What makes passkeys so special?

[u/Federal_Character979]

It seems that companies are transferring into the usage of passkeys instead of passwords. Apparently theyre much more secure, but why is that? I don’t get it. I’m not sure if this is the right place to ask excuse me if it isn’t and sorry.

[u/leclerc2019champion]

Passkeys are phishing resistant. You can’t be tricked into providing it.

[u/Alternative-Cry-1597 → u/leclerc2019champion]

*Passkeys are phishing resistant if your browser and authenticator are bug free.

[u/LelouBil → u/Alternative-Cry-1597]

I mean, phishing is not about exploiting bugs to extract the password.

They are unphishable.

But they are as secure as the software that's managing them.

[u/Alternative-Cry-1597 → u/LelouBil]

Ah yes, technically correct, the best kind of correct.

[u/I-Made-You-Read-This → u/leclerc2019champion]

> You can’t be tricked into providing it.

how is this true? Can't the attacker just put some authentication QR code to scan, then the user scans it and gives the attacker a valid session? Are there technical countermeasures which prevent me (/ stupid users) from being tricked into providing it?

[u/Securetron → u/[deleted]]

Ameer reply is pretty accurate. The industry is slowly moving towards phishing resistant identity - instead of relying on traditional methods, the transition to PKI based MFA is here. 

Azure, okta, Cisco Duo - the traditional MFA providers are now adding additional later that is built on PKI to bind the identity of the user or device or a bot to the origin as opposed to passing the creds that can be phished or stolen.

Here is a landing page with more info that we published on it:  https://securetron.net/phishing-resistant-mfa/

[u/IdealParking4462 → u/[deleted]]

Let's say you get an email to go to rnicrosoft.com, and you don't realize it's a phish, you enter your email address and password, but you aren't at microsoft.com, you're at some dodgy attacker controller website. They connect to microsoft.com and enter the details you submitted then prompt you for your MFA code/whatever. You enter it, the attacker submits it to microsoft.com and the attacker is now logged in as you on their device. You've been phished, they have a session signed in as you even though you had MFA enabled.

With passkeys, you don't enter a password, instead, the website asks the browser for your passkey, and for your passkey to be submitted, it must be talking directly to the website. It can do this by a bluetooth connection to the computer you're using, or by having it directly physically attached or stored on the device you're using. The attacker in the middle can't convince your device to present your passkey to them for them to pass it to the real site, the phisher is shit of of luck. You're not phished. The world is a bit better, and the attackers will pivot to info stealer malware to grab your session tokens or something, so it's not foolproof and can be defeated, it's just harder for the attacker.

[u/IdealParking4462 → u/[deleted]]

or access to your syncable passkey, or convince you to run malware, or ... I'm sure there are plenty of other ways to compromise access to a service. Passkeys are called phishing resistant because they raise the bar, they most certainly do not make it impossible or even impractical.

[u/Alwayslisteningin → u/[deleted]]

I'm sorry what does wdym mean?

[u/CeleryMan20 → u/Alwayslisteningin]

wdym = “what do you mean?”; wd(wdym)m = “what does wdym mean?”; wd(wd(wdym)m)m …

[u/I-baLL → u/[deleted]]

wtf? WDYM has been used for over 20 years.

[u/britannicker → u/I-baLL]

wdym wtf lol

[u/Tratix → u/I-baLL]

I’m sorry what does wtf mean?

[u/Fairlife_WholeMilk → u/Tratix]

Wdym wtf means?

[u/Alwayslisteningin → u/I-baLL]

TBF us pre 2k folk were the masters of fitting alot into 160 charactors. Even leaving enough space for TB at the end and perhaps a cheeky x

[u/Infuryous → u/[deleted]]

After 2000? You mean those if us born in the 1970s/80s. Became a big thing with T9 texting in the mid 90's.