          What I’m getting at is that a web server has a password, in some form. And so if that site gets breached, your password itself may not get leaked, but the hash will. And if the hash is a common hash, then it can be easily cracked or guessed.

          • huginn@feddit.it
            link
            fedilink
            English
            arrow-up
            10
            arrow-down
            1
            ·
            21 days ago

            Ultimately I’m pro passkey but when it comes to password managers: if the hash of your vault is easy to crack you’ve fucked up big time. There shouldn’t be any way to crack that key with current tech before the sun explodes because you should be using a high entropy passphrase.

          • theherk@lemmy.world
            link
            fedilink
            English
            arrow-up
            4
            ·
            21 days ago

            Not anything sufficiently modern. Salted passwords should be exceedingly difficult to reverse.

    • huginn@feddit.it
      link
      fedilink
      English
      arrow-up
      27
      ·
      21 days ago

      Never forget that technologically speaking you’re nothing like the average user. Only 1 in 3 users use password managers. Most people just remember 1 password and use it everywhere (or some other similarly weak setup).

      Not remembering passwords is a huge boon for most users, and passkeys are a very simple and secure way of handling it.

      • funkless_eck@sh.itjust.works
        link
        fedilink
        English
        arrow-up
        20
        ·
        21 days ago

        I work for multiple organizations. The majority of which have a Google sheet with their passwords in that are

              c0mpanyname2018! 
        

        Those that aren’t are

               pandasar3cute123? 
        
        • Echo Dot@feddit.uk
          link
          fedilink
          English
          arrow-up
          2
          ·
          edit-2
          20 days ago

          At one point the organization I work for had a password that was literally Password-022!, guess what it was the following month?

        • Prison Mike@links.hackliberty.org
          link
          fedilink
          English
          arrow-up
          1
          ·
          20 days ago

          I had to start hashing passwords and sending it to the haveibeenpwned API.

          I also fight with my users over data normalization because any time I add some rule (like don’t put “SO#” as part of the value of the “SO#” field), they’re too stupid to realize the point and find some other “hack” around it.