Why passkeys are a step back for personal security: examining account lockout risks, platform lock-in, hardware key limits, and fragile recovery flows.
In the scheme I’m proposing, the password never gets sent to the server.
The issue of password reuse is the password getting sent to the site, because the prevailing approach is to hash the password server-side. Passwords leak because they get stored in plaintext, or hashed using outdated algorithms, or get logged with request metadata–bottom line, they end up stored somewhere that an attacker can get their grubby little paws on them, or in a way they can reasonably recover them.
Using a master password to derive a passkey client-side isn’t any different than using a master password to unlock a password manager. It just cuts out the middle step.
It’s not a bad idea but that idea breaks as soon as you have to change the master password. You would have to change every one of those passkeys. Which could be annoying, if you have a lot of them.
You might like the current implementation of bitwarden passkeys. You have the master password to unlock your vault of passwords and passkeys as per usual, but then the webpages connect with the extension to authenticate via passkey, so there’s no weak link where the password is sent, but changing the master password doesn’t affect all your other passkeys afaik.
In the scheme I’m proposing, the password never gets sent to the server.
The issue of password reuse is the password getting sent to the site, because the prevailing approach is to hash the password server-side. Passwords leak because they get stored in plaintext, or hashed using outdated algorithms, or get logged with request metadata–bottom line, they end up stored somewhere that an attacker can get their grubby little paws on them, or in a way they can reasonably recover them.
Using a master password to derive a passkey client-side isn’t any different than using a master password to unlock a password manager. It just cuts out the middle step.
It’s not a bad idea but that idea breaks as soon as you have to change the master password. You would have to change every one of those passkeys. Which could be annoying, if you have a lot of them.
You might like the current implementation of bitwarden passkeys. You have the master password to unlock your vault of passwords and passkeys as per usual, but then the webpages connect with the extension to authenticate via passkey, so there’s no weak link where the password is sent, but changing the master password doesn’t affect all your other passkeys afaik.