Technology

The only way I ever used passkeys is with bitwarden, and there you are sharing them between all bitwarden clients.

From my very limited experience, pass key allows to login faster and more reliable compared to letting bitwarden enter passwords and 2fa keys into the forms, but I still have the password and 2fa key stored in bitwarden as a backup in case passkey breaks.

To me, hardware tokens or passkeys are not there to replace passwords, but to offer a faster and more convenient login alternative. I do not want to rely on specific hardware (hardware token, mobile phone, etc.), because those can get stolen or lost.

I think that passkeys are simple, but no-one explains what they do and don't do in specific terms.

Someone compared it to generating private/public key pairs on each device you set up, which helps me a bit, but I recently set up a passkey on a new laptop when offered and it seemed to replace the option to use my phone as a passkey for the same site (which had worked), and was asking me to scan a QR code with my phone to set it up again.

So I don't know what went on behind the scenes there at all.

you can't just share passkey between your devices like you can with a password

Either you enroll a system that shares them between devices without the need for special interaction (password manager, iCloud etc) or you enroll each device separately into your account.

You can have more than one passkey for a service. This is a good thing.

Whatever way the world is moving, expect DHH to have a different opinion about it.

It is 2FA. Just easier to use.

It uses asymmetric cryptography. You sign a login request with the locally stored private key and the service verifies the signature with their stored public key. The PIN on your device is used to unlock access to the private key to sign the login request.

If you've ever used ssh it's very similar to how ssh keys work. You create a cryptographic key for the site; this is the passkey itself. When you go to "log in" the client and server exchange cryptographic challenges, which also verifies the site's identity (so you can't be phished...another site can't pretend to be your bank, and there are no credentials to steal anyway). Keys are stored locally and are generally access restricted by various methods like PIN, passphrase, security key, OTP, etc. When you're entering your PIN it's how the OS has chosen to secure the key storage. But you've also already passed one of the security hurdles just by having access to that phone/computer. It is "something you have".

The passkey stored locally in some kind of hardware backed store on your device or in your password manager is the first factor: something you have.

The PIN/password or fingerprint/face to unlock the device and access the stored passkey is the second factor: something you know or something you are, respectively.

Two factors gets you to 2FA.

I have a sub to dashlane that came with ten additional subs and despite trying to literally give them away to family and friends and you'd think I was trying to pull teeth.

Yes, use a password manager to store your passkeys.

Passkeys are a solution looking for a problem that hasn't been solved already, and doing it badly.

You say that and then

hoping every service they log into with "password123" has it's own TFA. And since nearly every site uses shit TFA like a text or email message

That’s literally a problem passkeys solve and password managers don’t lol

And the fewer times that people are entering their password or email/SMS-based 2FA codes because they're using passkeys, the less of an opportunity there is to be phished, even if the older authentication methods are still usable on the account.