Pepperidge Farm Remembers when the FIDO Alliance threatened to recommend the blocking of FOSS implemententions because they gave the users control. Control over backing up. Control over not using biometrics.
When something wants too much power, you must avoid.
FIDO 2 level 2 also requires the supply chain documented and a bunch of expensive certificates, which locks small vendors and open hardware implememtations out.
Zero trust is the end station, if you allow organizations to treat your personal devices as being theirs. Organizations that could actually benefit from the increased security (which isn’t Twitter, except for some high-profile individuals, maybe), should provide the user with resources to do so, at their expense (issuing a dedicated TOTP device for example).
But what tends to happen instead, is enshittification of service, while offloading it onto the client. A similar trend can be observed with car parking: where operators remove parking meters, and require the customer to use their device and data plan, to make a payment to the operator…
We’ve been on this trajectory for quite a while now: from Outlook enforcing IT-policies of email administrators (dictating screen locking requirements as device administration app), to SMS-based 2FA requiring one to have a mobile phone number and tying all to this tamper-resistant identifier. So why not a black box snitch, paid for by the client, further restrict their freedom for “security”?
It seems perfectly in line, and I think this article draws all the right parallels.
Passkeys mean a spread of enshittification to ever more areas of life. Specifically, they
- force me to use an extra OS on an extra device and keep it around just to use a site with passkeys.
- add insecurity and inconvenience. I neither can backup the passkeys nor use them on another device. (That’s not implemented on Windows.) This user experience is laughable in 2026. The passkeys are forever locked on the device where I created them. I am forever chained to exactly one device. If it breaks down, my life ends because our lives depend on digital technology.
- take away control from me and force me to trust third parties. I have to trust the hardware, the OS, the proprietary software, which makes me feel very uncomfortable as someone used to use Free software. Security by obscurity was always a bad idea.
- deny me anonymity and control over my accounts. I can have only one account per domain.
- are a black box with no user interface. With passwords I know exactly what account name and password I enter at which site. With passkeys I get asked for a PIN. That is all. There is no indication what exactly I authorize. This is a lot like clicking links in emails and giving your banking details to everyone who asks.
The recommendation “do not use them” is cute. They are forced on people. I can’t choose.
I’m not familiar with any of these limitations that you described. Those might be limitations of the specific credentials manager(s) that you’re using. You might want to try a different one.
Yeah I’m confused. I also don’t remember ever using a site tha would force use of passkeys. I always have standard TOTP alongside those.
some of this is disingenuous. For example you’re supposed to make multiple passkeys for your devices so that you can still Access your Accounts even if you lose your Main device (Ofc its still shitty because this forces you into the cloud if you only have 1). Also thats why the passkeys being bound to their „birthplace“ is Not really more of an issue than the others. Also im Not sure where they are forced? In fact i wish it would be more supported in certain apps
Indeed. Every device should get a passkey. Its like client certs where you can lose a device and just remove that passkey from your account. Also, you /can/ store passkeys in pure software. Bitwarden can store passkeys for example. Lots of options for FIDO keys too. I have never heard a non technical person give me a secure password strategy. That is 100% of nontechnical people I have asked use bad password schemes. Passkeys at least enforce a truly randomly generated key.
They still suck at usability but it is an attempt to solve a real problem. Basically the only thing standing between 99% of people and having all their accounts compromised is service password attempt rate limiting.
You think an everyday user will think this way?
That’s how they work, regardless of how users think. Though you’re correct: the majority of computer users don’t understand what they’re doing and do feel threatened by change, even if that change is positive by any measure other than “I feel uneasy about changing something I have no grasp on”.
Regardless of if a regular user will think this way or not, it is good to have options, precisely for providing them as an option to a regular user, even if they end up not implementing them. The other option is NOT having the option. Which one do you think is more beneficial across the board?
For example you’re supposed to make multiple passkeys for your devices How do I do this? Can you link to a guide?
Also im Not sure where they are forced? The big transition is underway. Switch to passkeys or you are out.
Log in to a website that supports passkeys, go to the account security page, press add passkey. Your browser looks for connected security keys to add the passkey to or if you have an extension installed, it might start your password manager. in the security key case; It asks for your pin and it’s done. If you use a password manager to store it, it will ask you where to put it. Once done; you can repeat and add any number of passkeys to your security keys or database. You should do at least two, for redundancy.
I would not tie my passkey to windows/ios/android or whatever. I won’t let a third party manage or sync them. Only on a security key I own or my password database.
An attempt to make an image describing where passkeys live:
It’s funny because I can’t see it and when I view the code of your post and copy/paste it into the location bar I get the broken jpeg picture.
Edit: At the time of upload it was a png. I guess lemmy.zip made the choice to convert it.
It’s even more apropos that the fediverse behaves unpredictably when uploading images.
Passkeys in a nutshell: how does it work? Idk. Who’s in control of it? Idk.
I wasn’t able to see the image because it’s an avif. What a weird format and choice of format.
Apropos of a discussion about over complicated unpredictable passkey behavior.
As far as I know using a password manager such as KeePassXC or Bitwarden solves all of these problems?
The way i understand it is that remote attestation (main point of this article) makes it possible for services to deny unapproved software. They can deny off market devices, operating systems, or certain password managers. So even if you use password managers you mentioned, if you’re using off market OS (e.x lineageos) they can deny access. Here’s a quote from the article “Remote attestation lets a website demand cryptographic proof that your device, operating system, firmware, and passkey manager are all on an approved list.”
Hm, so similar to websites blocking user agents now.
Make that question mark a period, good sir/ma’am!
and your redundant 3-2-1 backup system of that. Everyone knows that! Surely no one has no backups. Oh well, can’t design around that unpredictable problem that no one could guess. Everyone has backups!
I mean I would hope so, but losing a password manager database sucks regardless if you used passkeys or not.
Please just stop using a service when it gets unbearable. There is no online service you -need- except maybe bank and tax stuff.
And for the bank, you can always switch to a better bank.
This is why I only use passkeys that are stored in my self hosted vault warden. As long as you don’t create passkeys locked to a vendor’s manager, I don’t see any reason to avoid them.
This is the feature that means you no longer get to make the calls about your passkeys. Fortunately, attested passkeys are not yet required on most websites. But the FIDO Alliance standard makes attestation a part of the passkey ecosystem, whether you want it or not. And even if the website doesn’t require attestation now, simply by using passkeys you indicate to the website that your setup supports the FIDO Alliance’s passkey standard and that you as a user are capable of using passkeys.9 This means that once Twitter (formally X) is satisfied that the overwhelming majority of its users would be unaffected, they can flip the switch – perhaps not all at once, perhaps just for ten thousand users at a time so as not to cause a fuss – and start rejecting non-attested passkeys.
Critically, remote attestation requires the co-operation of your cryptoprocessor, your passkey manager software, your device’s operating system, and your device’s firmware to all pass the remote attestation check. After all, your phone’s operating system has total access to all the 0s and 1s in every app that’s ever run, so it’s not enough for Twitter (formally X) to trust your passkey manager if it can’t even trust your phone’s underlying operating system. If any single one of those things were to fail – say, because your phone stopped receiving security updates so you installed a custom operating system like LineageOS to keep yourself safe without having to buy a new device – then Twitter (formally X) will be able to notice and prevent you from logging in.
Remote attestation can allow them to verify that your device is not capable of, say, sending and receiving encrypted messages, or running a competitor’s app, or using social media without verifying your ID. They don’t want you to be able to turn off the mandatory built-in AI image scanner on your phone that scans everything your phone sees for nudity. (Yes, I’m serious.)
The convenience of using passkeys is a double-edged sword.
This is also one of the ways Playstation stops you from installing Linux and other unauthorised software on the PS5.
So it’s HDMI for login? Thanks, I hate it.
Despite the attention-grabbing headline, the only negative thing I can find in the article about passkeys are this section:
Attested passkeys7 are the last but most important type of passkeys you need to know about. These types of keys use what’s known as remote attestation to cryptographically verify – using the aforementioned tamper-proof cryptoprocessor that lives in all your modern devices – that you are using one of the several approved passkey managers, and not using a custom one that you vibecoded yourself and which can lie.
This is the feature that means you no longer get to make the calls about your passkeys. Fortunately, attested passkeys are not yet required on most websites.
I don’t see why we should assume this hypothetical is going to happen. There is a lot of different software that supports passkeys (I use keepass for example), and going against the open standard and forcing all their users to use a specific software would basically make them unusable.
Overall every password / login style has its dangers and bad ways to use it, including passkeys. That doesn’t make them “traps”.
Also, like, if it doesn’t allow me to set up a passkey because my manager or OS is not supported…I guess I’m not setting up a passkey then, which is OK by me, so there is no problem.
No problem until they make every other method more and more difficult. Which is already happening.
I only use passkeys when the alternative is an onerous song and dance.
The only area I could really see this taking off is with internal company stuff. Like forcing employees to use a very specific and weird way to do 2FA is already a thing in a lot of companies. They won’t let you just use any old authenticator app. You need the “special” one that sucks ass. So maybe they’ll do the same to passkeys, but for normal users I don’t think they’d do that. Users are way too bad at doing things. It would cause too much of a tech support burden or just user bleed.
finally people are waking up to this garbage.
Ah there’s that phrase again, remote attestation. That has very quickly become my least favourite phrase, and I’ve yet to see an example of it that benefits the end user. I didn’t know passkeys supported it but I’ll be avoiding them even harder now that I know they do.
I’ve already been avoiding them because I don’t see how there’s any security advantage over TOTP unless the passkey is the only way to access the account (which would be awful for account recovery). And the concept of tying my login to a specific device is stupid. I also don’t appreciate how many websites keep trying to stealthily create passkeys automatically on login without explaining what they are or letting the user make an informed decision.
I’ve already been avoiding them because I don’t see how there’s any security advantage over TOTP…
I’m not going to challenge your choice in using passkey or not. However, I do want to set the “technical record straight”: passkey is the successor to TOTP in every technical way*.
TOTP works by having a “shared secret” saved by both you and the place that your authenticating against. This shared secret is then mixed with current time to generate a rotating number that the client shares with the remote server. The remote server does the same calculation, if the rotating numbers match, the user is successfully authenticated.
With TOTP, this means that there are two attack vectors: your device and the remote server. If an attacker is successful in getting the “shared secret” from either, your TOTP is effectively broken.
Passkey works more like ssh-keys. The client generates a public and private keypair. The client only shares the public portion with the remote server and stores the private key locally (or in your password manager).
So the only attack vector (with passkey) is your device (this is often why it’s bundled with attestation). Also passkey is not dependant on both the client and server having their time kept in sync. With TOTP, if you have more than ~30 seconds drift between the client and server, they will be generating different rotating codes and never match (which is confusing when you need to explain this to your Grandma).
- there is one thing TOTP can do, that passkey cannot: TOTP is 2FA, your TOTP can reside on a separate device (ie your phone when logging in using your PC). With passkey, you’d need to enable 2FA on the passkey manager (which varies from manager to manager).
…unless the passkey is the only way to access the account (which would be awful for account recovery).
Recovery options are never going to go away. With TOTP, you often have one-time use backup codes. Email, SMS recovery etc.
Oh that’s good to know, I didn’t realise TOTP was vulnerable on the server side. I’m still going to steer clear of passkeys for now though.
Thank you so much for clearly and concisely explaining how TOTPs are kept in sync between server and user. I KNEW the answer couldn’t be “magic”.
This is actually a terrible take. Passkeys provide a very large security benefit over passwords and have an open standard.
It’s particularly ridiculous that they seem to think TOTP good passkey bad. They solve the same problem: symmetric persistent encryption like passwords is very weak. TOTP solves this my making it not persisting and passkeys solve this by making it asymmetric. Passkeys are mildly more convenient because you don’t have the copy a code over.
Both also have the same potential for abuse, any service could require you use their specific app. The fact that this article makes it sound like TOTP is a perfect open standard while passkeys are a Trojan horse for abuse is ridiculous. If most services are using the open standard for TOTP why wouldn’t they for passkeys? Also not all services do obey the open standard for TOTP. I’m sure I’m not the only one who was forced to install the duo Authenticator because their institution was somehow sold on their protocol being stronger than the open standard.
TOTP and passkeys are comparable and both with doing.
Did you even read it? It bends over backwards to espouse the positive aspects of passkeys before getting into the control issues.
Both also have the same potential for abuse, any service could require you use their specific app.
That’s not true. TOTP is just a mathematical formula for how you mix a “shared secret/seed” with the current time.
In the authors article, they mention that you could write your own python program to generate the correct rotating numbers.
There is no way Big Tech could force you to use a specific app, because at the end of the day, TOTP is just math. 1+1=2, that could be calculated by you, your cellphone, or me - it doesn’t matter.
According to the article, Passkeys, on the other hand include a bunch of metadata. For example, can this passkey be copied or moved to another device.
The article is also very clear that all those fields can be faked except attestation.
And for those at home, attestation is a cryptographically secure way for an application to be certain that the application, operating system, and hardware are not modified to work in a way that the OS provider, application, and hardware vendor expect it to.
This has been abused by google/android to prevent/limit people from installing applications outside of the google play store, its been uses to force people to only use google-approved os’ (no cfw, no grapheneos). The same technology is a requirement for windows 11 (TPM).
Now, if FIDO agreed to not include attestation as part of the metadata - this would not be a discussion: everyone would love and use passkey, as you (the user) get to decide how to store/backup and (optionally) share this key.
But that’s not what FIDO did, the attestation flag is included in the metadata. And the author speculates that once people accept passkey, Big Tech will turn the screws and then start to force how you store your passkeys.
So, in an apocalyptic future “coming soon”, when you try to log onto your bank, you’ll be greeted with an error:
“We detected that your passkey is stored in the cloud. Your security is important to us. Please, install your new passkey onto your local device using your manufacturers approved Google Android Operating System and Google Approved passkey application.”
Really there is no way big tech can force me to use their app? Ok so you know how the open standard for TOTP is a six digit code computed from the time and shared secret? Well every student at the university of California and every employee at many companies across the US has to use an Authenticator app called duo which uses a 3 digit code generated by the app at the moment you attempt to log in. How does it do that? No idea it’s closed source. Is it even a formula like the TOTP open standard? Probably not I’d guess duos servers just send a code to both sides when you attempt a login. And would you look at that suddenly we have TOTP that I can’t write myself and I’m forced to use some shitty app.
Now I do recognize the point you’re making but I want to emphasize it’s not about attestation being in the metadata or not. It’s about open standard compliance. As the open standard is written even if you have to have hardware attestation you can build the passkeys yourself (because this is functionality all password managers are quickly starting to have) and frankly having each passkey being device locked is good security practice to protect you from credential stealers and related malware. You’d still be in control and you could still sign in to as many devices as you want. You’d just need to make a new passkey for each one if you don’t wanna sign in the old fashioned way with a password and dual factor and such.
The abuse scenario you describe would require a departure from the open standard. Is this possible? Of course. As I said some companies already do this with TOTP. But I don’t see that as a structural fault of passkeys that TOTP somehow doesn’t have like the article tries to imply. Both only work well for the consumer if the open standard is adhered to.
And would you look at that suddenly we have TOTP that I can’t write myself and I’m forced to use some shitty app.
I think our definition of what TOTP is, differs. When I say TOTP, I mean TOTP as defined as a standard in RFC 6238.
The behaviour you’re describing with duo is something else, something proprietary. In my mind, duo would be an One Time Password (OTP).
sidenote: TOTP is a specific/narrow implementation of the larger umbrella OTP.
It’s about open standard compliance.
Maybe I’m getting hung-up on semantics, but attestation is an open standard, like gpg is. With gpg you can implement your own encryption/decryption according to the gpg specification and your encrypted data will still be safe because you’re trusting the math behind the Asymmetrical Encryption.
Attestation is identical, but at the hardware level. The public/private keys are created by the hardware manufacturer. The private key is (often) isolated and stored in the CPU (or in a dedicated chip). The public key is freely published, so OS/application vendors know how to validate that an attestation response wasn’t faked. The private key is not exposed and even if it were, the public key could be revoked by the OS/application.
Attestation is great for device level security, but makes it nearly impossible to create backups/clones. :(
Corporations want what they’re terming phishing-resistant passkeys, which have two approaches: hardware-based or synchronized passkeys. If they are forced upon us for certain services or jobs, the least harmful to a worker is a synchronized passkey. Password managers like Bitwarden support this, so that you don’t have vendors and employers tracking your cell phone. If an employer uses something like Microsoft, the administrator settings may not allow synchronized passkeys…but at least we can advocate for them when these auth methods are forced upon us.
I suspected as much, being shoved on us like AI.
