152
Bitwarden passkey support starts rolling out through the browser extension
(www.androidpolice.com)
this post was submitted on 04 Nov 2023
152 points (96.9% liked)
Open Source
31250 readers
252 users here now
All about open source! Feel free to ask questions, and share news, and interesting stuff!
Useful Links
- Open Source Initiative
- Free Software Foundation
- Electronic Frontier Foundation
- Software Freedom Conservancy
- It's FOSS
- Android FOSS Apps Megathread
Rules
- Posts must be relevant to the open source ideology
- No NSFW content
- No hate speech, bigotry, etc
Related Communities
Community icon from opensource.org, but we are not affiliated with them.
founded 5 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
Oh, nice! Doesn't look like it's hit the Firefox Addons repo yet, but I'll be looking forward to it when it does.
uh. for the slower ones.... how does this improve security? ๐ค
edit. thanks @[email protected], @azron, @[email protected] i still dont really get it, but feel confident to trust you guys on this one.
My understanding is:
Passkeys are like a password + 2FA mashed together. If someone steals your "passkey password" they still can't use it to login without the hardware component. That means phishing is harder. Since passkeys are generated for the user from their hardware it also forces better hygiene on the user by not allowig any password duplication.
A downside is it is tied to hardware and a provider that can cause problems witb loss of device or when you change devices but it is hard to say how painful that is going to be.
[edited for a bit more clarity]
but butwarden already makes phishing impossible, and even if someone gets the password, they don't have the 2fa?
It's more about supporting a new standard. Plenty of folks are using same credentials everywhere, and passkeys could potentionally change that. Also, entering 1 thing is easier than entering 2.
Continuing on what Rolling Resistance said (sorry for the delay, had to step away for a while), I know plenty of people who do use a password manager and still use a static password in some places (hell, I've been guilty of that in a few places - but generally on network-isolated systems). Some people also don't use 2FA because they find it inconvenient.
Passkeys are more or less very similar to how SSH keys work if you're familiar with those, your device (or password manager) generates a secret key that it only has access to, and then gives the public key to the website (and a new keypair is generated for every single website). When you login to a website, the website sends you a challenge which you sign with your private key, that the website can then verify using the public key that you used when enrolling the passkey. This way, a website never has any form of secret - making say password hash leaks less relevant, whereas in theory you could give your public key(s) and post it on Google's homepage without any repercussions... but don't quote me on that one.
So even if you use a password manager, if you still have a few websites that share the same password, and one of those gets compromised - those other websites may still be vulnerable which wouldn't be possible with a passkey.
If you use a password manager like bit warden, on a compromised machine, the credentials used to log into a site, could get copied. Then somebody else could log into that site as you.
Using pass keys, or hardware security keys means the private information never goes over the internet. So somebody who's compromised the system, still doesn't get the private key. So they can't impersonate you later
Passkeys are client-driven.
When you visit a website you'd like to login to, your browser generates a public/private key pair and gives the public key to the site.
When you want to login:
Now both website and browser are sure the other is legit, there are no passwords involved, the login process is standardized and can be upgraded with new protocols and cyphers whenever needed, you can't be phished, you can't be tricked by a fake domain that looks in Unicode like the correct one, and if anybody breaks in and steals the public key they can't do anything with it.
This is the best primer that I've found: https://www.eff.org/deeplinks/2023/10/what-passkey
The main advantage is that, like hardware security keys, they're immune to Man in the Middle phishing attacks, but are far simpler to use so should hopefully see much more widespread use.
but it one would use a security key for the butwarden login, all of thst is pointless, no?
That is different kind of protection. ๐
The phishing protection is still very valuable. Also presumably you'd protect your Bitwarden account better than any number of random sites.