PassageNick

This is a great question.

I think the biggest barrier to adoption is lack of end user demand for the service. That is followed by people not understanding/believing the incredible increase in user experience and security. It's almost like people think it is too good to be true.

It is not clear to me what they are implementing here. There is not mention of passkeys anywhere.

Not sure I follow....

Biometrics are very difficult to impossible to reproduce short of physical coercion.

Passwordless is actually MFA --

Something you have (your device) Something you are (your biometric)

Those are definitely two factors that are required to be together for passwordless to work

>> I hate having to rely on having my phone handy to log into anything.<<

This isn't the case. Nothing about passkeys says you need your phone to login on a website with your laptop, for instance.

The problem with legislation like this is that it eliminates the possibility of better solution.

What happens if someone invents a better interface than USB 3.0?

Or better, why would anyone bother when a better interface couldn't be used?

No -- every origin has it's own Public/Private key that is stored on the TPM chip on your device. The TPM is designed specifically for securing these keys.

Each passkey is a modest amount of data, and I don't see a person having so many passkeys that the TPM gets full.

That's a great article, thanks. In fact, it's a fantastic article. I read it a couple of weeks ago, and learned a lot. Thanks.

Apple's changes do degrade security, but I think it is important to note that even with those degradations, Apple passkeys are still many orders of magnitude more secure than passwords.

....and can you explain the cookie theft thing a bit more?

If you can take a photograph of someone's fingerprint and reproduce it, how, exactly, does one use that?

They cannot block access. The passkeys are actually stored on your devices in a Trusted Platform Module. When moved to the cloud, they are E2E encrypted, and the transferring platform has zero knowledge of your keys.

Currently, you cannot move them to other devices without the cooperation of some cloud service, or the like. At some point you'll have to trust someone to move passkeys between devices.

Passwordless is MFA -- something you are and something you have.

I'm not a yubikey expert, but I don't believe that losing your Yubikey will open up your company to a breach.

For a typical passwordless solution, losing your phone isn't a risk, given that no one can reproduce your face or thumbprint.

You own your own passkeys on your own device, ultimately. Google/Apple/MS have no ownership or knowledge of the actual keys.

Fair enough.

Re: Yubikey -- I confess I don't know. The folks in r/yubikey definitely will, though.

The "Big Three" are on the FIDO board, along with 1Password. They can't really do the extinguish thing, and it really isn't in their interst to do so.

An no, the small tweaks don't kick anyone out of the game.

There will be other, perhaps more trusted, companies that you can use to move your passkeys around between eco-systems.