Passkeys SUCK (here’s why + how I use them)

If you care about your personal security and privacy online, download my free security checklist here:

🔹🔹🔹What You Should Watch Next🔹🔹🔹

We've got a lot of great privacy- and security-related content here on the All Things Secured YouTube channel (although we admit we're a bit biased). If you're wanting to increase your online cybersecurity, here's what's next:

🔹Support All Things Secured (Recommendations)🔹
If you enjoy this kind of practical security and privacy content, one of the best ways you can help support this channel is by using these affiliate links to our favorite products and services. When purchasing through these links, you not only get the best available deal, the companies will also pay us a small commission. Thank you for your support!

*********************
Video Timestamps
*********************
0:00 - Introduction to Passkeys
0:33 - The History of Password Security
2:12 - What is a Passkey?
3:52 - Understanding a Syncable Passkey
4:46 - Understanding a Single Device Passkey
5:59 - Logging in with a Passkey
7:34 - Should You Use Passkeys?
8:53 - My Passkey Security Strategy
10:05 - Passkeys will NOT replace Passwords...yet
*********************

You've probably been hearing about passkeys as a replacement for the traditional username and password security for your accounts. In this video, Josh walks through a clear explanation of how this new standard of security works and whether or not it's useful in our everyday lives.

#onlinesecurity #passkey #passkeys

[talle]

Oh boy, that shirt isn't good for youtube's bitrate ^^

[ThatonedudeCR]

Thank you for covering this! I bought keys like a year ago and I honestly couldn't figure out if I was using it incorrectly. Almost no sites allow the key to be anything more than a backup since you essentially still need to log in how you previously had. I was really wondering if it was something I set up incorrectly. So relieved it's just awkward to use them in many places

[hoopoe_]

Passkeys are probably intended for people who have so far been using simple passwords, memorising them and using them on multiple websites. Using passkeys will mean a big jump in security for them. Those who use password managers for creating and saving long, random, unique passwords for each website along with 2FA won't gain much by using passkeys. I have created passkeys on a couple of websites out of curiosity but I still use passwords on those sites.

[shubinternet]

Note that Amazon and Google both use password protected hardware tokens (like Yubikeys) as their method of authenticating to internal systems. It takes some additional infrastructure, but it is very robust and resistant to many types of attacks. But the human behind the keyboard will probably always be the weakest link.

[Tux.Penguin]

If a website login (such as the Amazon example here) allows the user to choose either password or passkey, then the passkey seems to add zero security. An attacker in possession of the password would simply choose that option.

[westbccoast]

I wish banks took security seriously and gave us the option of hardware keys, banks 2FA are a joke, sad

[jwillisbarrie]

Thanks for adding actual captions for the Deaf - and thanks for clear explaination

[GlassDeviant]

Funny how a month after this video, a vulnerability in YubiKeys and other systems that use the Infineon library came to light.

[Dygear]

As someone who just implemented Passkeys on the server side, the username part as mentioned in 6:12 is not actually required. The passkey when you first sign into the server sends a sha256 hash of the public key along with it. Every time you use a passkey, that same hash is sent back along with the challenge response. The server can use the hash for the user lookup (so it doesn't have to check your challenge against n number of users to find out who it actually belongs to) and then check the challenge against the public key as stored in the database. I offer my users a simple button that allows them to sign in to their account with just their passkey. No username is required, just physical control of the passkey device (be that a phone, tablet, computer, or Yubi / Titan security key.)

[cobrabtc]

also. These companies that have passkey support should also offer the user the ability to remove and delete the logging in with a username and PW. Defeats the purpose and security of passkeys if that old tech is still avail and could get hacked and stolen.

[NomadOutdoorAdventures]

I totally agree. I love having my account secured and I do have a security key in place for as many accounts as I can, but yet still have not activated passkey on any of my accounts I feel the same way about passkey going to continue using what I’ve been using to me. I’m very happy with that.

[gabrielgon]

You didnˋt mention the most important thing and the reason why Iˋm not using passkeys at all.

At least on my device, an S22 ultra, the passkeys asks for my fingerprint OR MY SMARTPHONE PIN. Thats completly absurd. Why would I swap a long and random password for an 8 digit pin? AND MORE, I live in a country (Brazil) thats possibile that someone would point a gun at me and ask for my pin, so sure, letˋs give the thief my device AND the password for all my passkeys. (!!!) Another possibility is someone being able to see me unlocking my device with the pin for some reason, something that also happens in the US.

Until itˋs only possible to unlock with biometrics and not the deviceˋs pin, Iˋm out. Very unsafe.

[nomadshiba]

its only good for if you only wanna verify already logged in users before doing certain actions.
its faster than typing password, but you can argue its faster for password manager to fill the password

[MichaelJessen]

Thanks Josh, good to see someone discussing Passkeys in more depth.

Here's what I'd like to know:
1. I note that I can turn off password and passkey sync'ing in my devices. In this case, I'd need to create a separate passkey for each device. Once that was done, wouldn't that be equivalent to having multiple yubikeys with separate passkeys?
2. Does the emergence of passkeys resident on devices threaten Yubico?

Be interested to hear your thoughts.

[LucTaylor]

I did a rant recently on Facebook, basically saying "what is a passkey and why should I trust Samsung to handle my authentication"
I mistakenly assumed it was a string, similar to a session token or api key. Knowing it is asymmetric key is interesting and helpful. Thank you .

[joev]

If you are in the United States ALWAYS use a password as an obligatory factor in a logon process, no matter how many other factors you use. The government can compel you unlock a device with a fingerprint or a face but they can’t make you utter a password.

My opinion says that you have a Fourth Amendment right to be secure in your person and a Fifth Amendment right to refrain from incriminating yourself but every court says otherwise.

[_w_w_]

I am quite in tune with security as I work on adjunct technologies. Passkeys are glorified randomly generated passwords for now. It require a few things that rooted in having password anyways. Passkeys need to be stored on major ecosystem platforms, or in password manager software. Current implementation and regulation on biometrics mean none of those are stored in the cloud, so if you ever try to provision a new device (that is the gate keeper for your passkeys), you will need to enter an account and password anyways. Those ecosystems or password manager serve as point of failure or attack point. Passkeys don't really solve most of these issues. The best and most flexible solution is to use a hardware device but not your phone or tablet.

[larkc]

Thank you - very helpful. I was confused about the difference between physical and syncable passkeys and this is a good explanation.

[Ldysith]

Using a physical device for 2fa codes feels so cumbersome for logging in from mobile devices!

[opesach]

In amazon the passkey is just replacing the password but in Google and Microsoft they are replacing the 2nd auth 2FA as well.