#passkeys
Proton Pass now supports passkeys on all devices and plans: Beating Bitwarden to mobile devices
Passkeys are an easy and secure alternative to traditional passwords that can help prevent phishing attacks and make your online experience smoother and safer.
Unfortunately, Big Tech’s rollout of this technology prioritized using passkeys to lock people into their walled gardens over providing universal security for everyone (you have to use their platform, which often does not work across all platforms). And many password managers only support passkeys on specific platforms or provide them with paid plans, meaning you only get to reap passkeys’ security benefits if you can afford them.
They’ve reimagined passkeys, helping them reach their full potential as free, universal, and open-source tech. They have made online privacy and security accessible to everyone, regardless of what device you use or your ability to pay.
I’m still a paying customer of Bitwarden as Proton Pass was up to now still not doing everything, but this may make me re-evaluate using Proton Pass as I’m also a paying customer of Proton Pass. It certainly looks like Proton Pass is advancing at quite a pace, and Proton has already built up a good reputation for private e-mail and an excellent VPN client.
Proton is also the ONLY passkey provider that I’ve seen allowing you to store, share, and export passkeys just like you can with passwords!
See https://proton.me/blog/proton-pass-passkeys
#Blog, #opensource, #passkeys, #ProtonPass, #security, #technology
@Friendica Support @Michael Vogel Ich möchte gerne mal nachhören, ob es langfristig möglich wäre, dass die #Anmeldung bei #Friendica über #Passkeys unterstützt werden könnte?
Bitwarden begins adding passkey support to its password manager
Although Bitwarden now supports storing and logging in using passkeys from its browser extensions, it’s not currently possible to store passkeys in the company’s mobile app. According to Bitwarden’s FAQ, this feature is “planned for a future release.”
Finally, it arrived for me today on Bitwarden. Seems to work seamlessly enough, as the extension pops up automatically when you choose to add a passkey on a website. For sites with multiple logins, it prompts you to select which one to use.
The theory, for me at least, is that I can use these passkeys across all my OS’s and devices (when mobile support is finally added). In the meantime, for mobile, the normal ID and password still work as before.
See https://www.theverge.com/2023/11/2/23943173/bitwarden-passkey-support-released-browser-extension
#Blog, #bitwarden, #passkeys, #technology
Password manager Bitwarden will too soon be able to store passkeys, but here’s why you may want to wait a bit with passkeys
I did a post a few weeks back speculating around the same issues but listening now to Steve Gibson talking on the Tech News Weekly episode 284 podcast at https://twit.tv/shows/tech-news-weekly/episodes/284 has reinforced my thinking about passkeys.
Yes, Google, Apple, etc are trying to get their users to adopt THEIR passkey management systems as quickly as possible, as it essentially locks you into their authentication (and eco) system for now. Even these two companies are implementing passkeys slightly differently (single synced key vs per device), and unlike today where you can easily export your passwords from one password manager to another one (migration) it is not at all clear yet how this may happen with passkeys (if at all). I have over 700 passwords and there is little chance of me migrating those one by one to a different authentication system.
Just based on how Apple’s and Google’s approaches to passkeys differs, we can also see some differences in how we’d use them, so I’d like to make a more informed decision before I just jump in. As Steve says, passwords are still going to be here for quite a long time, so there is no rush to jump into using passkeys (as long as you use secure and unique passwords, along with good 2FA). While backup passwords still exist for passkey sites, they are still as secure as that weakest link.
So, yes, Bitwarden too will be rolling out their passkey implementation in 2023 (see https://www.ghacks.net/2023/05/24/password-manager-bitwarden-will-soon-be-able-to-store-passkeys/ without any firm date) and I’ll first have a good look at how they plan to implement it too. I do prefer something like Bitwarden (or similar) where it is a purely cross-platform implementation not tied to a particular vendor (apart from Bitwarden yes, but then you can also host their open-source solution yourself if you really wanted to). Personally, I would not use Apple’s system as I have twice switched away from using an iPhone, and I’m not getting locked into an ecosystem specific solution for that reason.
Bottom line though is there is no rush, and jumping in now with whoever you choose, is going to be your bed fellow for the foreseeable future, unless you only have 5 site passkeys to worry about. Passkeys are certainly an excellent step forward for online authentication, but it is about when and with whom I’m more concerned about.
#Blog, #bitwarden, #passkeys, #security, #technology
Passwort-Manager bereiten sich auf das Passkey-Verfahren vor
https://linuxnews.de/passwort-manager-bereiten-sich-auf-das-passkey-verfahren-vor/
#passkeys #passwordless
#ThisWeekinSecurity: #Oracle #Opera, #Passkeys, and #AirTag #RFC
There’s a problem with Opera. No, not that kind of opera. The Oracle kind. Oracle OPERA is a Property Management Solution (PMS) that is in use in a bunch of big-name hotels around the world. The PMS is the system that handles reservations and check-ins, talks to the phone system to put room extensions in the proper state, and generally runs the back-end of the property. It’s old code, and handles a bunch of tasks. And researchers at Assetnote found a serious vulnerability. CVE-2023-21932 is an arbitrary file upload issue, and rates at least a 7.2 CVSS.
https://hackaday.com/2023/05/05/this-week-in-security-oracle-opera-passkeys-and-airtag-rfc/
Google accounts now support passkeys to replace your password and 2FA: Expect teething problems though
Starting today, Google users can switch to passkeys and ditch their passwords and two-step verification codes entirely when signing in.
Passkeys are a safer, more convenient alternative to passwords being pushed by Google, Apple, Microsoft, and other tech companies aligned with the FIDO Alliance. They can replace traditional passwords and other sign-in systems like 2FA or SMS verification with a local PIN or a device’s own biometric authentication — such as a fingerprint or Face ID. This biometric data isn’t shared with Google (or any other third party), and passkeys only exist on your devices, which provides greater security and protection since there’s no password that could be stolen in a phishing attack.
I’m still holding off on this until my own password manager has a working solution (Bitwarden announced today their solution is being worked on). But for me numerous questions still remain, despite this undoubtedly being a more secure solution:
- What happens if your passkeys are on your primary device, and you lose that? Hopefully everyone has their passkeys backed up and are able to retrieve and actually use them.
- How do you log into the service to disable lost passkeys, if the passkey is your access to the service?
- Users get locked into a specific passkey service and then want to leave for another one, e.g. an iPhone user decides to move to Android.
- If passwords are the weakness, they should be completely removed from a service, otherwise they remain just as risky as if you were using them still. Passkeys will only be as secure as any fallback method, e.g. if a provider uses SMS for backup, then you are running the same risks having SMS as if you were using SMS 2FA.
- Security has always been a trade-off against convenience, so a lot of basic user education is going to be needed otherwise we run the risks of either having risky fallbacks, or many users will be locked out of their accounts. An account is either secure, or it is not. ‘Marketing messages’ don’t create the security.
See https://www.theverge.com/2023/5/3/23709318/google-accounts-passkey-support-password-2fa-fido-security-phishing
#Blog, #passkeys, #security, #technology
1Password, Dashlane, LastPass, and now also NordPass, already have support for Passkeys
NordPass explains that using Passkeys with its system is superior to using “alternative systems,” because it allows for syncing between cross-platform devices, offers better passkey-sharing options, and grants instant portability between operating systems. This means that if you use multiple devices in different ecosystems, such as a Windows Laptop and an iPhone, you can use your Passkeys more easily.
They are dead right about needing cross-platform support for passkeys (unless you know for sure you’ll never be moving off your existing OS, or even sometimes using a different one), but they won’t be the only ones supporting cross-platform.
You will have a challenge with cross-platform support though if it is a solution that only works on iOS or Windows for example. Passkeys are not like passwords, where you can just retype them into a different machine. So you certainly want to give a bit of thought before making your choice as to what to use as your passkeys manager.
If you are already on Bitwarden, for example, just wait a bit until they release their passkeys solution. There is no immediate urgency.
See https://www.reviewgeek.com/148532/another-password-manager-announces-support-for-passkeys/
#Blog, #NordPass, #passkeys, #security, #technology