That is truly amazing. (Golf clap)

Thank you. That was the very first thing I thought.

1. Password managers are, generally speaking, far more security conscious than the average website. I'd rather send a password to my password manager a couple times a day than send passwords to every website I interact with.

2. One click to confirm vs. 2-3 to autofill. Tiny gains in speed 🤷‍♀️ If you make a password manager even slightly more convenient than just using gregspassword123 for everything, you can onboard more normies.

You're entering your password into your password manager, which is stored by a company or entity whose entire job is to keep it secure. You're not giving your password, in any form, to the website or service you're accessing. When the website gets compromised, your hashed password is not in a database waiting to be cracked. All the attacker gets is a public key they can't use for anything.

The biggest difference: nothing sensitive is stored on the server. No passwords, no password hashes, just a public key. No amount of brute forcing, dictionary attacks or rainbow tables can help an attacker log in with a public key.

"But what about phising? If the attacker has the public key, they can pretend to be the actual site and trick the user into logging in." Only if they also manage to use the same domain name. Like a password manager, passkeys are stored for a specific domain name. If the domain doesn't match, the passkey won't be found.

https://www.youtube.com/watch?v=qNy_Q9fth-4 gives a pretty good introduction on them.

If you're using a hardware token like a YubiKey then you do need to enter your PIN before being able to use it.

The main benefit is that you cannot extract the Passkey from the secure element (the token cannot be transformed from what you have to what you know) and it cannot be phished through a fake domain as the challenge-response will not match.

Passkeys are asymmetric, meaning that the server only ever sees your public key. If the server gets breached, then only your public key is leaked, which isn't a big deal. Functionally, it's almost identical to SSH keys.

And all of my tech challenged family screamed out in unison, “What’s the fucking 1Password password again?!”

You don't have to memorize a ton of passwords for multiple sites which helps prevent password reuse. Whatever you use to decrypt your passkey or password is not transported over the network.

It's not foolproof of course but it's a huge improvement.

TOTP generated on the same device as the passkey is not a secondary factor. It will have been compromised together with the passkey.

For passkeys, the secondary factors are used to access the passkey vault, not auth to the server. And these secondary factors should be a master password, biometrics, or physical keys. TOTP and SMS are out.

Use a password manager that implements passkey like Bitwarden that syncs up to a server. Or you can host your own Bitwarden sync server with Vaultwarden if you don't like the thought of a cloud sync.

It's already a huge problem now. Lots of people only have one auth device they depend on for everything. At least passkeys come with standards which should help spread the use of vault sync and backups and hopefully those practices become the norm.

They mention it in here. I don’t know about Android, Apple synchronizes them between devices. The way they do it seems pretty secure but it is still less secure than the keys being untouchable. Using multiple will be a necessity.

RIP local sexpot.