My read on it all is that FIDO is stuck in some sort of groupthink. They don't feel the boots on the ground confusion around passkeys being opaque. They only care about phishing and being called "insecure" and don't care about anything else. Hence why WebAuthn has additional weird anti features like AAGUID for provider authentication.
Another one of those ridiculous threads is saying you gotta have support for nonsense like user presence verification.
The phishing resistance on fake websites is largely a function of the fact its an ssh key and you can't man in the middle those after first setup because you have known_hosts, which in the case of passkeys gets replaced with the website certificate technology.
The baking in "which authenticator is storing this passkey" and "require user to provide biometrics/pin to verify presence for this passkey" and "don't make it easy or possible to export passkeys" behaviour is more just control.
I guess it sort of helps if the threat model is complete remote code execution inside the victims brain because you got them to export their keys to you, but it seems more useful for websites and governments whitelisting what hardware and software they deem acceptable.
> I guess it sort of helps if the threat model is complete remote code execution inside the victims brain because you got them to export their keys to you, but it seems more useful for websites and governments whitelisting what hardware and software they deem acceptable.
Reminder that Facebook has warnings and prevention mechanisms to avoid users pasting malicious JavaScript into the console on Facebook.com (which would exfiltrate session cookies).
Preventing users from accessing these keys directly makes sense!
Aren't they effectively locked in the database of whatever password manager is used? I know you can export them, sort of, but that feature may blacklist your password manager and make it useless. Are they portable? I thought passkeys are locked to the device.
> Aren't they effectively locked in the database of whatever password manager is used?
Not in the case of Keepass, since you can export them.
> I know you can export them, sort of, but that feature may blacklist your password manager and make it useless.
Yes, and this is why passkeys are flawed.
> Are they portable? I thought passkeys are locked to the device.
There's nothing preventing you from syncing your passkeys and using them on different devices. This even seems to be the happy path in the locked down eco systems (You can create a passkey on an iPhone, which is then synced to iCloud, and now you can use that same passkey on a Mac).
I was answering to the storage part. Blacklisting is the attestation part which is definitely a concern. Again, you can use passkeys as a yet another way to login. You can still use passwords. It doesn’t have to be one or other.
https://github.com/keepassxreboot/keepassxc/issues/10407
https://news.ycombinator.com/item?id=47189749#47193048
My read on it all is that FIDO is stuck in some sort of groupthink. They don't feel the boots on the ground confusion around passkeys being opaque. They only care about phishing and being called "insecure" and don't care about anything else. Hence why WebAuthn has additional weird anti features like AAGUID for provider authentication.
Another one of those ridiculous threads is saying you gotta have support for nonsense like user presence verification.
https://github.com/keepassxreboot/keepassxc/issues/10406