That makes no sense to me — and I’m not technically illiterate. If it makes no sense to someone like me, there was never any hope that it would be adopted by the masses who just want things to work. Google may not have helped here, and I’m certainly not among their fans, but it’s hardly entirely their fault that it never caught on.
The user does not need to understand it. A user does not understand https or hashing and salting.
Still, every one of these is important these days for online security.
I am not a huge fan of passkeys themself, especially when the secrets are held by big tech, but they promise better security and protection against command n attacks like phishing.
I take your point. But I would argue that the user needs at least to understand the basic theory. Otherwise you get me, who sees no benefit, resents when it’s imposed unilaterally, and finds ways around the inconvenience.
You have a point that it will be hard to explain this to everyone on why it is better.
From my understanding, when you use a password manager, the user will enter a pw into it that they remember and the vault will unlock. Then when they go to log into a website, a different, longer, and impossible to remember password will be sent to the site at login. (Assuming they are using the manager well). A week later when they go to log in again, the same long password will be delivered.
The problem is that if a bad actor gets involved, whether it is the website is attacked or they send the user a phishing url or something and the password from the manager is exposed, it will have to be changed. That scammer can now log into that website as the user whenever they want, and possibly any other website that user used the same password for. Hopefully they didn’t if they are using a manager.
With passkeys, a user will log into their manager with a password they remember, but when they go to log into a website, a different token will be sent, based on their key, every time. So if a scammer is listening at the router they still can’t log in again because it has expired.
It is still not a perfect thing, I would imagine that phishing sites could still get a scammer in, who could possibly do bad things or change the login credentials but it is still much more secure than sending a password to the site for the user.
Users not having to remember a bunch of passwords makes a huge amount of sense to them. The support is already built into the devices they are using and it’s somehow, they don’t know or really care, more secure.
You need to check out public key cryptography and digital signatures. Those are the basics of Fido.
When the private key is bound to a device it is not possible to fake or steal it through conventional methods. Passwords are the weakest link and an easy target for attackers - passkeys basically solve that.
User adoption depends on implementation, but everything is easier than remembering a secure password or using a password manager for most people. There needs to be an easy and secure way to distribute passkeys across devices, and any backup mechanisms may be a weak point. In any case: still better than passwords.
The difference is, that even if you enter the “password” on a phishing site, it is useless. Or when the server is compromised.
The only way the passkey can get compromised, is when the device that holds it gets compromised.
The same reason why hardware tokens for things like FIDO or U2F are recommended.
That makes no sense to me — and I’m not technically illiterate. If it makes no sense to someone like me, there was never any hope that it would be adopted by the masses who just want things to work. Google may not have helped here, and I’m certainly not among their fans, but it’s hardly entirely their fault that it never caught on.
The user does not need to understand it. A user does not understand https or hashing and salting. Still, every one of these is important these days for online security.
I am not a huge fan of passkeys themself, especially when the secrets are held by big tech, but they promise better security and protection against command n attacks like phishing.
I take your point. But I would argue that the user needs at least to understand the basic theory. Otherwise you get me, who sees no benefit, resents when it’s imposed unilaterally, and finds ways around the inconvenience.
You have a point that it will be hard to explain this to everyone on why it is better.
From my understanding, when you use a password manager, the user will enter a pw into it that they remember and the vault will unlock. Then when they go to log into a website, a different, longer, and impossible to remember password will be sent to the site at login. (Assuming they are using the manager well). A week later when they go to log in again, the same long password will be delivered.
The problem is that if a bad actor gets involved, whether it is the website is attacked or they send the user a phishing url or something and the password from the manager is exposed, it will have to be changed. That scammer can now log into that website as the user whenever they want, and possibly any other website that user used the same password for. Hopefully they didn’t if they are using a manager.
With passkeys, a user will log into their manager with a password they remember, but when they go to log into a website, a different token will be sent, based on their key, every time. So if a scammer is listening at the router they still can’t log in again because it has expired.
It is still not a perfect thing, I would imagine that phishing sites could still get a scammer in, who could possibly do bad things or change the login credentials but it is still much more secure than sending a password to the site for the user.
What makes no sense to you, exactly?
Users not having to remember a bunch of passwords makes a huge amount of sense to them. The support is already built into the devices they are using and it’s somehow, they don’t know or really care, more secure.
You need to check out public key cryptography and digital signatures. Those are the basics of Fido.
When the private key is bound to a device it is not possible to fake or steal it through conventional methods. Passwords are the weakest link and an easy target for attackers - passkeys basically solve that.
User adoption depends on implementation, but everything is easier than remembering a secure password or using a password manager for most people. There needs to be an easy and secure way to distribute passkeys across devices, and any backup mechanisms may be a weak point. In any case: still better than passwords.