Do you find yourself using passkeys or strong 2FA to secure your accounts? Leave a comment with your experience and if you don't already have a good 2FA key, get $5 off your next Yubikey purchase: www.allthingssecured.com/yubikey5off
@S1039426 күн бұрын
Thank You For Your Content ❤ you put so many videos which help people learn also I Brought 2 Yubikeys about one year ago love them I fell much safer the best 2FA method easy and secure
@AllOSes123415 күн бұрын
Strong, I forget my passwords and passkey save me I just need to use my fingerprint
@ivory.narwhal13 күн бұрын
@@AllThingsSecured honestly, I use both. Passkey for my mobile device. This is preferred. I also use MFA and all services I use too, should an attacker choose to use a password login they would still need an MFA code.
@DavidA2020010 күн бұрын
Pass keys are far better than a password with 2FA. However, with software passkeys, there’s always a compromise for convenience. Hardfobs are by far the most secure.
@talle134126 күн бұрын
Oh boy, that shirt isn't good for youtube's bitrate ^^
@AllThingsSecured26 күн бұрын
Haha! Yea, I’m learning that.
@AdemChatum26 күн бұрын
The video feels like it slows down
@Tsaukpaetra25 күн бұрын
I don't think it's KZbin that's the problem LOL.
@user-bo4uc3el5t3 күн бұрын
Why is that? Can anyone explain it?
@robervaldo46332 күн бұрын
@@user-bo4uc3el5t the video compression algorithms try to limit the amount of data transferred (bandiwidth), it seems they can't deal well with the amount of details on the shirt, then instead of reducing detail they prefer to reduce the amount of frames, or something like that
@Tux.Penguin26 күн бұрын
If a website login (such as the Amazon example here) allows the user to choose either password or passkey, then the passkey seems to add zero security. An attacker in possession of the password would simply choose that option.
@AllThingsSecured26 күн бұрын
In some respects, yes. But there is added security if YOU as a user only use the passkey. It protects against phishing and it's not susceptible to keyloggers or other MITM attacks.
@Tux.Penguin26 күн бұрын
@@AllThingsSecured ah, good point. If that password is unique, safely guarded, and never used, then a user can enjoy the benefits of a passkey and just reserve that password as a last resort method.
@JosephTomasone23 күн бұрын
That’s why for accounts like that - where someone can cost you money - use a password manager like 1Password to create an incredibly complex password and enable 2FA.
@JosephTomasone23 күн бұрын
I should add that most sites are reticent to remove password authentication since passkeys are so unknown to most users. Once they become more accepted, I would expect password logins to be removed for new accounts and then ultimately for legacy accounts. That - of course - will take quite some time. All major changes do.
@peterstonesuk19 күн бұрын
@@AllThingsSecured AITM
@ThatonedudeCR1295626 күн бұрын
Thank you for covering this! I bought keys like a year ago and I honestly couldn't figure out if I was using it incorrectly. Almost no sites allow the key to be anything more than a backup since you essentially still need to log in how you previously had. I was really wondering if it was something I set up incorrectly. So relieved it's just awkward to use them in many places
@AllThingsSecured26 күн бұрын
Yea, passkey use is limited, but using it as a 2FA key is very useful!
@GuillaumeRossolini26 күн бұрын
The advice in the video is on point for this: use the keys only for the most sensitive accounts, and you’ll find that these services are often the most mature as well. One thing the video didn’t mention: keep a record of which accounts you set them up on, because on the day you lose the main key, you’ll want to order a new one and set it up on these same accounts again (and revoke the lost key too)
@artos620925 күн бұрын
@@GuillaumeRossolinithat's the reason to have 2 of them. One you use and one stored in a safe place as a backup.
@GuillaumeRossolini25 күн бұрын
@@artos6209 no, I’m well aware and I was actually pointing out what happens when you lose one of the two keys
@shubinternet25 күн бұрын
Note that Amazon and Google both use password protected hardware tokens (like Yubikeys) as their method of authenticating to internal systems. It takes some additional infrastructure, but it is very robust and resistant to many types of attacks. But the human behind the keyboard will probably always be the weakest link.
@AllThingsSecured24 күн бұрын
Always
@cobrabtc26 күн бұрын
also. These companies that have passkey support should also offer the user the ability to remove and delete the logging in with a username and PW. Defeats the purpose and security of passkeys if that old tech is still avail and could get hacked and stolen.
@AllThingsSecured26 күн бұрын
I agree, but I think they're going to be slow to do that for a number of reasons.
@Toramt15 күн бұрын
They'll still need a mechanism for you to gain access if you lose your passkey.
@SirusStarTV3 күн бұрын
@@Toramt they can add a feature to unlock password authentication by sending sms with OTP to your phone and then after you're verified you can enter your password.
@joev40423 күн бұрын
If you are in the United States ALWAYS use a password as an obligatory factor in a logon process, no matter how many other factors you use. The government can compel you unlock a device with a fingerprint or a face but they can’t make you utter a password. My opinion says that you have a Fourth Amendment right to be secure in your person and a Fifth Amendment right to refrain from incriminating yourself but every court says otherwise.
@LTPottenger10 күн бұрын
They will give you contempt charges if you don't in some cases but if you have something that important than setting it to destroy itself is better
@LucTaylorКүн бұрын
I did a rant recently on Facebook , basically saying "what is a passkey and why should I trust Samsung to handle my authentication" I mistakenly assumed it was a string, similar to a session token or api key. Knowing it is asymmetric key is interesting and helpful. Thank you .
@hoopoe_10 күн бұрын
Passkeys are probably intended for people who have so far been using simple passwords, memorising them and using them on multiple websites. Using passkeys will mean a big jump in security for them. Those who use password managers for creating and saving long, random, unique passwords for each website along with 2FA won't gain much by using passkeys. I have created passkeys on a couple of websites out of curiosity but I still use passwords on those sites.
@theoldtribe20 күн бұрын
If I have set up multiple YubiKeys for an account, should I then disable the use of SMS 2FA?
@AllThingsSecured19 күн бұрын
If you can, I would advise that you do.
@seansingh442117 күн бұрын
Because text messages is the main vector for SIM cloning. I would suggest if you can use your Yubikey everywhere you can
@demorez54 күн бұрын
every criticism in this video is aimed at the implementation of passkeys, instead of passkeys as such. i think its a great technology and since i have implemented it in my identity provider my life has become so much easier, i can log in into all my services with a single PIN or fingerprint
@hoki369726 күн бұрын
Is it my computer or is there a weird framerate in some parts of the video?
@AllThingsSecured26 күн бұрын
Yea, sorry about the dropped frame rates. It’s a new piece in my studio and I’m working on it. Thanks for your understanding.
@Ice_219226 күн бұрын
I'm watching this on my work computer and the FPS get me thinking "Is this laptop really that bad?" lol
@larkc767726 күн бұрын
Thank you - very helpful. I was confused about the difference between physical and syncable passkeys and this is a good explanation.
@AllThingsSecured26 күн бұрын
Glad it was helpful!
@autohmae22 күн бұрын
It's really sad that he said some only allowed syncable passkeys.
@NomadOutdoorAdventures26 күн бұрын
I totally agree. I love having my account secured and I do have a security key in place for as many accounts as I can, but yet still have not activated passkey on any of my accounts I feel the same way about passkey going to continue using what I’ve been using to me. I’m very happy with that.
@AllThingsSecured22 күн бұрын
Glad to hear it. 👍🏻
@augustusmaximus878425 күн бұрын
glad i`m not stupid. i started to use passkeys and thought i might do something wrong. or i needed to change some settings, because all my accounts act just like the passkey is password ...
@AllThingsSecured22 күн бұрын
Ha! Yea, you’re not alone, nor are you stupid 😂
@nomadshiba7 күн бұрын
its only good for if you only wanna verify already logged in users before doing certain actions. its faster than typing password, but you can argue its faster for password manager to fill the password
@MichaelJessen23 күн бұрын
Thanks Josh, good to see someone discussing Passkeys in more depth. Here's what I'd like to know: 1. I note that I can turn off password and passkey sync'ing in my devices. In this case, I'd need to create a separate passkey for each device. Once that was done, wouldn't that be equivalent to having multiple yubikeys with separate passkeys? 2. Does the emergence of passkeys resident on devices threaten Yubico? Be interested to hear your thoughts.
@AllThingsSecured22 күн бұрын
Thanks for the questions, Michael. Yes, you can create single-device passkeys using your phone and that would be about the same as a Yubikey. The difference is that the phone is connected to the internet at all times while a Yubikey is not. And no, I don’t think this threatens Yubico. In fact, they helped develop the FIDO2 standard. Their key is just one of many ways that you can do 2FA or passkeys. Make sense?
@autohmae22 күн бұрын
the more widespread these technologies are, they might sell less percentage wise, but the market itself will be many many times larger
@kenp412425 күн бұрын
Passkeys don't suck, it's the implementation that sucks (see passwordless SSH for how this should work). And whether it's in a password manager or a yubikey, if you can't disable other login methods, it's pointless to a threat actor. I've given up on passkeys, I just stick with a good password manager, strong passwords and 2FA. PSA: backup your 2FA codes!
@AllThingsSecured22 күн бұрын
I agree, and despite the title, I tried my best to explain that in the video.
@Mysdia2 күн бұрын
Passkey Does replace 2FA. As for whether it replaces typing in a Username or not.. I would say the End User should have control over whether the website will be registered on their FIDO2 token as a RESIDENT key. If it's a Resident key, then the website should be able to Prompt the user to PICK from a list which account they want to use. There is no requirement to prompt for a Username, but it's a design decision by the website operator. I don't understand why Amazon still prompt for it after a Passkey is supplied either. They should at LEAST make it an option to skip 2-step Login only when a Passkey is used.
@giacospace26 күн бұрын
The title is very misleading. It seems that the message is: passkeys suck as a method in general, while in reality is the adoption and implementation that every company does that is up for debate. One example. The so much criticized Sony (Playstation), after many data breaches, is so far the only gaming publisher that introduced passkeys in a way that it invalidates password and 2FA. You want to remove the passkey, you need to set up a new password and 2FA.
@utuber100026 күн бұрын
"the only gaming publisher that introduced passkeys in a way that it invalidates password and 2FA. You want to remove the passkey, you need to set up a new password and 2FA." That's the way it ought to be on every website, starting with all financial websites, but so far I don't see any groups or individuals strongly advocating for that position.
@AllThingsSecured26 күн бұрын
Sorry you didn't like the title. Saying "The implementation of passkeys suck" just didn't have the same ring to it.
@giacospace26 күн бұрын
@@AllThingsSecured your channel, your title 🙂 If the goal is convincing people to adopt passkeys and I read "passkeys suck", I think we're giving the wrong message. Keep up the good work
@autohmae22 күн бұрын
A title on a KZbin video has a truth to it, but also a bit clickbaity ? Say it ain't so ! 🙂
@CP-xu2pjКүн бұрын
How is a pin different from or more secure than a password? I don’t get it.
@ptsai51425 күн бұрын
In my experience some financial service providers have already doing passkey with device binding.
@AllThingsSecured22 күн бұрын
Interesting…which ones?
@darrylcoleman434726 күн бұрын
This Was a really informative video thank you for sharing and education for the public
@AllThingsSecured26 күн бұрын
You're welcome, Darryl!
@davidunwin786821 күн бұрын
Getting password manager and a couple of hardware keys has completely changed my life. I never need to remember a username or password ever again (except for work stuff)
@BartJenkinsRW3 күн бұрын
No. Apple has implemented this correctly. Using my Touch ID enabled MacBook, when I connect to an Apple site it pulls my passkey userid from my passwords keychain (which does NOT have to be an email or phone number), applies that and initiates the Passkey flow all in one step so the only thing I have to do to login is put my finger on the Touch ID button or present my face if logging in on my iPhone. The number of items I have to type-in drops from 3 (email, password, 2FA code) to zero!
@MelissaB099926 күн бұрын
I do use Yubikeys, as a passkey and 2FA where I can, but also like the convenience of using my phone or laptop as the device sometimes instead of my Yubikey (not saving in iCloud Keychain or Google Password Manager). Where would you place the security of using your phone or laptop as the device vs. a Yubikey in the scheme of things?
@AllThingsSecured26 күн бұрын
I tried to answer that toward the latter half of the video. It depends on the sensitivity of the login. For me, the Yubikey is the ultimate form of security, so it gets used for the most sensitive logins.
@artos620925 күн бұрын
My question is what happens if you lose the phone or it is stolen or malfunctions? I also wonder what happens if the passkey gets compromised. Nothing is totally secure. Is it possible to change it to a new one? I am looking at getting a yubikey as i trust that further than passkeys. As far as passkey go, until I get a satisfactory answer to those questions, I will keep using my offline password manager and not jump on the passkey bandwagon.
@AllThingsSecured22 күн бұрын
Losing a passkey isn’t terrible as long as you have a backup. In that case yes, you can go in, revoke the old passkey and create a new one.
@gabrielgon34082 күн бұрын
You didnˋt mention the most important thing and the reason why Iˋm not using passkeys at all. At least on my device, an S22 ultra, the passkeys asks for my fingerprint OR MY SMARTPHONE PIN. Thats completly absurd. Why would I swap a long and random password for an 8 digit pin? AND MORE, I live in a country (Brazil) thats possibile that someone would point a gun at me and ask for my pin, so sure, letˋs give the thief my device AND the password for all my passkeys. (!!!) Another possibility is someone being able to see me unlocking my device with the pin for some reason, something that also happens in the US. Until itˋs only possible to unlock with biometrics and not the deviceˋs pin, Iˋm out. Very unsafe.
@CedroCron26 күн бұрын
Until there is a standard and easier portability I'm only using my hardware keys as a 2FA method. Once all places allow me to store my passkeys in Bitwarden and use that as my Passkey everywhere and not just select sites then I'm not interested in Passkey. The other thing I don't like is not being able to turn off account recovery for Passkeys or Hardware keys because then it just lowers the security if someone gains access to your email or SIM-jack's your phone.
@AllThingsSecured22 күн бұрын
👍🏻👍🏻
@opesach8 күн бұрын
In amazon the passkey is just replacing the password but in Google and Microsoft they are replacing the 2nd auth 2FA as well.
@westbccoast2 күн бұрын
I wish banks took security seriously and gave us the option of hardware keys, banks 2FA are a joke, sad
@Maj91833 күн бұрын
I was really excited about passkeys until I learned I couldn’t get rid of my ID and password and therefore would still be vulnerable in that regard anyway.
@rpm360514 күн бұрын
Right on target sir. I looked into what services allow the use of passkeys and found that very few of my important and most important accounts have adopted passkeys. I’m staying with username/passwords, password manager with very random mixed (letters, numbers, special characters) greater that 15 character passwords, and two factor authentication where ever it’s offered. What you have described says that passkeys are a bigger pain in the but than what I use now. Not very encouraging.
@rpm360514 күн бұрын
I forgot to say that I also set up alerts for my important/most important accounts so I get notified of activities on those accounts. Is all this a guarantee? No, but it is IMHO the best way to go at this time. I’ll check out passkeys sometime in the future when the Google/Microsoft/Technology industry has them better worked out and far more ubiquitous.
@miltonthecat22408 күн бұрын
Sorry, I refuse to use a security device that plugs into the computer. Years ago, to log into my employer's company network from home, I was required to use a credit-card sized device with a small screen that displayed a rolling code that I had to manually enter. These days, that credit-card sized device could have biometrics or some other form of authentication to provide some additional security if the device is lost or stolen before I have a chance to disable it.
@sploders10195 күн бұрын
Certain security devices that you plug in do have that option. You’re mainly looking for anything that implements the U2F standard, not just Yubikey (though they may have one, too). The benefit of a physical device is that the keys are not syncable. They cannot be copied, even if an attacker gets a hold of your computer. With most software-based implementations, a skilled attacker could bypass any biometric authentication you have. Biometrics are a fuzzy-matching logic, which means they can’t be used to decrypt data as they are not a definitive key of finite variations. Something like a Yubikey can get away with this by making custom ICs that do not provide any exposed method of accessing persistent memory. To bypass that, you’d have to de-lid the chip and analyze it under a microscope, and be able to decipher what’s happening at the electrical level
@toddhensley88023 күн бұрын
They’ve managed to make this as complicated and confusing and convoluted as using PGP, which went absolutely nowhere in the consumer space.
@AllThingsSecured22 күн бұрын
Yea, I don’t think I’ve appreciated how important consumer packaging and user experience play a role in security standard adoption.
@lupoal411310 күн бұрын
here in Italy there are no BANK accepting authentication via ubkey or other similar producs... wondering why
@RussMichaels14 күн бұрын
The biggest issue is those accounts that people think are not important and have weak security on. The hackers get into these accounts easily still your identity get the answers to all your security questions and then use this information to get into all your other accounts and reset your passwords and get past your past keys.
@russmarano38029 күн бұрын
they still cannot get past the physical key, change pw/un all they want, the physical key stops them dead in their tracks.
@RussMichaels9 күн бұрын
@@russmarano3802 you seem to be under the impression that every single account/website on the internet supports 2fa keys. This is simply not true, most sites still do not even have basic 2fa let b alone physical keys. And yet you can get past logins that have this, it happens every day. You should watch some of these hacking videos on here and see how they do it.
@deejay590826 күн бұрын
Finally i understand....thank you so much! 😅 Greeetings from Austria. 🇦🇹
@AllThingsSecured26 күн бұрын
Greetings to you as well!
@nishantpiano25 күн бұрын
How secure would syncable passkeys be if they were stored on a self hosted password manager like Bitwarden / Vaultwarden without any external access? Thanks!
@AllThingsSecured24 күн бұрын
I guess that depends on you. People assume it’s safer than with 1Password, but I would actually trust the security practices of 1Password more than an individuals.
@dogoku13 күн бұрын
Even if you someone manages to steal a syncable passkey, wouldn't it be useless to them, since they need biometrics to actually activate it?
@lukchem26 күн бұрын
LOL I actually have never seen a website requesting a 2fa after using a Passkey.
@AllThingsSecured22 күн бұрын
You’re welcome 😉
@user-mdrc57cbnjjd26 күн бұрын
Still trying to make sence of the syncable part. I setup passkeys on my three android phones separately for one outlook account. When does the syncing come into play?
@AllThingsSecured26 күн бұрын
It depends on how you've set it up, I guess. If the passkeys are bound to that single device and they aren't syncing, then you have your answer.
@user-mdrc57cbnjjd26 күн бұрын
@@AllThingsSecured Ok, makes sense. But I am trying to think of a case where syncing with passkeys occurs in the context of Android phones. I think with Windows Hello as well, you're creating a passkey for just that computer. I have never owned an Apple phone, so I don't have any experience with them.
@tac7315 күн бұрын
I had set up passkeys wherever I could. But, long story short, I've backed off on that. When the dust settled, I'm back to using Yubikey's OTP, and Bitwarden's TOTP for 2fa. For me, Passkeys are too wonkie right now. Maybe one day when they gain more uniformity in implementation and scale?
@eliasl3324 күн бұрын
I think having multiple steps is good in case the pass key gets stolen.
@mr-lacker10 күн бұрын
Don't most of the websites support Google sign-in? Wouldn't adding two keys on Google account be as good as using keys on each website?
@albertopicado494325 күн бұрын
Concerning the point of some websites requiring you to enter email then use passkey instead of password only then require 2fa(amazon), this differes accross different services. So Some services actually have on the login page a button to click to sign in with passkey directly without requiring entering the email and if you have setup 2fa this first passkey will bypass the 2fa (Microsoft for example). Some other like Proton let you decide if you want to use passkey as a replacement to password only while still requiring the 2FA method (or vice versa according to your settings). So to summarize, the implementation of passkeys is different accross websites.
@AllThingsSecured22 күн бұрын
You are correct. I think I said in the video that every website implements it differently.
@autohmae22 күн бұрын
I think email address is fine, I can see how the flow of a login would be easier to build for many existing websites. The email address can also be a simple auto-fill by the browser anyway.
@vincentnthomas124 күн бұрын
Hey man, you don't really know what you're talking about. It has an entirely different purpose compared to passwords or 2FA. They all fill one hole in account security, it's just that passwords are the most exploitable (the bottleneck is that users have to remember them). Btw the syncable passkeys and the other "types" is bs, they're all the same
@AllThingsSecured24 күн бұрын
I appreciate the feedback but would need something a lot more coherent as a response in order to take you seriously.
@AmirIskandar14 күн бұрын
Yikes you seem to be the type resistant to criticism. Wouldn't wanna take security advice from someone like this. Unsubsrcribed.
@RobbyPedrica11 күн бұрын
@@AmirIskandar Most people accept criticism if formulated coherently. But most people also struggle to explain concepts or opinions. You stated an opinion but refused to explain it. Who's fault is that?
@fuseteam8 күн бұрын
While technically syncable passkeys are the same as single device passkeys, security wise they are different. With single device passkeys, there's no password manager account to crack to get a hold of a password- they need physical access to your device (phone, computer, yubikey, whatever) With syncable passkeys, the password manager account you saved it in, becomes an additional attack vector. But yes syncable passkeys, single device passkeys and yubikeys are all the same thing
@jmr14 күн бұрын
Tracking passkeys is an interesting thought experiment.
@FranzBazar12 күн бұрын
Our (very large software) company forced all employees to "switch" to using passkeys. I got it set up, and if anything it's Less convenient than before. Now there are More steps for me to log in - and I generally need to use username/password anyway because either a)I have my laptop closed so no access to the power button on the Mac for thumbprint; or b)when I do try to use my thumbprint it doesn't work more than half the time and I have to revert to using username password anyway. - It's all just More headache than before, not less.
@utuber100021 күн бұрын
If one of the principal motives for introducing passkeys is to eliminate the ability of wrongdoers to obtain our passwords by breaking into websites we use and/or buy stolen passwords on the dark web, then what is the point of websites not giving us the option to remove our user name and password after creating a working passkey into the site? It seems like an exercise in futility the way it is presently set up. This paradox substantially contributes to the slow adoption rate of passkeys by users, in my opinion. As things now stand, taking the time to set up passkeys wherever available, as I have done, feels more like a parlor game than a successful step to beef up our security. Or perhaps a sales argument for hardware keys instead of passkeys? Or simply, the biometrics option already available on most computers and phones?
@codester_d25 күн бұрын
Using Passkeys with my self hosted services with Authentik. No usernames, passwords, or 2FA.
@AllThingsSecured24 күн бұрын
When you control the service, you can do that!
@dennisvanmierlo25 күн бұрын
Good quality content. I agree with your view on passkeys. The quality of your video is not that great. Very often it looks like it's missing frames. Maybe it a result of how the overlay graphics are rendered!?
@AllThingsSecured24 күн бұрын
No, it’s my fault on skipped frames due to some new equipment. It’s a one-time event.
@MarcLombart26 күн бұрын
How would I use a key like Yubikey to log onto sites on my mobile devices?
@AllThingsSecured26 күн бұрын
You can either plug it into the USB-C slot or the Yubikey 5 series also allows for NFC (which is just tapping the key on the phone to use).
@expat644 күн бұрын
This was actually a really good presentation. Unfortunately I saw what looked like a click-bait title so almost didn't watch it. Indeed it took it a couple more times popping up on my suggestions before I was tempted in. I'm glad I was, and am not following you 🙂
@deezplace24 күн бұрын
good info but still too convoluted to send to my tech challenged relatives to help them understand.
@AllThingsSecured24 күн бұрын
Sorry to hear that
@davidcave54267 күн бұрын
So are passkeys similar to ssh keys and pgp/gpg keys? Also, biometrics are not protected by the Constitution as far as unreasonable searches and seizures. The Supreme Court ruled because biometrics are public (people can see you and your fingerprints are easily taken), they are not protected against searches and seizures. Passwords are protected, however.
@BobFrTube8 күн бұрын
This is oriented towards human users. The challenge is in using APIs and connecting devices that operate on our behalf. The worry is that this rolls us back to the days before people could write their own apps.
@kfffisher25 күн бұрын
Educational as always. Thank you!
@AllThingsSecured22 күн бұрын
You bet!
@davinp26 күн бұрын
Websites/services are slow to adopt passkeys, so I don't expect 2FA to go away anytime soon
@AllThingsSecured26 күн бұрын
Agreed.
@youtubeadfree418726 күн бұрын
What happens if you lose the Yubikey?
@azclaimjumper26 күн бұрын
Same as losing a key to a padlock. Which is WHY you want to buy TWO Yubikeys, same as getting 2 keys when you buy a padlock.
@AllThingsSecured26 күн бұрын
Yes, what @azclaimjumper said.
@solomonhilliard535726 күн бұрын
Use your back up to login and remove the lost key from the account
@mr-lacker10 күн бұрын
buy two or none
@declanmcardle9 күн бұрын
Some sites charge extra to use a Yubikey as a HW Passkey 😞
@nomadshiba7 күн бұрын
2:05 im not a fan of security keys or any other physical device that gives permissions. only secure place for a private key or its seed is your mind, with an external signing device
@jinvid5 күн бұрын
Nice Lego Globe my guy!
@autohmae22 күн бұрын
The limits on the Yubikey kind of scared me, especially because as I understand that some systems/services end up using slots indirectly.
@autohmae22 күн бұрын
So I looked around turns out the limits, for websites, etc. specifically, is on: Discoverable Credentials / Resident Keys, which is the part you talked about how services don't offer it (you still need to specify the username), so their is actually a reason for it. Having to enter your email address (maybe auto-fill-in by the browser) and so bad and makes it easier to implement the flow for a website, maybe. Also means you aren't running into limits on your Yubikey (25).
@autohmae22 күн бұрын
The others are, unlimited, so that does also mean they use an algorithm to calculate the private key per website, based on a single private key: pk=(hash (lowercase (website-domain))+single private key) or similar, probably fine, but it does mean it doesn't generate a completely standalone private key per website.
@RobbyPedrica11 күн бұрын
Look at the Token2 Swiss company's products - they have a lot more slots than Yubikeys.
@shock78926 күн бұрын
The biggest concern I have with passkeys is "if I don't use them can a hacker use them on my account" is this a valid concern or is it not?
@AllThingsSecured26 күн бұрын
I don't think so, although I'm not sure I understand the concern completely.
@autohmae22 күн бұрын
Please explain the question, because it's not clear what you meant
@senchaholic23 күн бұрын
First: Amazon is a very bad example to demo passkeys. Google, Apple and Microsoft (and Sony believe it or not) are some of the few who have implemented passkeys correctly, meaning you use a passkey in place of a password and MFA. They way you demo it makes it seem like "this is how passkeys work, sucks am I right?" Which comes off as a bit disingenuous in the light of you pushing yubikeys. Unless you didn't really know how the other actors I mentioned have implemented it? (Yes, Microsoft's setup process in particular sucks, but I'm specifically referring to the passkey usage at login.) Second: normal users are never going to use yubikeys. Yubikeys are for IT-experts or employees at a company. Syncable passkeys are the most likely used version going forward.
@AllThingsSecured22 күн бұрын
Thanks for the comment. Amazon may not be the best example, but Google wasn’t too much better in my experience. I find it interesting that you think I’m saying all this to push Yankees seeing as you can use the physical keys whether you use 2FA or passkeys. And if you decide to use 1Password or iCloud instead…great! As for “normal users,” I think that’s a cop out and underestimates what people are motivated to do now. Everything starts off with early adopter, but 2FA keys are far, far beyond that stage. I prefer to treat my audience as if they’re intelligent.
@Andre-qo5ek26 күн бұрын
the biggest reason i do not have a passkey right now is because they can not be used ubiquitously across ALLLLL password protected applications. (i also dont trust biometrics. ) -shrug- I stick to a password manager , unmemorizable 20+ character passwords and a rotating passwords schedule.
@AllThingsSecured26 күн бұрын
You do realize that there is no one “passkey”, right? You create a unique passkey for each login that allows it.
@bigjoegamer26 күн бұрын
You don't have to use biometrics. You can use a long alphanumeric PIN instead, and/or a security key that is locked with a long alphanumeric PIN. They talk about passkeys and biometrics together because they know that biometrics are more convenient, and a lot of people care more about convenience than security in the online world (look up "most popular passwords 2024" for proof).
@kevinobrien236625 күн бұрын
Do Yubikeys work across different devices? I would want one key I can use on my PC laptop, google phone and tablet. Good video, thanks
@artos620925 күн бұрын
Think they are available in USB A & C also in a version that has NFC support for phone that are so equipped. Not sure if the USB C version will work on a phone through the USB port or not though.
@AllThingsSecured22 күн бұрын
Yes, that’s part of what makes them so useful: they work on any device that as a USB port or NFC capabilities (most laptops, tablets and phones nowadays).
@GManWrites26 күн бұрын
My thoughts are that 100% people are going to use AI to crack any security measures people come up with, so what are your thoughts on the danger of AI breaking our security?
@AllThingsSecured26 күн бұрын
How in the world is AI going to break security measures?
@GManWrites26 күн бұрын
@@AllThingsSecured A good question? I asked ChatGPT and this was the answer. Cracking a YubiKey or any hardware-based authentication device is generally difficult due to its design and the security protocols it employs. However, if AI were to be used in an attempt to bypass or crack the security of a YubiKey, it might be applied in the following speculative ways: ### 1. **Social Engineering Attacks** - **Phishing**: AI could be used to craft highly convincing phishing emails or messages to trick users into divulging their OTPs or other authentication credentials. - **Deepfake Technology**: AI could generate deepfake audio or video to impersonate trusted individuals, convincing users to reveal security details or grant access. ### 2. **Brute-Force Attack Automation** - **Pattern Recognition**: AI could analyze patterns in user behavior, potentially predicting OTP sequences or other elements based on data from compromised systems. However, YubiKey’s security is specifically designed to resist such attacks. - **Enhanced Brute Force**: AI might assist in a brute-force attack by rapidly testing different combinations more efficiently, but given the limited number of attempts before the key locks or resets, this approach would likely be ineffective. ### 3. **Bypassing or Exploiting Software Vulnerabilities** - **Zero-Day Exploits**: AI could assist in finding vulnerabilities in the software that interfaces with YubiKey, potentially identifying flaws that could be exploited to bypass authentication. - **Behavioral Analysis**: AI might monitor and learn from the interactions between the YubiKey and software, identifying potential weaknesses or patterns that could be exploited. ### 4. **Physical Security and Side-Channel Attacks** - **Side-Channel Analysis**: AI could be used to analyze side-channel data (like electromagnetic emissions or power consumption patterns) to infer sensitive information during the authentication process. - **Physical Access Exploits**: AI could potentially assist in analyzing and automating physical attack methods (such as tampering with the device itself), though this would require access to the hardware and is more of a security research area than a realistic threat. ### 5. **Automation of Data Collection** - **Data Mining**: AI could automate the collection of large-scale data across platforms to find potential weaknesses or to cross-reference with known vulnerabilities related to YubiKey's implementation. - **User Behavior Analysis**: AI could analyze user behavior over time to predict when they are most likely to use the YubiKey, potentially helping in timing other forms of attacks. ### Limitations - **YubiKey’s Design**: The YubiKey is designed with strong security protocols, including physical presence requirements (e.g., touching the device), making it highly resistant to remote attacks. - **U2F and FIDO2 Security**: These protocols are built to protect against phishing, man-in-the-middle attacks, and other common threats, which limits the effectiveness of many AI-driven attacks. ### Conclusion While AI can theoretically assist in attempts to crack a YubiKey, the security architecture and protocols of such devices are specifically designed to resist these kinds of attacks. Most real-world attempts would likely focus on social engineering or exploiting vulnerabilities in the broader ecosystem (software or user practices) rather than directly attacking the YubiKey itself.
@autohmae22 күн бұрын
I think the weakest link is still the human, so using AI to mislead the human is going to be very common. That said: 1 of the big advantages of passkey is that every site has gets it's own keypair and thus you can't be mislead to authenticate to a fake site, this helps a bunch because that greatly reduces the number of possible misleading attacks.
@RobbyPedrica11 күн бұрын
AI is not in a position to crack secure codes, and won't be for many years, if ever. Nothing to worry about at the moment.
@lumixS5M225 күн бұрын
just to be curious, what be your daily work?
@AllThingsSecured24 күн бұрын
I be working online
@talharehmanwb26 күн бұрын
How can i get number for verification in websites??
@AllThingsSecured22 күн бұрын
You have to set up a 2FA Authenticator first.
@willcoder25 күн бұрын
The polo shirt that KZbin's codecs hate.
@AllThingsSecured24 күн бұрын
Yea, I realize that now.
@benderunit442 күн бұрын
mins and I still do not know what is a passkey.. the name itself does not explain anything at all
@utuber100026 күн бұрын
Thanks for this updated video, but the bottom line still escapes me: How can we remove our long password and our SMS and our email as 2FA from the websites of our online bank accounts and credit cards (VERY FEW take passkeys) so as to defeat a wrongdoer from using Forgot my Password to intercept the link given to change our password? Can we do that with a Yubikey? Or set it up with our biometrics? If not, with what?
@AllThingsSecured26 күн бұрын
That’s part of the point - you can’t. And that has nothing to do with Yubikey, that’s all about how the different banks and services implement their login security.
@utuber100026 күн бұрын
@@AllThingsSecured I'm not criticizing Yubikey. I bought 3 of them. I'm just still baffled as to how I/we can use them to protect financial accounts like those mentioned from the most common form of interception.
@PvtAnonymous26 күн бұрын
@@utuber1000 it's simple, change your bank to one that lives in the 21st century. My condolences to my fellow Americans, who have to deal with these backwards companies.
@BartJenkinsRW3 күн бұрын
Hatdware keys are great until you travel out the area of your backup keys. Imagine being on a cruise ship and you lose your yubikey and need to sign in somewhere that requires that key. You are scrod!
@davinp26 күн бұрын
stop it with apple, what about Microsoft Windows? Windows uses Windows Hello which you can setup passkey or yubikey
@AllThingsSecured26 күн бұрын
I mentioned both Apple and Microsoft.
@zug81078 күн бұрын
Passkeys, bad. Yubikey, awesome. Totally unrelated - this video sponsored by Yubikey.
@AllThingsSecured8 күн бұрын
You’re funny. It’s really better to actually watch the video and then comment, then you’d know that passkeys and 2FA keys aren’t mutually exclusive.
@doug-zilla26 күн бұрын
I've been using Authy for some time. One reason I chose Authy was because I could install an Authy client on Android, Linux and Windows and have them sync. Unfortunately, Authy pulled the plug on their desktop clients. And, lately, Authy won't install on non-Google Android clients like Graphene and LineageOS. So, I'm having to undo all my 2fa setups. Next, I'm getting rid of Authy. Not sure what I should use next.
@brianm-26 күн бұрын
I completely migrated 2fa to 1pw also use it for passkeys, ssh keys and all logins, has cli support and clients nearly everywhere
@AllThingsSecured26 күн бұрын
Ugh...so sorry Doug. I hate reconfiguring 2FA.
@jayarmstrong25 күн бұрын
ente auth
@davinp26 күн бұрын
X is just rolling passkeys for Android. It has just been only on iOS which is frustrating.
@AllThingsSecured26 күн бұрын
Yea, I was frustrated as well.
@daniel292638 күн бұрын
Amazons implementation clearly sucks, there are sites where's it's used in the way it was supposed to be used.. Finding the worse possible example and drawing conclusions from that is disingenuous.
@richarddaugherty858324 күн бұрын
I think one of the problems with adoption is that passkeys are not exactly cheap. Last I looked it would be ~$200 for a key and a backup key. Low income folks can't afford that. Heck, my son has a decent job and is working 2 jobs to make ends meet. If it really caught on then sooner or later someone is going to say this authentication method is racist (silly, but that's the world we live in). I don't think my bank even supports this method. I turn on 2FA everwhere possible and use a password manager with very long passwords. I don't even know what they are myself!
@AllThingsSecured24 күн бұрын
I don’t think you watched the video. A passkey can be done easily for free, which invalidates your given concern completely.
@richarddaugherty858323 күн бұрын
@@AllThingsSecured I did watch the video all the way through. I priced a couple models of Yubikeys and two of them would be ~$200 ish. I'm skeptical of anything free. It's usually worth what you paid for it. As for putting my passwords into Apple or Googles care (shudder) I would never go there.
@shiftyjesusfish6 күн бұрын
"Not trackable" -k
@SirusStarTV3 күн бұрын
Google and microsoft passkeys don't suck
@jonathanhirschbaum675410 күн бұрын
Passkeys are new IPv6
@videodude81378 күн бұрын
Who are you. What are your Bonifides? Are you another self-made youtube expert?
@raylopez9925 күн бұрын
Nice channel I think I'll subscribe. Years ago I trolled some stock forum for a company that sold one of those dongles that randomly changes numbers every 30 seconds to generate one-time passcodes. I said it would go nowhere, and more or less I was right. Today's "something that you have" (Ubikey) key is related and my opinion is still low. Not that I don't like the idea, but rather it reminds me of the adage "necessity becomes virtue". When enough people are doing something one particular way, like now with no such "Ubikey", then it becomes the virtuous "norm". If and when enough people adopt the "Ubikey" then and only then will it become the virtuous norm. Chicken and egg thing.
@MichaelJessen23 күн бұрын
RSA Securid? Massively successful company, widely used in the corporate world. Not sure about the stock, but the product was/is sound.
@AllThingsSecured22 күн бұрын
I’m not sure I follow your logic here.
@raylopez9922 күн бұрын
@@AllThingsSecured Network effects bro. Google it. As in your video (I think it was yours not another channel) even Google doesn't support Ubikey 100%. Bye.
@DexxterClarkMusic5 күн бұрын
video starts at 4:54
@LogicalLighting25 күн бұрын
I am scared to lose or have my passkey stolen.
@AllThingsSecured22 күн бұрын
What about 2FA?
@thememace8 күн бұрын
Dude, passwords are NEVER saved on a server. This and other statements give me the strong impression, that you don't know what you're talking about. Also very disturbing that you are so strongly biased with the yubikey and sorta advertise it without clearly clarifying it as an ad.
@Flashback_Jack26 күн бұрын
If you use your fingerprint to unlock your cellphone, you already use passkeys.
@AllThingsSecured26 күн бұрын
Kind of. I think that's part of the problem, though - if you consider that a passkey (which isn't based on the FIDO 2 standard), then you just add confusion to the conversation.
@eaglepass517027 күн бұрын
Excellent video!!! Thank you!!
@AllThingsSecured26 күн бұрын
Thanks! 🙏
@scottag012 күн бұрын
This is an indictment of the websites that don’t know how to implement Passkeys well, not an indictment of Passkeys.
@steveshuffle27 күн бұрын
Amazing video Josh - thank you for your work 🙌🏽
@AllThingsSecured27 күн бұрын
Glad you enjoyed it!
@Huskyzeit26 күн бұрын
WTF: KZbin translates the Channelname of 'AllThingsSecured' to 'Alles gesichert' - but only under the video. NOT in the comments... Why do the translate _anything_ for an english video. This simply makes no sense! Thats only obfuscation...
@AllThingsSecured26 күн бұрын
That's beyond my control, sorry.
@lukchem26 күн бұрын
They don’t translate it in the comments because the Channelname isn’t shown there anymore since it now shows handles. (The thing with the @ in front of the name.) Since the purpose of these handles is to be able to use it as a link to the channel they can’t translate it.
@Huskyzeit23 күн бұрын
Thank you, I know it's not under your control. It's a stupidity anyway, that a link 'AllThingsSecured' points to an accout 'Alles gesichert', who's real name ist 'AllThingsSecured'...😅
@lukchem23 күн бұрын
@@Huskyzeit I think the YT Developers haven’t really thought about that themselves. But funfact, on my home feed where I discovered this video the channel was shown as all things secured but only after clicking on the video Alles Gesichert was shown.
@macbitz26 күн бұрын
What concerns me is whether simply having possession of an unlocked device allows logins with a passkey? E.g. someone shoulder surfs you unlocking your mobile in a bar, steals the mobile and logs in to it and is then able to log in to sites that use an email address and passkey with no further challenge?
@AllThingsSecured26 күн бұрын
That shouldn't be the case. Passkeys require some kind of authentication, whether biometrics or a known password/PIN.
@solomonhilliard535726 күн бұрын
You'd have to rescan fingerprint or face id when attempting to use the passkey
@tonyo.422625 күн бұрын
All your videos are very jittery !!!
@yt_n-c0de-r24 күн бұрын
As if video quality & fps is the main point here. Lol thx for the laugh 😅
@tonyo.422624 күн бұрын
@@yt_n-c0de-r It absolutely is. Hard to watch duh. Would you watch a movie that is jittery… absolutely not. SMH
@yt_n-c0de-r24 күн бұрын
@@tonyo.4226 In a movie quality of certain degree is key to the medium, a visual one. (Do I need to explain the words one by one?) Comparing this to a movie is like... I don't know, never heard such comparison that have vastly different goals XD Here, it's more like an essay. This could have been easily just a sound clip in a podcast. Visuals, aside from a few explanatory inforgraphs where framerate is so not relevant, just don't matter in these formats. But it still gives me a smile^^
@MISSY4EVR26 күн бұрын
I can’t plug youbekey into my phone .
@pascald.145126 күн бұрын
There are keys with nfc, meaning you can scan the key to login.
@WilfredvanderDeijl26 күн бұрын
Why not? Depending on your phone you should get a USB-C or lightning version of a yubikey. I happen to use both. And in some situations you might even be able to use the NFC version.
@AllThingsSecured26 күн бұрын
Most phones now have the USC-C standard, so you can plug it in. Or you can use the NFC capabilities to tap on the phone.
@RobbyPedrica11 күн бұрын
Yubikeys come in different flavours - usb-a, usb-c and nfc or a combination of those. Choose an nfc capable model if you want to use it against a phone, or use a usb-c version.
@MISSY4EVR11 күн бұрын
@@RobbyPedrica thank you I’ll check it out 🙂
@HASHTAG428 күн бұрын
lol you picked the worst implementation of passkey auth to make a generic statement about passkeys
@QuantumScribe23 күн бұрын
No, Passkey definitely don't suck - you either don't understand them or more likely, you're shilling physical security keys.
@AllThingsSecured22 күн бұрын
Thanks for the judgement. Did you at least watch the video to understand my complaints or are you simply commenting on a video because you do t like the title?
@YardKat66622 күн бұрын
They don’t have an incentive to make it easier. They want you to be less secure. It benefits them to make it less convenient.