Passkeys are HERE and they're SECURE! Learn this today...

[@JohnnyBean78]

7 months later and still going forward, passwords are still here and rule the day and not dead!

[@palliard]

And Lastpass, which already supports yubikeys. So your password manager requires the hardware key.

[@uraniumu242]

I bought a Thetis 2 pack. The NFC does not seem to work (I have NFC tags all over the place and they work fine) the number of application supported by Thetis is really slim, maybe I should have bought a Yubikey.

[@nokarukuta587]

So what's the backup? How do I restore access when I lose my device and my private key can't be restored from the cloud for some reason? If it's personal ID for example a thief could have it right there with your wallet.

[@yavivid]

Thanks for the articulate explanation. I just wonder how different it is from PKI.

[@tekenator]

Once a passkey is setup, is the option to sign in with a username and password no longer an option? How does recovery work if I loose my device?

[@travails3829]

Correction: the private key answer to the challenge is checked on the server, not the client. It would be no security at all if the device was just sending "whether or not the challenge was successful" to the server. :D

[@karicallegra8194]

Was coming to say the same thing... would def be pretty sus lmao

[@isovideo7497]

Presumably the servers would also have to use the public key to encrypt a unique timecode in the data sent, and then verify the same timecode in the response, in order to prevent client playback attacks.

[@robertburley6506]

Best content on passkeys I've seen so far. Thank you! Regarding the Best Buy example, you say that you don't have to worry about Best Buy getting hacked but how is that the case if they don't give you an option to completely remove your password?

[@chrismargolis]

I love the idea of passkeys and their simplicity, but the biometric nature concerns me. In the US, the government/police can’t force you to reveal a password. That is because it’s considered a 1st and 5th amendment protection. Biometric based logins are NOT protected in the same way. That is why password managers w/ security keys still seems like the best to prevent government intrusion.

[@WanderTrekker]

The "freest" country in the world 🤣🤣

[@graysonpeddie]

@@pinky6863 So what if I'm required to give them 256-character password from my password manager? :) Passwords won't come cheap! :)

[@WanderTrekker]

@@pinky6863 In germany both are protected under our "Grundgesetz"/ constitutional law, and also under the "Strafprozessordnung"/Code of Criminal Procedure. You don't have to give anything (information and things) to the government which *could* might incriminate yourself.

[@damiendye6623]

​@@pinky6863not sure your right as you are required to give prints and DNA samples if your arrested in the UK. And we have new laws effectively going to make it illegal to use these because of the lack of government back door

[@Alex-zv4oc]

Exactly, but also people near you that can use your finger or Face ID to get access. Somehow, brains are protected 😅 i would not use Face or Touch ID to confirm.

[@williamhughmurraycissp8405]

The biggest limitation of Passkeys is the small number of applications that offer the option and the users that adopt them. Hopefully those will grow with time and videos like this one.

[@CD-vb9fi]

To me the biggest limitation is losing control over my own Identity. PassKeys can be hacked just like LastPass, Comodo, Zero Ring, Golden Ticket, I mean... all this does is create a more valuable target... sure we might save the morons from being "hacked" but now even the geniuses will be forced into this ecosystem and they will now become less secure. Remember the old joke... if you are being chased by a bear... all you need to survive is be faster than the slowest person? It's the same concept. With "gimmicks" like this... it makes even the fast as slow as the slowest! Now... you have to rely on someone else's ability to to dictate your survival and you will not have any ability to understand this technology to fix it when it goes wrong... but the hackers will... they will know more about your own security than you ever will. You have a job to do and can't dedicate the attention necessary. But they have time... they have plenty of it since they get paid by their various governments to datamine your "identity" or just flat out NSL the data directly without any way for you to know or even challenge it. A day will come where an employee is fired because a government somewhere does something with their account and how is the poor sap going to be able to prove any of that? The entire ecosystem is completely outside of their ability to even "know" which means courts will throw out all of your challenges because you can't even prove harm... And just like that... the entire world is compromised. Especially as AI takes off. Nothing beats a personal password where your brain is the storage medium. These are only to fix the problems with the stupid and lazy.

[@ianl1052]

Agreed. So far, even Amazon doesn't accept it (yet). However, because Google does, you can use it for any account you can access via Google including PayPal...which is pointless because PayPal accepts passkey.

[@freemagicfun]

I like the idea of passkeys, but yes it seems like the acceptance by apps & sites is woefully slow. 😎

[@bkbroiler5946]

@@freemagicfun It's just so complex. not many people even understand this, so even if the sites offer it, I imagine almost no one uses it.

[@CyberMedics]

All of the major email platforms and operating systems are supporting them (Apple, Google, MS, outlook, gmail). But true that most others services do not support them or hardware security keys. The banking industry is woefully behind on the security front.

[@fs9553]

The elephant in the room you didn't mention. what if you lose you phone? sure the private keys aren't stored in there but how can I get my credentials back since Google/Apple uses pass keys which are linked with the old device which you lost.

[@EcoAku]

Exactly! Nowadays a phone is an awfully weak link in a security chain, because it is both indispensable, as you mentioned, and extremely vulnerable to assault: if nicked while unlocked, and/or if your aggressors force your face or your finger on the phone, in a matter of seconds they own your Google or Apple account holding your private passkeys, and as far as I know, there is nothing you can do about it.

[@jaxxarmstrong]

Yubikeys are great, but due to their inherit limitations of 2FA secret storage on their keys I'm waiting for them to upgrade that storage and release their 6th series before I buy a handful.

[@RogierYou]

And their recent price increase 😡

[@MegaLokopo]

I would highly recommend you don't buy security keys. If you enable googles highest level of security, and they detect a potential attempt to break into your account, google will immediately disable every way of logging into your account, and disable all of your security measures, including your password, then require you to reset your password via a link in your gmail, then only after reseting your password, will you be able to reset up your security keys. If google can't even trust a yubikey, a titan security key, 2fa via googles app, passkeys, and passwords, to verify who I am, you probably shouldn't trust them either.

[@machdaddy6451]

Does a hardware bound passkey have to be plugged into your phone to use it with your phone?

[@lykp]

Clear explanations and nice overall. But some things are a bit oversimplified and even wrong. Such an example is the note that password managers being susceptible to server hacks. To begin with, one could have local only password manager databases. Moreover, there services have setups where even with low quality master passwords, a server hack will offer no info to the attacker (feel free to check 1Password setup). Furthermore, having a secure master password would basically be enough to prevent any brute forcing, even if the whole hosting server is completely compromised.

[@bubi352]

Agreed. Also the "they need your PIN" - yeah cool... What I took from it is that the vector of compromising the secret holding service gets eliminated. So it's still no match for pw+(non sms)totp for corporate or self host scenarios. Big plus is that it is a convenient enough method to use for non tech people. About the amount of time to reset a password. Not a strong argument, this can be very streamlined.

[@DFPercush]

I think he's talking about grabbing your account from some random website and cracking it with a rainbow table, not necessarily hacking the password manager's servers. A note about PIN codes, most modern devices have a secure element chip that is hard wired to prevent repeated attempts at brute forcing, so even if you have a 4 digit pin, while that's not great, a thief/spy/hacker would only get to try a couple dozen times before the timeout became days long. That would, in theory, give you time to mitigate the damage by updating your account information in the relevant places, unlink/remote erase the device, etc. Not all devices are equal though, so take it with a grain of salt. Might be worth looking up your device and how it handles that.

[@CyberMedics]

@@DFPercush True. The iPhone has the self destruct mode (erase the phone) after 10 failed attempts.

[@macbitz]

I think passkeys are a great idea, and as (another) IT professional I understand the benefits. However, they are not without their issues. You have to consider adoption and compatibility, their adoption may not be universal across all platforms, applications, and devices, and some older systems or browsers might not support FIDO2/WebAuthN, limiting their widespread use. You also have the hardware dependency with the issues that brings (forgetting or losing your device, backup and recovery). Initial setup complexity - as has been pointed out in other comments, how do you get your non-IT literate friends onboard with this? Finally cost - not everyone can afford one (really).

[@Felix-ve9hs]

Also, have you seen how many dependencies FIDO2/WebAuthN has? It is so much work that most websites will probably never provide it, unless forced by their government...

[@williamhughmurraycissp8405]

Jones' Law: "Anything hit with a large enough hammer will break." All security mechanisms have limitations which should be considered when deciding whether or not to apply them in a particular environment. That said, Passkeys offer a balance of security and convenience that works for a broad range of applications and environments. As to "too much work," there are, or will be plug-n-play implementations for most environments. Compared to doing nothing, they are "work." Many, not to say most, managers of websites are reluctant to do any work until they get slammed. I never cease to be amazed at the number of managers who opt for cure over prevention. However, the environment is becoming increasingly hostile and password reuse is a favored method of attack. Perhaps, keeping one's resume up to date is the least work. However, being associated with the victim of an extortion attack may blot an otherwise spotless record.

[@HarmonicaMustang]

I'm a (yet another) IT professional. I work in education. Shared computers are a common device deployment method for cost savings, so hardware-tied private keys would not work in this environment. There's also the problem of personal devices. 2FA implementation is always a controversial topic as for one, smartphone use tends to be discouraged, and two, staff are always against using their personal devices for work purposes, and schools do not have the budgets for hardware tokens.

[@williamhughmurraycissp8405]

@@HarmonicaMustang Admittedly, Passkeys are neither as convenient or secure on multi-user systems. On the other hand, the majority of modern computer users have never used a shared computer, not even a PC. Most have only used a mobile computer, a single user system. Many of our security risks today are relicts of shared systems. As the cost and scale of computers continue to shrink, solutions like Passkeys will become increasingly convenient and secure.

[@jamespulver3890]

@@williamhughmurraycissp8405 This misses the knowledge that there are lots of situations both in work and at home where shared devices make lots and lots of sense. I'm thinking a shared public PC in a living area where random visitors might well need to check their e-mail, but don't carry a laptop (and find a full desktop a lot easier than their phone), a roku TV where a visitor would like to load their Netflix profile for one movie, etc. In the work environment I'm thinking all sorts of kiosks where you have manufacturing, scientific experiments, library style public access systems, projection control computers - anything needing walk up access that might require authentication as different users for cloud services, work processes, etc. And in work locations this is going to be even harder because you'll want to give access via many to many matrix for users - both if their laptop dies you want to hand a new one they can start using immediately, but also access to the corporate cloud e-mail, cloud storage, local services, plenty of shared systems you remote into for various reasons like terminal servers and more. And from a work location there's the reverse issue of many of these hardware things just not being available to all OSs - if you use Linux you can't (as far as I can tell) use a TPM to unlock FDE, and worse, the management is completely different between MacOS, Windows and Linux. Passwords have converged to it working the same across all platforms. Not to say passkeys won't potentially get there, but we have these special proprietary "secure enclaves" that often aren't as secure as we are told. So Apple doesn't use TPM from what I can tell, neither does Android. So we already have more Windows only, or Mac only, or Android only implementations.

[@TheNameOfJesus]

I have some concerns with some of your conclusions, but I'll mention just one. At 10:31 you said "Server leaks don't matter when it comes to Pass Keys." I would call that statement 99% wrong. It's 1% true because your "authentication credentials" remain secure. But any DATA that you upload to the server (name, email, address, phone, contacts, calendar, web links accessed, etc.) may potentially be completely stored "in the clear" on the remote website. Pass Keys are very good when it comes to "credential privacy," but has NOTHING, ABSOLUTELY NOTHING to do with data privacy. You actually said "server leaks don't matter" but that only applies to your credentials in the case of Pass Keys (which is 1% of security overall.) Your data can still be stolen, leaked or sold to communist China, FaceBook or Google. (I'll leave it ambiguous whether the word "communist" applies to only the first of those three.) The only company that I'm aware of that uses YOUR private key to store (some) user data on their servers is Apple. So not even Apple can recover (some) of your data if you lose your private key. But any of your data stored by Google on their own servers is very likely stored using an independent encryption system that has nothing to do with Pass Keys. I'm guessing that you will acknowledge that all you were talking about was credential security, but you really need to look at the big picture. Data security is far more than just password security. Saying "server leaks don't matter!" is misleading at best, wrong at worst.

[@FalconEagleEye]

Thanks - GREAT info - great explanation FIGHT FIGHT FIGHT FOR AMERICAN FREEDOM !!!!!!!! 🇺🇸🇺🇸

[@travishatch6246]

What is the difference between passkey and ssh keys at the cryptographic level? It sounds like passkeys are very similar if not the exact same technology rebadged and made consumer friendly. A synced passkey feels like moving an ssh private key to a password managers vault.

[@mardymarvin8441]

these sound good but did not explain what happens if you loose the device so you have a ubikey you loose it how do you then get into your accounts. At least with a password manager I only need to login to the password manager on any device. With the hardware ones if it breaks or you loose it how do you get back into your accounts

[@theockle]

Ok, so the Government, who have my fingerprints, simply need to obtain my device and then they will have access to all of my accounts? If so, no thanks. Password and 2FA to get into my password manager, followed by unique passwords and another 2FA to get into any of my accounts sounds more secure to me due to more compartmentalisation, even without the two-way authentication. What am I missing?

[@ArtVanAuggie]

Too bad you are so Apple/Google oriented. Windows/Microsoft users just look elsewhere. You are also associating your sponsor with Apple.

[@id104335409]

Ahaaa, What happens when your device gets stolen, destroyed, corrupted? What happens when you need to recover your passkey? Can you do that just like you can remember your password?

[@SteelWolf13]

To me this just sounds like PGP. Secret and public keys. You then access your secret key with some form of ID. QR code, Face ID, Master password?

[@jamesrosemary2932]

If biometrics is required it is not government proof. This is because your consent is not required to have your photo taken or your fingerprints extracted. Lifelong passwords reside in your memory/mind and no one can get into it unless you voluntarily want them to.

[@jagdtigger]

*yawn* They can force me to put any bodypart on/in front of any sensor. But since i have a right to remian silent they dont have any options to get my passwords. And those who think they have nothing to hide pls read 1984.....

[@TJWood]

15:27 What happens for example you no longer want someone you have shared your passkey with (say a divorce) and you no longer want them to be able to use your credentials?

[@jgleigh]

You should be able to create a new passkey and the old passkey will no longer work.

[@mo3k]

Not sure about Passkey being more secure than Password + 2FA: IF [Passkey] : Access to Device + PIN == access to any website IF [Password + 2FA] : Access to Device + PIN != access to any website, as password is still needed. Although I do understand that passkeys protect against certain attacks better, like Phishing; it's hard to say one is flat out better or worse than the other.

[@petergplus6667]

Too bad that 90% of the shitty windows laptops don't feature IR cams or fingerprint scanners....

[@laurak96]

How do you keep your hardware passkeys secure? Where do you store them to keep them safe? Or do you carry them with you at all times like on your keychain with your house and car keys?

[@chublez]

How do you keep your car and house keys secure? Where do you store them to keep them safe? Or do you carry them with you at all times like on your keychain with your hardware passkeys? Seems like a personal decision based on threat assessment is my point.

[@jackt6112]

Yubikeys are going nowhere. They exist to control concurrent usage of software programs and mostly replaced by storing the keys on an in-house server. They fail often from use and going through the washer and dryer. The software vendor overnights you a new one and deletes the old so even if it is found or starts working it won't work. The only reason this 2009 passkey technology has become usable is because the cell phone has become almost ubiquitous and is the only device that has the intelligence for now and the future. Even your car and house keys are going away. It's already your wallet, passport, visa, credit card, immigration form holder when you travel, map, calendar, secure and insecure communicator, airline tickets, where the gate is for your next flight, flight schedules, your seat, adjust your house environment when you are home and when you are not, guides you around the traffic tie-ups to and from work, lets you scan into the gym, your note taker, language translator, it will soon be carry your ID/driver's license, gets backed up encrypted to the cloud, and is becoming the only thing you need to take with you.

[@discerningacumen]

What if you lose the passkey. Or stolen or broken? It looks meaningless but a marketing hype

[@cob00927]

So let me get this straight...Even sites that offer passkey integration require a password, so if you have to have a password to do first time set up, even if YOU use the passkey, hackers will still have a password to try to get access to by hacking the business? Are you saying that until businesses allow us to delete the passwords, they are no better than having JUST a password?

[@MegaLokopo]

Google doesn't even trust the passkeys. They detected a potential attempt to break into my account, and completely disabled every security measure I have to verify my identity, logged me out of my email on all of my devices except my phone, refused to let me login even though I had every single method of verifying my identity, and required I change my password, through a link in my email, then after I reset my password, which didn't require any form of authentication beyond being logged in, I was able to reset up my many authentication methods. What is even the point of any of it if google won't even trust a single method of authentication, and won't even trust you to verify your identity if you have all of them at once. And then doesn't even bother to verify my identity, while it bypassas all of that authentication I have, and lets me reset my password, without verifying who I am.

[@norgeek]

They're technically more vulnerable than a website with just a password, as it's an additional attack vector..

[@seetentees]

I think this is an example of not yet perfect, but way better. Part of the benefit of passkeys (even as an alternative to still-active password auth) is that it makes certain attacks way harder to pull off. For example, if someone pointed you to a simple mis-spelling of a website, your browser will not reveal any details about your account to the imposter. It'll just tell you that no passkeys are available for the service without revealing anything. This should clue you in that this your being attacked. This benefit alone can help improve your security posture. Granted, ur right that it would be cool if more sites allowed those who are comfy to just go 100% passkey, eliminating the possibility of a compromise of those passwords on the server side altogether.

[@mdamaged]

Better off going with the Thetis, since it's recommended to buy at least 2 (one for backup) the yubi will set you back at least 100 bucks, I've found the Thetis is just as good and half the price.

[@narkeddiver7325]

How secure are iCloud passkeys? Can they be overridden if someone has your iPhone and it’s passcode? If so then your passkeys are only as secure as your 6 digit passcode

[@alexthemtaandr211weatherfa2]

Apple support security and recovery key, eight character passcode

[@TheSecurityAgency]

Cons 1. Hardware passkey can be stolen, 2. lost, 3. malicious borrowed (the worst type of attack besides 4. can be cloned. (not all of them) 5. Price always x2, you need a backup key. To remove all four cons, a hardware key has to have a biometric sensor. As of now, there is no hardware passkey with a fingerprint sensor usable on Linux systems out of the box because you need proper drivers. Also it can't be used cross platforms on your customer's PC/Mac without drivers installation.

[@MegaLokopo]

Biometric fingerprint scanners can easily be beaten.

[@TheSecurityAgency]

@@MegaLokopo Yes it is, especially while gobble down a popcorn watching Mission Impossible.

[@abghere]

What happens if you lost your YubiKey?

[@samb4486]

Great video Chris. I note that Microsoft have announced that Windows 11 is getting a built-in passkey manager. Any comments or thoughts on that?

[@techserviceondemand9409]

not quite, i have an Yubikey for years, finally gave it up as i can never remember where i put it. As one other KZbinr pointed out (correctly, IMO), the different types of connectors on different devices also make them a real pain (i have usb micro, usb c, apple ...).

[@markbroussard7394]

What do you do if you lose or damage your hardware key? How do you authenticate to setup a new one?

[@kuhluhOG]

12:38 Yeah, about that. You can't force them to use their personal devices. So instead you give them a different device. And they WILL forget it at home (or loose it). I am speaking of experience here...

[@williamhughmurraycissp8405]

Sorry, there is no remedy for stupid. "The dummies have it, hands down, now and forever."

[@kuhluhOG]

@@williamhughmurraycissp8405 sure, but a password is easy to reset with these people, unlike a hardware key besides I wouldn't even call them stupid, it's just that given enough people, you will always have at least one person per day and it's always going to be somebody else

[@dennisvanmierlo]

Companies need to give better and fully detailed instructions on how to setup passkeys on their website. Take Microsoft for example. They point me to advanced security options and then I have to figure it out all by myself. The same goes for PayPal. If they don't make this easier for their users, than passkeys will take forever to be adopted. And that's a big missed opportunity.

[@ldwhitley]

I'd suggest a Apple user approach, and a Google user approach. I think you have the Apple approach covered in this video. The Google approach might be a future video. Sharing among the Password managers in the various approaches too - OnePassword to Apple to Google might serve as an example. Also, I'd suggest a discussion of where the resistance to this approach may come from. Thanks for the valuable video. It raises the question of Passkeys and where they may fit in our security vision.

[@jx5189]

Passwords are always going to be required for passkeys If not could you imagine the headache administrators will have when something happens to the users device that was storing those passkeys for said account.

[@my3.1415]

What good are passkeys if I, or someone else (I'm looking at you mr hacker) can still logon to my Adobe account using a password because I can't see an option to remove the password?

[@gotoastal]

Could you call them hardware token/keys instead of generically using Yubikey. We should be supporting open source hardware options.

[@julianmontague4342]

I agree that we should support free (libre) hardware, but Yubico sponsored this video. That’s why he mentions Yubikeys.

[@chrismuller2780]

If someone steals a companys DB of public keys, and create a fake site, could they could trick you into signing in with your passkey?

[@Alex-zv4oc]

It’s basically the same asymmetric PKI stuff is used for TLS encryption. The private key is stored on the webserver or client and Yubikey hardware stores the private key like a HSM used by servers like webservers or reverse proxy servers such as F5 right?

[@miss_sapphire]

Also think of like ssh keys

[@bcam8995]

great video but you should mention the cons of passkeys. Each method has its own strengths and weaknesses.

[@CrosstalkSolutions]

So like the part where I talked about the cons of passkeys you mean?

[@MrSoulMonk]

A comprehensive and simple explanation of the various methodologies. Thank you! I love your channel. You present relevant topics with detailed information.

[@RaymondDay]

SQRL Secure, Quick, Reliable Login and don't store them on the server but the server has to have SQRL too. It's been out for years and I guess the best but hard to get servers to use it.

[@martian-sunset]

No option to remove account passwords after a passkey login has been set up renders passkeys useless.

[@seetentees]

Although some types of attack remain possible as long as your account allows password login, the point of passkeys is to give you the option of choosing when to use a password. Whether it's *never* is up to you. If you choose to still login with a password, this is what makes your enrollment of passkeys useless :) When you do login with ur passkey, instead of typing your password into a website and submitting it, your browser (after verifying that the website is...the website) will simply ask you which passkey to use, then prove that you have the passkey in a way that cannot easily be man-in-the-middle'ed unless your device is compromised. The idea is your browser will never attempt to log into an imposter website, and if one of your devices is compromised, depending on how, you may be able to un-enroll it from the service from an uncompromised device. This makes it significantly harder for someone to convince you to log into a website that proxies any part of your login attempt, and also allows you to reduce the blast radius of a device compromise to maybe that device (depending on the compromise). Stepping back, the whole idea is to give you a more secure way to login. Eventually, it'll also allow websites to just stop storing (even salted/hashed) passwords altogether. But baby steps.

[@GeeWit]

I was pretty up to speed on this but what a great review and in my case, confirmation that I'm arranging our digital security in the best way for us. Thank YOU!

[@randalljames1]

Pass keys were the standard some 20 years ago (dual authentication) ... worked security for a military contractor and passkey fobs were SOP.... they are cheap and easy to implement... Can use almost any cell phone today for the same job.. I now work IT security for the medical industry and ANY Dr that writes sched 2 drug scripts is required to use passkey authentication.. (is law) since the Jan 2023

[@bugsy123]

Great description helping to show the overlap and underlap between Passkeys and hardware keys.

[@SteelWolf13]

Face ID is a joke. I've bypassed it with a printed picture.

[@CrosstalkSolutions]

Insert [doubt] meme here...

[@CraftComputing]

Beer in a tech video? How original.... :-P

[@CrosstalkSolutions]

Hah! To be fair...that was 3 years ago.

[@rakeau]

I really, really don’t want to be required to use Apple or Google devices along with their proprietary clouds for my authentication.

[@CrosstalkSolutions]

You’re not even required to have a cell phone at all.

[@rakeau]

@@CrosstalkSolutions I'm just a bit nervous about large companies driving this. Making things "easy" comes at a cost. Apple is especially bad at forcing users to do things "their way".

[@justinparrtech]

Cryptographic authentication is far superior to passwords. However, protecting cryptographic keys with a biometric key is absolutely terrible. Biometrics should never be used for security, ever. Biometrics can be forged or stolen. If you become injured, you need a way to change your biometric key, which means that the entire scheme needs a back door such as a PIN, and PINs are weak and are much easier to attack than passwords. Worse, if you secure your device or passwords with biometrics, law enforcement is allowed (with a warrant, of course) to force you to unlock your device using your own biometrics, but a password can never be coerced. And if law enforcement can do it, so can the bad guys. NEVER EVER EVER USE BIOMETRICS.

[@GerryVeerman]

Agree. This video explains the matter thoroughly and clearly. Helped me a bit further on grasping the passkey tech. Important to highlight though; - The ‘passkey technique’ is what it’s all about. Which hardware you use to make it happen is secondary. (you don’t need ‘security keys’ per see to be able to use the passkey authentication.) - For now it depends on the OS / browser version used, if it can handle passkeys QR codes. Hopefully third parties apps for devices will soon pick up the art of handling, syncing and storing of passkeys. - As an example of how the latter can bite you in the tail, is the nasty surprise for the Apple ecosystem; As for example using security keys, it needs all your devices to be running the latest OS. It’s all or nothing. If you implement security keys, any device not able to run the required OS is at loss. (booted out of the eco system)

[@mikedoth]

I love passkeys, but would love a way to integrate browsers with Keepass and utilize passkeys for those of us who do not like hardware keys and want to keep them centralized with our existing cred storage.

[@idaho_7407]

Always trust the CIA to be working in your best interest.

[@MoveInSilence2444]

Lol😂😂😂😂

[@MarcioHuser]

SMS is SUPER INSECURE. Bad actors inside cell companies can migrate your number to a different SIM card and use it to to Auth as if it was you into your bank accounts, for example, making a "forgot password" attempt through sms. I ditched SMS as second factor from everything I could, after I got that happened to me, some years ago (I also minimized how much money I kept on that same bank intuition also, given how it handles access recovery 😒)

[@mauriciolee7349]

Thank Crosstalk Solutions for this DETAILED & INFORMATIVE video. As of today, July 27th, 2024, out of 10 passkey videos I've watched yours is the BEST. It's because your clear & easy-to-understand explanation of how passkey works, how it helps me in case of phishing and website IT breaches.

[@MotorsportsX]

the problem is that no one points out the single massive and major flaw with hardware keys. when someone takes it from you, youre screwed.

[@seetentees]

Enroll multiple passkeys. When you no longer think you have one of them, unenroll it. Until you do, it must have had a layer of security on it before it could generate the passkey (a strong pin or a pin and a biometric lock) that whoever stole it needs to crack. TLDR: You can lose it but you can also prevent that particular key from ever being used to log you into stuff without affecting anything else that isn't lost/stolen from logging you in.

[@dukeofclemance]

double dutch@@seetentees

[@GeorgeCudd]

If you use your cell phone pin in a public area and it gets compromised you can have real problems. The WSJ had a great article about this earlier this year where someone used their pin at a bar to make a confirmation, it was compromised (observed) and their phone was immediately stolen as they were getting an Uber outside the bar. The thief used the pin immediately to reset and change all of the passwords, being synced in the password manager. The thief did this so quickly the phone couldn't be shut down. The thief had access to all the accounts on the phone and proceeded to rob the owner of several thousand dollars. Bottom line is that tying everything to your phone has some level of risk. Better use a more complex pin and be careful when you use it as it provides the keys to your kingdom!

[@CrosstalkSolutions]

You're right - there is always a risk of someone shoulder surfing your PIN and then stealing your phone. But that's not the point here - the point is that your example is extremely rare compared to the amount of phishing and hacking attempts that hit people from far far away. If we eliminated ALL but your specific concern, it would be a HUGE win for security world-wide. And a singular edge case of "well...it can still be compromised in this very specific way..." is not an excuse for rejecting this technology.

[@GeorgeCudd]

@@CrosstalkSolutions I agree with you but just thought it's important to understand all the risks before entertaining any new endeavor

[@n2hobbes]

**fast clapping** Thank you! Thank you! This is the best, most complete and concise explanation of Passkeys I have heard yet! This video is going to help me so much in explaining the technology more to my team at work and family/friends.

[@JohnnyVang-d3y]

My excact question is, what you also mentioned in the video with the bestbuy example. If you have to create a user first, using a password, and then only after that can enable passkey login. Then the password login still exists somewhere in bestbuys systems, and be found in a server hack/leak? What would be the correct way to do this(besides being able to actually use passkey when creating the account) - When enabling passkey it somehow should delete any knowledge of a password ever existing?

[@giacospace]

Exactly my same question. My take is that passkeys (plus other authentication factor) should become the primary login method and username + password the fallback option. Probably in the future we won't even set up a new account like we do today (username + password).

[@PeterRowe-k1o]

Excellent presentation that covers the various protection levels and their vulnerabilities. Many other presenters glide by the multi-device sharing of passkeys as no issue, but hackers will find a way. I agree that the hardware key is best; your private key never leaves the device and it is difficult to hack while not too expensive to have backups, unlike a ‘phone or laptop/desktop. Nice job!

[@christopherguy1217]

Great introduction, now could we see examples of doing this with the Yubico please.

[@paulclement1025]

Did you check his site? I seem to remember he's demonstrated how to use Yubikeys before.

[@gotoastal]

We should support open source alternatives, not Yubico

[@tjbrison]

There just happens to be a MASSIVE issue with passkeys/2FA....the likes of Google and Apple can use this system for capturing end user data - that has nothing to do with authentication. E.G. can you autenticate with Google without any google app on your phone? (Which is then capable of revealing things like EMEI details etc to Google). There is a HUGE issue with tracking personal details when you use 2FA with any big tech company. E.g. if I buy a Yubikey, can I use that device to authenticate to Google without any Google software installed on my device? If NOT, then why? What is it the Google wants ? Maybe, your identity tied to a specific device perhaps? Basically, what I am saying, is that ease of use comes at a huge price - your privacy.

[@dgmelvin]

I started to go down this path, but I use a mixed bag of environments. I use both Apple, Google, and Android. I think that if you live and work in a single environment (all Apple all the time) this might be fairly easy to use and understand. But, I have given up in my environment. So, once this technology is finished and super easy to use in the same way on all platforms, I will take a further look. It appears to be more or less in its infancy and not ready for prime time.

[@Jim-j2c]

I admire your enthusiasm and knowledge. Because I'm a beginner with all this computer technology I found the layers of information you were presenting to be overwhelming. For me getting to the simpler points . Just describing the two keys what they are and how you use them. Then going into all the other detail would have been better for my way of learning. And as I say I'm a beginner so perhaps many of your other viewers don't have that same difficulty

[@vulcan1827]

Putting SMS and TOTP into the same category is I.T. blesphamy. SMS is hackable (many cases recorded) and doesn't require your interaction. . TOTP is not hackable, especially hardware TOTP. You would just need to be careful with the device that stores your TOTPs in the authenticator app as in: don't click on links, open attachments or browse social media sites. If your device is infected with the right malware they could then accesss your TOTP keys. Or call you and trick you into giving it to them, which I'm sure could work the same with passkey if you allow them to connect to your PC. Nothing is 100% secure- it always comes down to the issue between chair and keyboard. Passkey however sounds promising.

[@hughluttrell6350]

I have many computers,run up to six drives in some .From Win 3.1 to win 11,around eight different Linux distros how would passkey`s work on all of these.A passkey for every drive and a new one when i rewrite a drive?

[@ronaldhofman1726]

i never have probleme with bitwarden and authenticator , passkeys need to be inserted in USB slot it a hassle

[@SethWhaley]

You are thinking of Yubikeys or hardware authentication tokens. Passkeys don't require USB or hardware token.

[@MikeJones__Who]

Isn't the bound hardway key technically shareable if you just physically give someone the key to use? The only key that isn't shareable in that instance is if it was one of those biometric Yubikeys

[@dimon22323]

> and services that you use authenticated with existing PIN codes, FaceID, or TouchID I say this is the gap that doesn't allow to put the complete checkmark on "device theft" protection. How different is this risk mitigation from password manager's master password (what can as well be same fingerprint scanner, pin code, or password)? Stolen device still gives the database to end malicious actor, even if its encrypted or hosted outside of the device.

[@smartassist9700]

PLEASE HELP…. , Due to disability, surgery, etc, I have not been able to use my raspberry pi4 in a long time. Do you have video on external usb storage attached to store files? Where in Raspbian do I go to see/select my new 8tb drive? I need to drag /copy many photos and videos to new Drive. How do I verify if it was formatted? What format is for that size (8tb)? God bless! Alton

[@BartAssink]

Watched this vid and I really like the fact that your explaining the functionality not to much the technical. Any idea how to scan a QR code on my smartphone if I want to add azure for instance? Otherwise I need another phone to scan my phone to add a passkey.😂

[@allwheeldrive]

Passkeys do NOT fix the very real problem of the legitimate user not the one holding the device. They can be easily lost, borrowed, broken, and stolen. And any device of consumer caliber using fingerprint is NOT secure enough for high-risk/high-value privilege access (financial accounts, restricted rooms/ buildings, etc.). This is a fundamental problem (FIDO-related) that cannot be solved by anything but advanced biometrics that check for human liveness and exceptional image matching levels. And they are already out there and work. Together, security is very high.

[@pe0sat]

Great tech, bad implementation ..... More big tech dependency, syncing passkeys between multiple devices and no clear and good explanation on backup/recovery solutions ....

[@laughingvampire7555]

I have love-hate relationship with marketing, I prefer the descriptive names because a marketing word like "passkey" is so vague, but normies will have a brain malfunction. We need to improve the education system so normies are more sophisticated in multiple aspects of life like the free market and technology.

[@TheConservativeTalkingPoint]

I have a question. I want to go passwordless on outlook 365, personal account. How can I do this without the MS authenticator app? I just want to use my key ONLY to login, otherwise what's the point of the security? How do you accomplish this?

[@ocavant]

SMS based are extremely vulnerable to SIM swapping! Avoid if possible. Sadly many banks refuse to upgrade.

[@ArtplusHrApps]

Yeah, and all that for $50-150! How cool is that! I mean passwords are sh*tty and free... yuck! Ahhh... YubiKey sponsored content... okay! :)

[@stumpypostie6457]

Great But… Apple user, unless I buy the latest Apple products, current latest iOS iOS 16 +I cannot use this. Most all my devices is iOS 15, so I cannot use this. As I said no good for older user’s. If I’ve got this wrong will except that, but information in the past dictates this.

[@KentBunn]

Under no circumstances should you be endorsing email/sms 2FA solutions. That is a VERY bad take, at this point.

[@cloudcultdev]

This is a great video, but couple of suggestions: I understand this tech really well (I’ve been an app security architect for roughly 15+ years, and went into platform architecture), but I tried to consider how my parents (in their 60/70’s) would take it. There’s still some assumptions made, like salted passwords, how key exchanges work, etc. So it’s kind of a decent primer for someone who already knows tech, and how FIDO/TOTP already work. I can’t say I could do any better though, because these can be difficult subjects to explain…but I think it’s something to consider, because it’s these groups (like my parents) who are the most vulnerable. Overall, this is a great video. It calls attn to a huge problem (and timely because I am forcing my parents to use a password manager this week). Thank you for creating the video!

[@wlarsen70]

Agreed. It was a bit confusing and I came out of the video still not certain about what it is and what it does. Simplicity is the passkey for many of us.

[@jamestemple8970]

I watched this video and al it did was convince me to not use passkeys until I have to. What happens if you lose you smart phone or don't even have one?

[@seetentees]

@@jamestemple8970 it's not a great answer, but the idea is that any passkeys on your smartphone are synced with the mobile ecosystem owners cloud password sync provider. So if you happen to have multiple e.g. Google or Apple devices already enrolled with Google or Apple's cloud password syncing service, they'll all magically have all of the passkeys either device has every created. If one device breaks, you can use another device to enroll a new device into ur ecosystem account, and it'll magically get all the passkeys synced up. This has obvious implications which are kinda concerning (mobile ecosystem vendor lock-in), but it is what it is. If a passkey is only on one of the devices from an ecosystem (e.g. if you made an account somewhere, provisioned a passkey on your solitary Android phone, and never enrolled a passkey elsewhere for that site) if you lose that device, you have two options: Option 1: Start the recovery process for the mobile ecosystem account tied to the device: So continuing the example, if you lost your solitary Android phone, buy a new Android phone, and use the recovery options for your Google account to sign back into into it. Then it'll magically have all the passkeys previously provisioned. Option 2: Buy a new other device (iPhone or Windows device with Microsoft Hello, or any device plus compatible hardware security keys), then go down your list of actual passkey protected accounts and invoke each one's recovery process to enroll new passkeys. At least for now, it's a great idea to enroll your convenient to use (but breakable/stealable) mobile device *and also* additional hardware security keys that you can lock up somewhere. Passkey auth requires some different factor (mobile device pin or biometric lock, or hardware key PIN) so the idea is that even if someone stole your backup, they won't be able to log into anything. BUT if they destroyed all ur backups and your main device, you're in trouble. The same trouble you'd be in if you lost your password pre-Passkeys. The crap thing is that you cannot simply remember ur passkey, and you can't practically write it down. Practically, each passkey's private key will be hidden (even in some cases totally inaccessible) on a physical device, so you just need to make backups in the form of ... enrolled devices upfront.

[@CyberMedics]

@@jamestemple8970 One thing he highlighted is that password managers now allowing management of passkeys. I think a password manager secured with a hardware key is more secure for managing you passkeys, vice a device or Apple keyring.

[@HorseTVGlobal]

I could not agree more, clear as mud. You expect the millennials to have even considered that scenario?@@jamestemple8970

[@johnsantos2360]

WHAT DO I DO NOW IF I LOOSE MY PHONE Which is pretending to be my yubikey??

[@crazysquirrel9425]

Dang you mean I cannot use password as my password anymore? About passkeys and such - can the government access your stuff? Can they take your passkey and use it to prosecute you? Suppose I do not want to store things like that? What if a thief steals that device? How about authentication using 2 factor AND your IP address? How about this: don't store personal and financial information on your device or even the internet? Remember, if you use a cell phone or windows, you are screwed. Too many backdoors in both.

[@64nghia]

Passkey is a totally useless thing. 1) When the phone is lost or broken, you still have to log in with a password to access the account, so how can you say Passkey will replace password and you don't need to remember the password. 2) When a bad guy gets your phone, they can't unlock it with fingerprint or face recognition, but they can unlock it with a PIN number. A PIN number is usually 4 or 6 digits. This is easier to figure out than a password, so how can it be called more secure than a password. 3) In the case where the bad guy doesn't have your phone, they will pretend that the phone is lost or broken to be able to enter the password. So what is passkey called more secure. 4) The password is in my head. In the event of being threatened, I may not provide the password even if I am killed. The passkey is on the outside. If threatened, the bad guy will use my finger or face to unlock the phone easily. So how can Passkey be called more secure.

[@CS_STNDONTRTH]

How is this better? Anything shared is vulnerable. I believe you are confident because have been with your similar passkey authentication and not used by many, anything that is not across a broad range of servers, network and apps may be more secure. You loss me with all the other monopolize privacy thives that won't change. but once its available that's when time will tell. I really hope this will be that much needed password protection.

[@chemicle]

Yes, took me a while to get onto the passkeys, but now I have two (one as a backup offsite) and I have never felt more secure. Everyone should have these. But they should be more afforable as Yubi's are a bit expensive (in Canada anyway). I know, I know, you can't really put a price (tongue in cheek) on security, but ya - WELL WORTH IT.

[@FunkyELF]

"The only thing Best buy knows about is my public key"... Uhm are you sure about that?... They don't know your address? They don't know your order history? They don't know your phone number? This was a false statement. You're promoting this like it's a silver bullet and it is not

[@johnsantos2360]

The announcement of the death of passwords appear over-exaggerated. Passkeys are too dependent on electronic devices to authenticate kzbin.info/www/bejne/mqCUi6GBd7SGhpo

[@robertcoleman7071]

Thank you for answering the question about deleting the existing login/password after setting up passkey

[@OXXOColette]

Most likely the biometrics will be saved, just like our data is being saved and sold. To put "trust" on Google, Apple, Amazon. Microsoft, etc would be an oxymoron

[@Bennyblanco-xx6ki]

Hey what happens when u accidentally erase the Fido2 on my yubikey?? What do I do? And I’m not a techie!!

[@mb_a5383]

I like the idea but I'm concerned that I would be 'putting all of my eggs in one basket', so to speak. Since the physical key is so important why am I not seeing manufactures saling these in pairs, or triplets? They obviously understand that the consumer could lose their one and only key and be locked out of their own device. When you buy a lock, it usually comes with at least 2 keys, how is this different? Please pardon the ramblings of an old man, I'm just trying to understand.

[@paulwoodward3453]

I don't know your target market, but if you want to market this to the average retail consumer, you need to dumb down you explanation. Way to technical for consumers to understand. KISS! Maybe Passkey is not ready for the consumer market.

[@moondoggspicoli1583]

I tried to keep up with you but glazed over quickly. I do get that I should consider using a Passkey, but what if I lose it? You probably covered that while I was sleeping ;-)