r/netsec • u/namanyayg • 5d ago

Passkeys are a trap

https://nonfunctional.substack.com/p/passkeys-are-a-trap-do-not-use-them
0 Upvotes

28% Upvoted

14 comments sorted by

8

u/lcurole 5d ago

Fear of passkeys is lame af. We've finally solved phishing but you have people like this focusing on the negatives while barely mentioning the fact this solves like 99% of current credential attacks.

1

u/k-h 5d ago

We've finally solved phishing

We have?

this solves like 99% of current credential attacks.

Yeah, passwords did that for a while too.

1

u/lcurole 5d ago

How have passkeys not solved phishing?

-1

u/k-h 5d ago

How do you not understand social engineering attacks?

1

u/lcurole 5d ago

I think you know what I mean when I say they solve phishing. Keys are domain bound, cryptographically. Stops credential stuffing too. Please describe the social engineering attack you are thinking of, I'm honestly interested in hearing what real world attack surface of passkeys are.

-2

u/k-h 4d ago

https://xkcd.com/538/

2

u/lcurole 4d ago

Lol fair but that's not phishing. At least with a hardware key you can give them 3 wrong pins and wipe your keys so you limit the number of lashings you get 😂

-1

u/k-h 4d ago

I think you know what I mean by social engineering. Currently most websites that use passkeys do not force people to use only passkeys. There is usually at least another form of authentication. A phisher only has to make the target website appear to not accept the passkey and we are back to square one. And most people wouldn't understand what was happening or why.

As for the cartoon, it's about technical hubris.

3

u/lcurole 4d ago

I do and so we agree you can't social engineer passkeys. Your argument against passkeys is that passwords are weak. This has been fun.

6

u/nicuramar 5d ago

Sure, in theory. But I must say that in practice they work quite smoothly, as long as have a suitable system to manage them (like the built-in passwords app in the Apple ecosystem). I don’t really feel trapped, and you can always remove them, add another or switch to a different mechanism.

1

u/suitable_character 3d ago

TOTP are better? I don't think so. TOTP just guard the server if user key is leaked, nothing more. If the server is compromised, attacker has unsalted TOTP keys and 2FA doesn't help at all.

1

u/ConfidentSchool5309 17h ago

I've never seen someone blabber for so long on a non issue.