1

Passkeys seems great for me as an individual, instead of passwords and TOTP tokens I can now slowly ditch the passwords and the somewhat annoying (but important!) TOTP tokens which I have locked in my phone.

I have read that passkeys will be able to replace 2FA altogether, great! This also seems safe for me, the passkeys are stored safely on my phone and I have it with me everywhere and the use of the passkeys require a fingerprint before being used. But this only seems safe if I as an individual make sure to use trustworthy ways to store and manage my passkeys.

I develop a web application which requires password and 2FA (TOTP or SMS). I know neither of them are foolproof, hence the two-factor authentication. 2FA is not foolproof either, but much better than only one factor.

All my users are certainly not security aware on the web, but forcing them to 2FA makes it much better. I would like to offer them the simplicity together with the security passkeys are said to offer, even if passkeys are used as the only authentication factor.

But from a developers view, are passkeys actually as good as having 2FA? For many of the practical likely cases I would say yes, but since I as a developer cannot control how the user manage and stores he or hers passkeys, could not the security of the passkeys be the weakest link?

There are slowly coming support from password managers to handle passkeys, which are very good. But if a user uses a password manager for storing the passkeys, and choose to use only a really bad password for the password manager vault, then the passkey security seems to lose its "value".

Will passkeys actually be able to replace 2FA for application that requires high security for all users, or should passkeys be considered to be a good type of 2FA instead?

2
  • 1
    Passkeys cannot replace offline TOTP device.
    – defalt
    Oct 16, 2023 at 9:22
  • 1
    Passkeys usually lay at the same spot as the password vault and often (for a good reason) hardware tokens are supported, whereas passkeys are not. Oct 16, 2023 at 16:57

2 Answers 2

0

Multi-factor authentication

In Multi-factor authentication, we confirm the identity of an user using different factors:

  1. something you know (password, pin, pattern)
  2. something you have (mobile device for OTP, SMS)
  3. something you are (your fingerprint, face scan)

In 2FA, we combine any of the 2 factors above to authenticate users.

Passkeys

In Passkey, Authenticator is responsible for generating the private/public key-pair. It can be both hardware or software based. It can be the OS's TPM, devices's secure module, Hardware key, etc.

Passkeys can combine the 2 factors of authentication into one if we set user-verification as required. What it means is, it'll require users to verify themselves during Passkey creation and authentication to unlock the Authenticator / Device using Touch-id, PIN, Face-scan or Password. (same way you unlock your device)

Login with Passkeys requires you 2 things:

  • You should have the Authenticator (device where Credential is store or Password Manager)
    • This satisfies "something you have"
  • User Verification to access the Authenticator
    • This satisfies something you know or something you are depending on how you unlock the Authenticator

But from a developers view, are passkeys actually as good as having 2FA?

IMO, Passkey are secure and equally good as 2FA as they can support 2 factors for authentication. I prefer it over traditional 2FA because of the better user experience.

Will passkeys actually be able to replace 2FA for application that requires high security for all users, or should passkeys be considered to be a good type of 2FA instead?

Passkeys are able to replace the traditional 2FA and should be considered in general usage. However, there's a limitation with Passkeys is that you always need Authenticator/Device access to login. If you loose your device where your Passkey (credential) is stored, you'd need to login using other means. Here, we can use password with email otp or magic links to login.

That being said, as developers we should always develop considering worst case possible with right balance between usability and security.

-2

Passkeys are promising for authentication, as they represent a transition away from traditional passwords and TOTP tokens. The prospect of replacing 2FA entirely with passkeys looks appealing, particularly with the enhanced security they offer. However, the security of passkeys does hinge on the user's diligence in securely managing and storing these keys. As a developer, you may find it challenging to ensure the consistent safeguarding of passkeys, given that it largely depends on users' practices. If a user opts to employ a password manager for passkey storage and then uses a weak password for the manager vault, the inherent security of the passkeys diminishes. This highlights a potential vulnerability, underlining the importance of educating users on secure practices.

In your role as a developer, it's prudent to support passkeys as an additional layer of security, offering users the flexibility to choose this advanced form of authentication. By doing so, you empower users to benefit from the security that passkeys provide. Simultaneously, you mitigate the risk associated with less-than-ideal user practices, as passkeys can coexist with 2FA. Your guidance and documentation on secure passkey management can further bolster user awareness and adoption, ensuring that your application remains a secure environment for all users.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .