Passkeys are great and wonderful and stuff, but what if you bypass them? Then they are the weakest link.
I’ve played with passkeys a bit, but have to consider what happens if I lose access to the passkey. As it turns out I’m not locked out forever, because there are built-in recovery methods if this happens.
The problem
However, Google’s Claire Forszt points out that weak account recovery methods introduce a new problem.
“If a passkey can be recovered with a lower security bar than the passkey holds, then the security benefit essentially becomes moot.”
This gives the bad people ways to get into your account via account recovery. Making the passkey the weakest link.
The solution
But there is a more secure way to recover an account: use of digital identity credentials.
“In Google’s scheme, users register a signed digital identity credential as a recovery method in advance. The credential is used to generate a unique cryptographic identifier, or ‘stable hash,’ linked to the user’s account.”
Of course, this can’t be generally used for account recovery until a sizable number of people HAVE digital credentials. Google thinks we’ll reach that point by 2030.
One more thing
But Non-Functional asserts that there is another problem with passkeys.
“What’s important to know is that unlike with any other kind of login credential, you do not have ultimate control over your passkeys….[W]ith passkeys come a hidden dial that lets the websites you use them on gradually remove your ability to do as you please with them and to use them with the devices and software you prefer.”
Specifically, there is a difference between attested and non-attested passkeys, and if a website insists on attested passkeys you could be locked out. Read more, including the author’s conspiracy theories about the true motives of the FIDO alliance, here.
(Because of my present and past professional association with FIDO Alliance members, I am sworn to secrecy regarding its annual meetings on September 31 in an underground bunker in Brussels.)
