Passkeys are not a trap

A article called Passkeys are a trap. Do not use them. has been doing the rounds complete the final few days, making it beautiful elevated on Hacker News, and I've had it sent to me many times alongside an 'is this true?' benevolent of vibe. It's written for "non-technical citizens of the web", and the header direction is to halt using passkeys and go rear to TOTP codes and passwords.

The Argument

The article makes what appears to be one chief claim: Passkeys assistance item called attestation, which lets a website ask for cryptographic evidence of what made the passkey.

The author calls this a "hidden dial" and argues that sites volition gradually rotate it up, until you're lone allowed to log in alongside approved application on an approved functioning system, alongside no modifications, no LineageOS and no sharing your Netflix password. Throw in uBlock Origin, the FIDO Alliance affiliation catalog and the UK's image-scanning proposals, and the decision is that passkeys are "not designed to prioritize your interests". <that-escalated-quickly.gif>

It's a compelling story. It fair doesn't equivalent how any of this really works...

Your Passkeys Don't Attest

The passkeys most group use are synced passkeys, stored in iCloud Keychain, Google Password Manager, 1Password, Bitwarden or any another application of your choosing. These passkeys don't provision websites an attestation declaration at all, and although a location can ask, what comes rear is none. I cognize this since I wrote an opensource passkeys library and made it accessible to everyone.

If a person website decided tomorrow that it would lone obtain attested passkeys, it would fastener out nearly all of its own users, instantly. What website is going to do that? Besides, the direction for person sites has been to not equal petition attestation for years now.

Attestation Isn't What You Think It Is

The article describes attestation as proving "that an approved passkey manager, functioning system, and firmware are in use" which is merely not true.

When it is present, WebAuthn attestation tells the location the create and example of the authenticator, identified by its AAGUID, alongside a certificate sequence from the vendor to rear it up. It says nothing concerning your OS, your browser, your extensions, whether your phone is established or jailbroken, your firmware version, or equal what color it is.

The YubiKey Recommendation

This is the part that amazed me the most. For group who desire stronger security, the article recommends a hardware safety key akin a YubiKey, since it "avoids OS-wide attestation".

YubiKeys are the authenticators that do attestation. Every one of them ships alongside a Yubico-issued attestation certificate, and endeavor attestation exists specifically so organisations can necessitate approved hardware keys. I'd motionless propose a YubiKey to anyone who wants one, they're outstanding and I use them, but if attestation is the item you're concerned about, the post's own advice pushes you towards attestation fairly than distant from it!

TOTP Is a Step Backwards

The article holds up TOTP as "already" a awesome solution. TOTP is improved than a password alone, absolutely, but it has one big weakness: you can category the code into the incorrect website, just ask my fine companion Troy Hunt. Phishing kits akin Evilginx sit in the middle, relay your password and code to the genuine location in genuine time, and stroll distant alongside your session. This isn't theoretical, it's how a huge figure of document takeovers happen today and we have the evidence to demonstrate it.

This is the issue that passkeys solve. A passkey is border to the domain it was created for, so your browser merely won't use your example.com passkey on examp1e.com. There's no code to peruse out and nothing for the person to get wrong. The author equal concedes this in the addendum, saying that passkeys are domain-bound and oppose man-in-the-middle attacks, but motionless tells readers to evade them. Swapping a phishing-resistant credential for a phishable one is a really bad trade...

What You Should Do

Keep using passkeys! Wherever a location offers one, obtain it, and shop it in a password/passkey director you trust. If you desire to be capable to move your credentials around, choice a provider that supports that. If you're concerned concerning attestation creeping into person logins, afterward that's value pushing rear on, loudly (if it always happens). But it hasn't happened, the biggest providers don't assistance it, and avoiding passkeys today during you delay for it won't defend you from anything, it fair leaves you open to phishing.

Sources

I have several cognition in this area:

I created WhyNoPasskeys.com to track the preparedness of passkeys on the Web.

I built and deployed passkeys assistance on my own SaaS company.

We built our own passkeys archive and had it safety reviewed.

I wrote concerning Security considerations whenever using Passkeys on your website.

I wrote Passkeys 101: An Introduction to Passkeys and How They Work.

I made our passkeys archive opensource for everyone to use.

I've done extensive safety testing of passkeys implementations.

I've openly acknowledged the restrictions of not using attestation on passkeys.

I think most of all that it's crucial to say I use passkeys everyplace I can since they're currently the finest item we have accessible to defend our accounts. And they're not a trap.