| Instead of framing your opinion through a philosophical theoretical lens, instead frame it through a practical lens or an actual real life security threat assessment based lens. Think about things like phishing, password re-use, sucking data out of the system clipboard, or keylogging. Passwords are symmetric in nature while keys are asymmetric. This property defeats a very large number of attacks without really increasing the attack surface. The 2nd factor is not just something you have, but also something you have right now. Time is not an irrelevant factor. You are correct that it is bad for these to co-exist on the same device. Being on different devices boosts security considerably. Yubikeys and secure enclaves are both good things. > 1. Something you know 2. Something you have I think you are stumbling over this statement. You are treating it as a-priori truth, when it is not derived from mathematic truth. "Something you know and something you have" is the result of a practical and economic processes of generating better systems of authentication. > which has been a fruitless battle This is false, password managers and salted hashed passwords as well as more advanced hashing algorithms have boosted security significantly. Security teams at large companies have done significant work around forcing password changes against people suspected of being compromised. Password managers themselves have started to warn people about password re-use which is also very positive. > never changed. Password rotation is not really considered a security practice of value at least among people I know. I think most people who work in security would consider it security theater. Password rotation is a band-aid for the problem of password re-use. Changing a password only matters if the password has already been compromised. So password rotation is a mitigation technique more than a security technique. > But it's really not any different than strong passwords with rotation, and a password manager. It's also important to consider that passkeys are behind your phones password or your systems password. So there is still generally a password protecting these items, but the password is a local check rather than a check against a remote machine. Summary of my response to you: The difference between symmetric and asymmetric encryption is real and of value.
Passkeys still require "something you know" to get loaded into memory.
You are right to not want multiple factors on the same device.
Password rotation is a red herring.
Think of things in terms of the attacker, not in terms of how things "are supposed to be."
Blind adherence to rules that you don't understand how they are made is called cargo-culting and people in security hate cargo-culting. You made a post because you understand that there are things you don't know you don't know, and that is a good instinct. What you don't know is the properties of asymmetric encryption and potentially standard techniques for compromising authentication.You took the correct idea that multiple factors of authentication being on the same device is bad and turned that into the (IMHO) false idea that passwords have better security properties than passkeys. |