Facebook krijgt ondersteuning voor passkeysFacebook voegt ondersteuning voor passkeys toe aan zijn apps. Daarmee is het mogelijk om in te loggen zonder wachtwoord, met een lokaal aangemaakt bestand dat op het apparaat wordt opgeslagen en dat kan worden ontgrendeld met biometrie. Messenger-ondersteuning volgt later.Facebook zegt dat het voortaan mogelijk is een passkeyinlogmethode in te stellen in de Facebook-app. Dat geldt zowel voor de iOS- als de Android-app. Gebruikers krijgen die optie als ze inloggen op hun account, maar kunnen die ook zelf in het menu van de app instellen.Passkeys zijn credentials die een wachtwoord vervangen. De passkey wordt lokaal aangemaakt en via Apples Keychain of in Googles wachtwoordmanager opgeslagen. Gebruikers moeten die ontgrendelen met bijvoorbeeld een vingerafdruk of gezichtsscan. Passkeys zijn een standaard van de FIDO Alliance en zijn mede ontwikkeld door grote techbedrijven die passkeys als alternatief voor wachtwoorden willen gebruiken.
New Pass-ta-key attack reveals all the things we didn't know about passkeys.Last week, a researcher outlined what he said was a “novel attack surface” in passkeys, the new authentication paradigm that offers a more secure alternative to password-based methods. In fact, the attacks demonstrated in the post are neither novel nor unique to passkeys. This distinction is important because the research has generated confusion among end users and security professionals as they assess whether this new mechanism is truly safe to use.The attack is called Pass-ta-key—a blending of the word passkey with the phrase “pass the key” and a nod to a plate of pasta. Arie Olshtein, a researcher at security firm Palo Alto Networks, described in a post last week how Pass-ta-key could obtain all passkeys stored in the Google Password Manager app (GPM) for Windows when it’s running on a machine infected with malware.This came as a surprise to many people because they believed passkeys are stored exclusively in the trusted platform manager (TPM), the locked-down enclave in a hardened silicon chip that’s reserved for storing cryptographic keys and other highly sensitive information on Windows machines. If passkeys are stored in the TPM, then how was Pass-ta-key able to extract the entire set of passkeys stored by the app, they wanted to know.
Om te zien welke websites passkeys ondersteunen:https://passkeys.directory/Nog afwezig (Juli 2023) in de lijst: Apple.
Passkeys for Apple accounts are automatically generated by any Apple devices signed in to an Apple ID running iOS 17 or macOS 14 Sonoma or newer. (Sept 2023) You will then be able to sign in with passkeys on Apple using any iOS device or Mac signed in to the same Apple ID you are signing in to.If you are using a different browser or device, such as a Windows PC or Mac signed in with a different Apple ID, you can scan the QR code using your iOS device and sign in with passkeys on Apple.You are not yet able to save passkeys for Apple ID accounts in third-party credential managers and can only be stored in iCloud Passwords at this time.
Het werkt dus niet met Proton Pass, de passkeys van Apple? Jammer!
How to use Proton Pass passkeys on iPhonePasskeys are available for all iPhones and iPads from iOS 17 onward. Earlier versions do not support passkeys.Go to the site you want to create a passkey for, and follow the steps to create your passkey. Here’s an example screenshot from GitHub:
... dat passkeys gekoppeld zijn aan een hardware device (bv iPhone) is onderdeel van de oplossing.
Passkeys do marginally improve security against MITM and phishing attacks, but they are primarily for protecting the lowest common denominator from themselves: people who re-use passwords and/or don't use a password manager. If you use multiple devices throughout the day, registering passkeys in all of these systems becomes a big headache with O(m*n) complexity, so putting the passkeys in a password manager is the only realistic solution. But this still breaks the login flow for a very common use case: how do I log in on a device that I don't own? With a password in a password manager I at least have the option of manually typing the password.
My irritation is that I know what it is, and I've said no thanks many times, but I'm still asked regularly by the likes of Amazon, and they usually pick a time when I'm trying to order something quick¹. It is one of the growing number of things in life that simply have no “no” option, it is always “yes or later” - I wouldn't mind so much if “later” meant “I know the option exists, I'll ask for it if I change my mind, don't bother me again otherwise”. Call me cynical, but if companies are trying to nag me into something I very much doubt the main benefit is mine. I'm sure there are many people out there who go along with it simply because they are sick of being asked repeatedly.
Het is nog steeds geen tovermiddel, die PassKeys:
Gast
