Passwords vs. Passkeys - FIDO Bites Back!

The FIDO (Fast IDentity Online) standard eliminates the need for passwords entirely and can provide resistance to phishing and replay attacks. In this video, Jeff Crume answers many questions that viewers asked after watching his first FIDO video, "FIDO Promises a Life Without Passwords". If you haven't seen that one, check it out in the link below!

[maxquasar]

Big FIDO2 fan and may I offer my favorite best practice with regards to "What if I lose my key?" You can register multiple keys with your servers. The key pair on the key is only used to protect the key pairs you make for each server. Once you're authenticated, your server will allow you create another key pair for the additional FIDO key. Keep one in a safe and use the other for daily use. Love your videos! Keep up the great work.

[BarryOGrady]

Great video, thanks, Jeff. I have been wondering about passkeys, have watched vids on YouTube, and this is the best concise video that explains it in human language. Well done, IBM! I am lucky enough to have worked there, so it is gratifying to see they're still doing a great job.

[NK-iwrq]

Thank you Professor Jeff ! Your videos on Cyber security have helped me ace some interview questions i've been asked recently.

[gasovensforqcult]

As a PKI engineer, this warms my heart

[toenytv]

We’ve come along way with passwords. Hind sight is 2020. Just thinking back at how great a tech this is and its importance. Great job keeping it open and secure. Threats shouldn’t be able to keep up. Just a thought security sure is my number1. Trust one of the keys to security. There sure is a lot of great tech in the process. Thanks for the points.

[alejandrodelavega]

What do I use to sync the passkeys. A password manager like 1Password?

[jaidenrichard]

Good teaching. He explain very important concept with easy example. Thanks.

[herewearewayoutwest]

Excellent best describes this presentation. I could listen all day.

[kenp]

Account recovery is always going to be the achilles heel. Even among the few sites that support passkeys, most force the user to enable a weak recovery method before they'll enable passkeys.

[con-f-use]

It's funny how he says he's addressed SSH and PGP, but has done all but.

[samwang]

IMHO, the first two questions are as important as what currently FIDO is trying to standardise. Without addressing or standardising those two, it just cannot be counted as a complete solution. And, "eliminating the needs for password entirely" sounds quite ambitious.

[DeepDiveGames]

I really like your contend and I appreciate the advantages of PKI and FIDO2, but I believe this video doesn't present a complete picture of modern password managers (PMs) that actually generates and stores unique, high-entropy passwords for each site automatically. With that in mind I'd like to clarify the two points:
1. In the phishing scenario (7:56): With properly configured PMs generating unique passwords per site, a compromised password from a phishing site doesn't put other sites at risk.
2. Regarding the offline attack (8:34): Cracking a properly generated password with 180+ bits of entropy is practically infeasible, and even if successful, would only compromise one site's credentials.

While Passkeys may offer better protection for the average person, the video would benefit from a more balanced discussion of their limitations. Also worth noting that the current Passkey implementations are still in their infancy - most sites simply replace passwords with Passkeys while still requiring email verification and 2FA, rather than fully utilising the technology's potential. A thorough comparison should consider the pros and cons of both approaches, as each has its place depending on user needs and circumstances.

[michaelcharl]

Phishing question: why can't a phishing website act as a live man in the middle? A user sign in request goes to the phish site, who passes it on unchanged to the real site. When the challenge request comes back, the phish site sends it to the user unchanged. The user challenge response gets sent back to the phish site, which again passes it on to the website, which successfully decrypts the response. Both ends assume authentication is successful, except now the phish site prevents further communication to the user and continues in the user's place. No passkey encryption/decryption by the phish site was needed. I must be missing something. (I'm assuming the passkeys are only for authentication purposes, but, if not, this would still be a problem.)

[zetectic]

Problem 1, only 4 accounts I have use passkeys
Problem 2, websites still asking for an email address or even a password when using a passkey.
Problem 3, it takes longer to logon using a passkey
Problem 4, website still want to use another method of 2FA rather than a yubikey etc where the passkey is stored i.e. email code, text code or authenticator app code
Problem 5 many will not use passkeys as they have been poorly implement & are less convenient than a password.

[ukranonymous]

The best security is when you use all THREE: 1. something you KNOW, 2. something you HAVE and 3. something YOU ARE. For example a password + device + fingerprint. Passkey violates this. To get access to you online banking, a bad guy can catch you unconcious (or help you with that), grab your phone, unlock passkey with your finger and thats it. I know real case. Although password managers also violate the first mean. Therefore for critical services I don't use password managers.

[AlessandroBottoni]

This depends on the level of security you are looking for. I do use FIDO 2 USB tokens since the beginning BUT... I still pair them with passwords and passphrases. Just in case someone steals my devices...

[karlking]

The major concern I have regarding the password-to-passkey transition period, is that the site (e.g., Amazon) I am accessing will actually have both the new public key for specific device(s) AND my original password. I mention this because I have created a few passkeys but have not seen an option to have the site permanently delete my password once the passkey was created; therefore, even if I create or share passkeys for all my devices to a particular site, a data breach of that site will cause the same pain it does with or without passkeys because my passwords are stored in the same old way "alongside" my public key.

What am I missing?

Thanks for the excellent video!

Karl

[eduardobuitrago]

If you do not control the security, assume everything you send to that system, it is available to third parties allowed by that system. Keep your private keys private! Period!

[MartynStarkey]

I would like to know if once a Passkey is setup, can I remove the 2FA for that site?

[dinesharunachalam]

@Jeff, what is the cost involved? Both from new installation perspective and also migrating existing password based authentication