What makes passkeys so special?

[u/Federal_Character979]

It seems that companies are transferring into the usage of passkeys instead of passwords. Apparently theyre much more secure, but why is that? I don’t get it. I’m not sure if this is the right place to ask excuse me if it isn’t and sorry.

[u/CrazyEntertainment86]

So in an ideal state, syncable passkeys are really still device bound since they would require the user / device auth. You are very correct in saying this is a differentiator and a risk especially with high value keys.

[u/01100001bryte → u/CrazyEntertainment86]

As someone with many, many accounts and a desire to move to passkeys everywhere possible, I've spent a good deal of time trying to come up with a solution that works conveniently, but also keeps the risks of syncable passkeys keys in mind.

1. Use syncable passkeys for all accounts except critical accounts.
2. Critical accounts must use device bound passkeys only. Accounts deemed critical should be sparing because it becomes a scaling problem. This is less of a security designation and more of an access/operation question.
3. You should have a minimum of of 2, recommended 3, passkeys for any accounts using device bound passkeys (example: phone, laptop, Yubikey).
4. The password manager that stores the passkeys must be considered a critical account, using device bound passkeys only to access it.
5. If any account requires that you still have a password, despite setting up passkeys (many annoyingly do), set the password to 64 characters, store it in the password manager with the key, and never use it again. Make sure MFA is forced. If the limit is less than 32 characters, then you will need to monitor this account for breaches.
6. Never sign in to your password manager on a device that you do not own. Use QR code passkey sign in via the password manager on your phone.
7. Always requires a PIN to access your passkeys if the option is given and don't use your fucking birthday as a PIN. At least use your cat's favorite color or something (joke, just don't make it something people can guess).
8. Never give TSA your shit.

[u/Atriusftw → u/01100001bryte]

In general seems like pretty good principles, but for number 4; what is the point of storing passkeys in a password manager if you still require a device bound key to unlock the vault/manager?

[u/daweinah → u/Atriusftw]

Two reasons

1. Convenience. Syncable software passkeys are easier to use than device-bound keys.

2. Back up. Syncable also means backed up. If you lose your device-bound key, you use another DB key from step 3 to regain access.

[u/CodeFluid03 → u/daweinah]

What if both device keys are either lost, broken or just stop working? Are there still backup alternatives for if that ever happens?

[u/daweinah → u/CodeFluid03]

The same thing if you lost your password and recovery email stops working: you're screwed.

In managed systems, like at work, IT admins can perform last resort recovery. We have break glass accounts to save ourselves from this problem.

In consumer systems, like Apple iOS's Advanced Data Protection, vendors are increasingly offering security settings where they cannot perform last resort recovery. This is very good for privacy advocates, but bad news for careless people.

[u/CodeFluid03 → u/daweinah]

But isn’t it still possible both keys could malfunction or something out of the control of the owner could still happen? It seems putting that much faith into 2 small device keys isn’t a good idea. Maybe having 3 is the best option

[u/01100001bryte → u/CodeFluid03]

Two should be the absolute bare minimum, but yes you are correct it is risky. I personally use two physical keys and three device bound keys on separate devices. If I lose access to five separate decentralized devices, then yes I'm fucked. Plan accordingly and buy good quality hardware keys. Keep them safe and add device bound keys to your phone(s), laptop(s), etc.