Meanwhile, half of the people at every company I’ve ever worked at:
If the computer is in even a marginally secure place, storing passwords on physical paper is better than what a lot of people do.
Of all the proverbial bullets I’ve been hit with, none had my name on them; they were all addressed “To whom it may concern”. The times my identity has been stolen or my accounts compromised it was because somebody attacked some fairly large entity, like Alphabet or Equifax or Microsoft or Visa. Nobody’s going to walk into my house looking for my passwords. They might walk into my house looking for my television, but that hasn’t happened to this house longer than I’ve been alive.
Yep, there’s a reason 2FA recovery keys are usually printed and stored safely.
With that said, one way to avoid someone compromising service A due to somebody breaking into service B is to have different passwords everywhere, so a Password Manager is more convenient anyway.
Which is why I use a password manager. There are some passwords that I do keep human readable and typeable, like my home wi-fi password, because…enter a password like ghQ953mGh0hY0eo5vgnj;lse%tp[n9a36 into my niece’s Switch Lite when she comes to visit. For that I do the CorrectHorseBatteryStaple thing. But for most passwords for services that aren’t in my physical control I use my PM’s random string generator.
For home Wi-Fi I use a strong password, but that’s because it’s something I input once in a blue moon. For guests I have a guest Wi-Fi with a simpler* (still reasonably secure and random, but shorter and without special characters) password and a QR code for simple use, though they are rate limited and have no access to any other network clients.
The worst part of the left one is the implication they have only two passwords. The “under the keyboard” part at least requires physical access and (hopefully) means its not something stupid or short like “p@ssw0rd”.
I have yet to see a sticky note password that was anywhere near NIST compliant lol.
NIST compliance is 15 characters. That’s it. No stupid cycling every three months. No stupid special characters.
Somebody finally read the XKCD comic.
Ain’t it 8 characters, and 15 for machine accounts?
I just read it yesterday but maybe it was an older entry
I wonder why passphrases fell out of style? If you remembered a series of random words like you were activating the freaking Winter Soldier, boom, 40+ characters!
If we take the EFF wordlist commonly used to generate passphrases, we have 7776 words. If we take ASCII alphanumerics and special characters we have about 92. Assuming we generate a NIST compliant password of 15 characters in length we get 92^15=2.8*10^29 of combinations. To get the same level of security (same number of combinations) using the EFF wordlist we need (log(2.8)+29)/log(7776)=29.45/3.9=7.6 around 8 words. If we assume the words are 7 characters long on average, plus the separators, we get 7*8+6=62 characters long. If we start to also include Unicode characters like other scripts or emojis (something I’ve recommended to others) the required number of words grows even more. I don’t know about you, but I can’t be bothered to type that all out every time, a password manager works for me.
Yeah, that makes a lot of sense. I guess I meant for things where you need to actually memorize a password, like for the password manager.
But yeah for 99% of cases, a backed up KeePass database with randomly generated ridiculous passwords for every little service is fantastic. 👍
I can memorize the 8 words though, which is why I use that method for anything where I can’t use keepass.
Did they ever get into style? I use them, but I don’t know anyone else who does. And some sites make diceware passphrases harder to use by e.g. requiring you to add numbers, special characters or capital letters, or by banning spaces. Or by banning non-ASCII, which makes it harder to use diceware passphrases in other languagess than English.
The “under the keyboard” part at least requires physical access
That’s fine at home. Not so great in an office, though
I agree, but if I had to choose between someone reusing passwords and someone who kept them under the keyboard I’d probably choose the latter
You can’t fit that many post-it notes under the keyboard though, so if they’re doing the latter they’re probably doing the former
This is why passphrases are better than passwords. So the “Under the keyboard” can be used as password. It has 3 out of the 4 types to match complexity and plentiful for length. And so much easier ro remember. It could be also a quote from your favorite movie or book, part of a lyric of your favorite song, etc.
Woah now what about changing 1 to !
I will take a stanza from a song, use the first letter from each word, switch the S to 5 or $ as an example, and make sure I have two uppercase, two lower, two numbers. and two special characters, 8 minimum, although now it runs about 13.
I hum as I type in my password. All I have to remember is how I typed it out.
Come at me, dictionary cracks. The result is bonkers as fuck, but I loved that stanza. I have passwords I have used for 20+ years.
My coworker who sits next to me recently commented to me that I always hum the same tune when I log into my computer. Then he mentioned I hum a different tune when I log into the proxmox.
My sticky note would be like:
computer - Local H
proxmox - Sonic Youth
mail server - Future of the Left
NAS - Faith No More
Inventory - Slothrust
etc.
Holy $#!7111
Alt joke:
Thanks for the tip! My password is now…
hunter2I feel more secure already. :D
Oct0ber2026!
That’s why you should never change your password. No one will think to guess @utumn2O23 in 2026.
I have a nice notepad from a conference on my desk labelled “Passwords”
They really aren’t a trap. They’re a well designed standard. The tooling around them isn’t quite perfect yet, but they’re a huge improvement over passwords.
People upvote because they hate change.
People upvote because they hate change.
People upvote because big tech has a tendency of forcing the most anti ownership outcome possible on everyone. Here, such an outcome likely would be mandatory passkeys that are set up to require hardware attestation.
One way to reduce that risk is to boycott passkeys until TPM and hardware attestation are removed from the standard. You may not think that’s a fair response, or that such a boycott won’t save us from the inevitable outcome, but nevertheless it’s not a completely irrational reaction.
This is what people seem to be missing, I haven’t seen a rebuttal to this problem.
This is the article that converted me into a TPM hater: https://www.gnu.org/philosophy/can-you-trust.en.html (And SystemD hater, since Lennard Poettering was employed by Microsoft for a while, the ones that control the TPM default signatures, and now apparently tries to get Linux to use secure boot signing everywhere. Very suspicious.)
Like, yeah, GNU/FSF tend to be radical with many opinions and that’s not everyone’s cup of tea. But I feel like this article has a point.
And also until the committee designing it has it members on it representing the interests of users. The point that this was lacking in the original is-a-trap article is an important one and is also being missed.
I’m just not convinced that mandatory hardware attestation is actually a real problem we need to worry about.
Like, yes, people with high security jobs will have that for sure. And they should.
But large companies that want customers? They want to make it as easy as possible for their customers to connect. They’re not going to force people to have a hardware device which if damaged or lost will lose them a customer. That’s just not what they want.
And yet, it’s there.
Embrace, extend, extinguish as in literally every single corporate case. Thousands of rug pulls later and we still haven’t learned our lesson.
In this case: first get people in the door en masse, then expand the requirements for things like hardware attestation in a transition period, then vendor lock people.
Adobe would never move to cloud only, that would lose them customers.
See: Literally every single API rug pull ever. Reddit, Unity, etc… Get people using the API and infrastructure, then switch from free to huge fees.
See: cloud companies giving good deals for storage and then charging massive fees for output bandwidth to access or move that data
See: VMware rug pull
This is the exact same except they are telling us what they are going to do from the start. When someone tells you how shitty they are, listen.
But large companies that want customers? They want to make it as easy as possible for their customers to connect. They’re not going to force people to have a hardware device which if damaged or lost will lose them a customer. That’s just not what they want.
I would say this is already proven to be wrong, since Microsoft Windows appears to be already doing exactly that with the special hardware device “TPM”: https://rossmanngroup.com/services/encrypted-data-recovery/bitlocker …in regular customer machines.
The TPM exists because it’s useful to support use cases where you want your passkeys tied to a device. It isn’t a Microsoft thing either. I run Linux - my computer has a TPM. I can’t use it because Linux support for the TPM is weak still, but it’s there! You probably have one too if your computer was made in the last decade.
By default, even on Windows, your website passkeys aren’t stored in the TPM. No one is forcing you to store your passkeys on the TPM.
And they won’t, because it’s a bloody stupid idea that benefits no one.
Microsoft wants your passkeys synced across devices because that’s how you get lock in. If the passkeys are stuck on the computer you made them on, then you may as well buy a Mac for your next computer because those passkeys are gone either way! If the passkeys are in Microsoft Password Manager though, now migrating to a Mac is harder.
Oh I know I have a TPM, yes. I blacklist all the Linux TPM modules though. Screw that thing.
I only dislike the ability for service providers to enforce a “security level”. Those should be the exclusively under my (the user) control. Sending preferred default (hints) would be cool, but not enforcement.
That a webpage can basically prevent me from using a passkey if the passkey is stored in software (a password manager for example) is complete bullshit. Especially if there is still username/password as alternative which is clearly worse. Sure, hardware tokens are the ultimate security. But it should be up to me and not them if I want that level of security.
But they already do enforce a “security level” for passwords through minimum character counts (e.g. must be at least 8 characters long), specific character requirements (e.g. at least one upper case + lower case + number), rotation schedules (e.g. must be changed every 90 days), etc. Some even enforce password sharing (e.g. Netflix IP/geolocation checks).
Yeah and certain password requirements are also dumb. But at least they still give me a degree of freedom how to generate the password and how I store the password.
Second factor is sometimes worse than Passkeys; with vendor specific apps (Steam Guard, Blizzard Authenticator, Microsoft Authenticator, etc) instead of following standard TOTP. But still. I want agency over my credentials.
I fucking love passkeys. I hate 2FA on every god damn website, but clearly the majority of people are too lazy/stupid for passwords alone to work in a time when phishing is so widespread. My only problem with them was that I couldn’t use my Bitwarden passkeys in Firefox for Android, but they fixed that, and I’ve never had a bad experience with a passkey since.
This has actually been a really good discussion on both sides as I think many including myself didn’t know about some of the inner workings of them. I’m glad the discussion happened. The trap article IS worth a read, it’s overly long but is really well written. After reading enough about both sides though I don’t think I’m too worried and will continue using them.
I’ve honestly not seen any benefits over passwords.
If I want to check my mail on a library computer, I can type in a password and I’m in. If it’s using passkeys I need an already logged-in smartphone - which I probably don’t have if I need that library computer in the first place. That’s just one example.
Memorizing passwords doesn’t scale well.
You’ve likely got dozens of accounts. You’re not going to memorize a password for every account. Re-using passwords is a serious security problem though. Poorly secured sites get their password databases leaked all the time. If you use the same password on lots of sites, it’s basically a sure thing that the hashes are out there on the darkweb already along with your email, and your password is compromised.
Also, typing your email password into an unsecured library computer is a terrible idea. It is ridiculously easy for someone to install a keylogger and gather emails and passwords. In the past, your main protection was that it wasn’t worth anyone’s time to break into the computers, install keyloggers, collect lists of passwords, then figure out how to use them to get money. But with LLMs that can all be automated. It has become ridiculously cheap, and can be done by someone with a bot farm in Russia.
A password manager largely fixes the first problem, but at that point you need a device with your password manager with you to log in anyway. And the password manager doesn’t fix the second problem at all.
Personally I like Passkeys, and I enroll them in both my KeePassXC vault and on my two hardware keys (a primary Yubikey which I carry with me and a spare one at home).
It doesn’t absolve one from neglecting proper security best practices (don’t login on a system you don’t trust, logout / clear cookies when done, etc), but a Passkey on a hardware key is much more difficult to phish or extract if you’re using someone else’s computer.
Well if your using a pasword manger instead of easily remmbered passwords your screwed either way. And considering the fast majority of people use the same password eveywhere and use a simple passowrd they are a big improvement.
I would say the people hate it, because they are exposed to the tooling and not the standard.
The standard might be the best there is, if the tooling is shit people won’t use it. And once you’ve been exposed to bad tools you make the connection between tools bad = passkey bad because they don’t know there’s a difference…
The biggest problem I see is that it requires OS or browser integration. While possibly a better solution than simple passwords this feels like a vendor lock-in scheme.
You could store them in your password safe if it supports them?
Potentially the server can request hardware/software attestation that would limit the choice of password safe to approved ones only. We don’t yet know how big/likely this could be, but in theory it’s possible.
well, if I’ve seen a vendor lockin before, and I’ve seen a couple, they’ll push them with open standards until they’re accepted and normalized.
Then suddenly the big players like Google and Microsoft will block all the open platforms sighting “security” forcing businesses to adopt closed proprietary versions while touting their free and easy too use platforms.
then the monitize it.
yup, and Netflix will use passkey attestation to make sure you can’t share logins with other users
they can already force your to install their app to receive a push notification (cough… google…cough…). if they really want to lock you in they will. passkey or not.
You don’t remember them you are not expected to moving from iOS to Android lets say generate new ones for your new device.
Usekeys are a pass. Trap them!
Them pass a use, keys are!
I like you 🤣
Passkeys are greate as long you make sure you use a third party (partial) password app, like proton or bitwarden that works everywhere.
I think the worry is that if passkey attestation is required it will force people into a narrow set of authenticators controlled by the big orgs.
At this point in time it’s not a problem, but how can we know it won’t be in future?
This right here. KeepassXC (PC) already had passkey support for a while, KeepassDX (Android) recently implemented support. If you use FOSS implementations, vendor lock-in and potential future corporate enshittification are non-issues.
vendor lock-in and potential future corporate enshittification are non-issues.
For now.
In some countries, banks require users use their app on IOS or Google’d Android. You can’t use their services via browser, LineageOS, GrapheneOS
Then you’re screwed anyway
Fuck off with that defeatist bullshit.
Make them drag you ckicking and screaming. Only morons and cowards walk in lock-step with the corpos
Then don’t use these websites and this is a non issue
Ah, but of course! Why didn’t I think of closing my bank account?
This mentality is so gross. “Well might as well roll over and get pounded in the A by big corpo! what else am I going to do, right? Hehe!”
So what are you gonna do about i
Me personally, I’d get a burner smartphone in a drawer just for banking that is on airplane mode 24/7 except when I need it for banking and use a dumbphone for everything else. Also, I run linux and I have strict control over my router and I have ZERO subscriptions and creditcards. It’s not much but it’s something. Beats blindly rimming apple and alphabet.
Good work. Never capitulate.
That’s not gonna stop them from doing any of these things you’re afraid of it’s just sparing you from it
In some countries, banks require users use their app on IOS or Google’d Android. You can’t use their services via browser, LineageOS, GrapheneOS
True. I’m kind of affected by this in GOS, although I found a workaround to bludgeon my banking app into submission.
Still, this is an issue that is already here, and it exists independently of passkeys.
Until they only allow specific AAGUIDs to enroll passkeys that don’t include the one used by KeePassXC (
fdb141b2-5d84-443e-8a35-4698c205a502) or KeePassDX (eaecdef2-1c31-5634-8639-f1cbd9c00a08) because they don’t consider them secure enough.
Which most people don’t do.
They’ll learn like I did the hard way. Lol
I have a password manager and hardware token. I see no need to use passkeys.
Password manager can store passkeys as well. They’re way easier to fill than passwords, they always work and never have issues with filling like you can have on some websites that just don’t work well with pw managers.
Still needs an arguably perhaps overengineered complicated standard to do it, and seems to open the door to more hardware attestation demands. I’m not a fan and I refuse to use passkeys. (But I can see the use for preventing fishing attacks, so I realize there is no obvious perfect answer here.)
are passkeys not a type of a hardware token? they’re tied to a device.
They’re actually not tied to a device. They can be synced across devices.
Bitwarden, 1Password, Dashlane, Google, Apple, and Microsoft will all do passkey syncing for you.
We don’t yet have a good Linux native passkey store. I believe the
credentialsdproject is working on a spec for that. Once that’s up and running I would expect to see some options for syncing without relying on a third party service (though, you can self-host bitwarden right now). It’s definitely not seamless on Linux yet though.Sadly 4 of those companies are American, and Dashlane has significant US operation presence, making those recommendations unacceptable to me - ymmv
1password is Canadian and zero-knowledge so could be an option if i didnt already use a different service.
I dont like the idea of pre-authorising a device to handle credentials and access in perpetuity at the hardware level. I’d be fine with having a hardware key that holds passkeys but cant use them, while the device using them can only do so when i put the two items together. Unfortunately i do not understand how to save a passkey to a hardware key or how to manage them once that is done. Till someone gives me a straightforward ux to do that, i’ll be using unique passwords, a manager, and totp.
If i am misunderstanding, thats just a different problem; the passkey thing needs to be explained more clearly.
Microsoft makes a hard distinction between Device-Bound and Synced passkeys inside of corporate tenants. They are in fact two different things that happen to be using the same FIDO standard, and can be stored alongside one another in the same app if it supports it.
Also KeePassXC with the browser plugins works a treat for synced passkeys.
Yubikey4lyfe
But you need to buy at least two of them, which isn’t cheap.
And… honestly, you should probably buy 3. Losing your main key only to find out that your backup key broke a month ago and you haven’t been testing it is a real risk.
I ended up getting one through arstechnica (they sent one if you subscribed back then), then I got more through some sale or something
Question: do English native speakers also read “arstechnica” as “arsetechnica”
I definitely read it like arse technica
Not every service allow for registering more than one passkey
And what are they odds of simultaneous losing / breakdown of all three keys? I think they are not negligible.
deleted by creator
Admittedly I didn’t read that one guy’s blog post very closely, but it seemed to claim that because some companies may some day misuse/abuse some features of passkeys, passkeys are poison and no one should ever use them.
Well if that’s possible, it doesn’t sound like a good basis for security.
The features they’re talking about are secure from a cryptographic standpoint.
However, there are features built into the passkey system so that a company could decide that it will only accept passkeys from a specific piece of hardware or software.
This isn’t necessarily bad, you may only want your server to allow you access if the passkey comes from your phone’s hardware. A person could have stolen your passkey but they’re unable to fake the attestation step.
On the other end of things, a company like Google could provide a passkey service which requires you to use hardware provided by vendors that they approve of and they could abuse their position to force it’s implementation, such as how you can use Google to sign into websites via OIDC.
Google could just as easily provide a service for ‘secure’ passkeys which are only allowed to be issued by phones provided by Google, Verizon or AT&T. No more third-party OSs (at least, if you want to sign into anything on the Internet) and no more jailbroken phones. You would have to use the exact, spyware laden, operating system that comes installed directly from your cellular provider who would have remote root access to your device.
I think the idea that we can just boycott passkeys and prevent this is nonsense magical thinking. It requires some hypothetical world where we can perfectly coordinate a boycott of otherwise useful technology. In reality this issue will remain obscure and generally only known to people interested in the topic while Google can pour tens of millions in advertising to reach everybody on the planet explaining how good and secure attested passkeys are to mainstream Internet users.
Use passkeys, they’re useful and more secure than passwords. Not using them won’t prevent enshittification, just sit back and watch the slow motion attested passkey trainwreck as it unfolds over the next decade.
I’m gonna need to find this comment in ten years. Wish me luck
Please provide a blood sample to verify your Age. Thank you for using Open FaceGoogazonthropic, we love you.
This isn’t necessarily bad,
I’m of the opinion that it is bad, from the perspective of the user. They are now locked into that company. It not bad from the perspective of the authentication provider, and the service provider may get a positive outcome of it from fewer breaches due to bad passwords.
The problem is the authentication provider isn’t trust worthy.
It’s a very basic principle, that you don’t create powers that could be abused. That they haven’t been abused yet does not make doing so ok. It like saying it’s ok that my government was given the power to lock people up with no reason or due process because they haven’t used it yet.
Brought to you by the community sending death threats to a guy that added a date field in a program
Who did what now?
The developer who added a “date of birth” field to systemd received death threats, because some people saw it as a first step towards age verification and apparently the appropriate response to that is cyber bullying and death threats
Another point someone brought up in one of these posts: the remote attestation (IE locking your passkeyto a specific app or software) issue is highly unlikely to be used for public websites, because it would block / halt the adoption they’re trying to promote, and its against their interest. No website that I know of has done this for TOTP either.
They push TOTP and passkeys now because they want to avoid the costs and support around resolving hijacked accounts, and password phishers.
The use-case for remote attestation is a valid one also: say you have a really secure internal system that you want to lock down to only users of your specific passkey validator, and make sure its that specific app, unspoofed.
Or “Like all questions of security vs convenience, a user should decide what they are or are not comfortable with.”
I think the reason passkeys are so controversial is that tech has a long history of ignoring user choice and pushing the most anti ownership solutions possible. Therefore, I think there is fair concern emerging along with any new mechanism that has any sort of TPM or hardware attestation components at all.
The concern is valid, but we should also look at these company’s interests in pushing passkeys, which first and foremost is avoiding all support and resources they have to dedicate to password resets and account hijacking, of which TOTP was the band-aid for, which they also push.
The software or hardware attestation is IMO a non-issue for most public sites. We have a precedent in TOTP, and they haven’t locked those down either to specific software, because they care more about adoption (to avoid the costs above) than controlling what software you use to validate.
If someone wants to say that these companies will turn on this attestation for passkeys in the future, and break a ton of logins and decrease adoption, then they should have a reason why they haven’t done so for TOTP.
If someone wants to say that these companies will turn on this attestation for passkeys in the future, and break a ton of logins and decrease adoption, then they should have a reason why they haven’t done so for TOTP.
Didn’t you already answer this by saying they want to increase adoption? That seems like the reason. I think the argument here is the same as what they do with something like streaming (which is closer to what I have a problem with, rather than locking people to specific software). They work on adoption until the numbers and ease of use are high enough to kill the other options and prevent multiple people from logging into one account. They lose some people, but gain more because of the new restrictions forcing people to have their own account.
Doesn’t necessarily work the same in that sense, but it’s still a numbers game. We continuously see companies/governments postpone onerous policies until they have enough people willing to put up with it. Then they ram it through and ignore the people that complain. It’s age gating and digital only purchases and digital id and backdoors and everything else we see with tech.
Passkeys are a good idea to prevent phishing. Using passkeys but then require a second method to login as a backup to prevent lockout when you lose your key (as many sites do) is epic bullshit. It makes an actual security improvement into some convenience feature so people don’t need to remember/type passwords anymore. Because the phishing will now ask for the alternative/recovery login to fix some alleged problem with your account/passkey…
So it suddenly does not provide additional security anymore above what a password manager would already do.
When you sell somehting as a security feature then instantly defeat the additional security to make it just about convenience the question about the actual goal feels natural…
so whats a passkey and how is it different from a password?
A passkey is cryptographically signed by the server when it’s created.
So it does not only has your credentials encrypted which are then used to login to a server, but it also carries information about the server and only that server can request the credentials from the passkey. So unlike a password a passkey is resistent to phishing attempts as you can’t actually give your credentials away to anyone but the actual server it was created for.
Passkeys: don’t stop them Passkeys: don’t, stop them
It’s the typical case of perfect being the enemy of good.
If you read the pro article you can tell its a bunch of hogwash as they don’t understand Tue point of passkeys.
The person that wrote the anti article thinks that 2fa is a form of password… they’re the one that doesn’t understand passkeys.
What a shitshow
Last time I was in Thailand and my buddy told me don’t worry, she’s not a trap.
