11

Some companies such as Github suggest passkeys replace both passwords and 2FA:

passkeys satisfy both password and 2FA requirements

Github thus allows logging in with a passkey without any second factor, even if you have one enabled (like a authenticator app).

Consider a example scenario where a user's passkeys are stored in a password manager on a desktop computer, and the user also has a previously setup second factor for their online accounts. For simplicity, assume that the password manager storing the passkeys (and passwords) is not installed on the second factor, and is installed and permanently unlocked on the desktop computer.

My understanding is that when using passkeys, an attacker would only need to gain access to a single device (the desktop computer) either physically or via network to acquire the user's passkey vault, at which point the attacker could access all the user's accounts.

In contrast, 2FA with a mobile authenticator app or a hardware key (e.g., yubikey) would require the attacker to gain access two two devices, the desktop computer AND the second factor (e.g., phone, yubikey, etc.).

Is my understanding correct in this scenario, that passkeys reduce difficulty of targeted attacks vs. traditional 2FA by reducing number of devices that need to be accessed by the attacker?

8
  • Welcome to the community. I don't quite get the assumption here - GitHub's recommendation is bad in this case, because it offers less protection(?) Dec 26, 2023 at 9:37
  • @SirMuffington This isn't an assumption per se, but a possible inference depending on the answer to my question. My assumptions are that a) desktop devices typically do not have biometrics, and b) most users of desktop password managers unlock their vaults for much longer than 1 second, typically 5 minutes minimum and often days or months. Dec 26, 2023 at 18:42
  • 2
    "password managers unlock their vaults for ... months" -- citation needed.
    – schroeder
    Dec 26, 2023 at 23:32
  • 1
    I think you are right that this opens a new attack vector that wasn't there before, but it's still not necessarily reduced security: For example, to attack "classic" 2FA with password+SMS, you don't need to take over any device: You get the password via phishing and the SMS via SIM swapping. With hardware-protected passkeys, you need to take over at least one device (the one containing the passkey). And this only allows you to use the passkey as long as the device is running - you can't just copy the key and do evil stuff at your leisure.
    – Heinzi
    Dec 27, 2023 at 17:20
  • 1
    @holocronweaver: The thing is: There is (still) a tradeoff to be made between convenience and security. And, despite the marketing claims made by some, passkeys are not the silver bullet solution that magically allows you to get both for free. Software passkeys are both more convenient and more secure than passwords, but they are not as secure as hardware passkeys (which, in turn, are more inconvenient).
    – Heinzi
    Jan 1 at 14:41

2 Answers 2

2

Passkeys are inherently single-factor - they only require or prove possession of a private key, which the server has no capability to determine how you are storing or protecting - but the intended use case is that the private key is always hidden behind an additional authentication step required on every use, which makes them pseudo-two-factor. For example, on Windows (Windows Hello), MacOS, or Android - the platforms I've used passkeys on - the private keys are themselves stored in hardware security modules (requiring, at least in theory, "something you have") but won't (in theory) give software access to those keys without performing a platform (OS) authentication step, usually either a memorized secret ("something you know" e.g. PIN/swipe pattern/password/passphrase) or a biometric ("something you are" e.g. fingerprint/facial recognition/iris scan).

Of course, theory sounds like a lovely place, and I'd really like to live there some day. Here in reality, though, there's bypasses to all of these controls, plus software (such as password managers) that just straight up don't handle passkeys the way they're intended. Note that this isn't anything new to password managers; they've offered (although usually less pushily) to store "second" factors (usually TOTP keys and backup codes) alongside passwords for years now, sometimes with auto-fill for TOTP, and without requiring MFA for the password manager itself. All of which is to say, if you allow a password manager (or any other program) to store your passkey insecurely, of course it won't be as secure as if it's stored correctly!

With that said, I do think the common pattern of not even allowing users to require an actual second factor in combination with passkeys is really bad. They are, after all, ultimately only a single factor.

9

The short answer in this case is "yes"; one would only need to steal one device instead of two.

But be careful not to jump to erroneous conclusions from this fact.

You state the passkey authenticator is "permanently unlocked". That's a huge factor to consider that violates the whole purpose here. And it's this factor that makes this a reduced difficulty for an attacker. Not the fact that the passkey is on a single device and not split across two.

Why is the passkey storage vault "permanently unlocked"?

The whole point to passkeys is that, like the link you provided shows, the cryptographic keys are protected. Then to access those keys, you need to authenticate locally to that authenticator. If you remove that authentication step, then, yes, you yourself have reduced the protection of passkeys.

So, no passkeys don't reduce the difficulty of attacks. Stripping the protection from them does.

4
  • 5
    I used "permanently unlocked" to simplify, but in practice password managers like Bitwarden are usually unlocked for at least 5+ minutes at a time (often 30+ days on personal desktop) to avoid repeatedly entering the (often lengthy) vault password. (Desktops usually do not have biometrics.) I just verified that Bitwarden & 1Password unlocked for 15 mins indeed logs into websites via passkey with no additional factors. Thus a single device compromise scenario with regular password manager setup seems realistic to me in the current implementation - attackers would just wait for vault unlock. Dec 26, 2023 at 18:34
  • 4
    "attackers would just wait for vault unlock" -- how would that attack work? If this is what you meant, you now need to rewrite much of your question. Physical access is no longer relevant, for example. And if remote access via a RAT, for example, is relevant, how would that be different with a 2FA authenticator on a separate device? The attacker would "wait" for the second factor to be provided. I think that if you narrow down what you are talking about, you'll see that things are not as bad as you're imagining.
    – schroeder
    Dec 26, 2023 at 23:32
  • 2
    @holocronweaver Password managers are not authenticators, though. An authenticator has the sole purpose of, well, authenticating you. I'd expect any authenticator to always request the user to authenticate. Except (maybe) for a few specific cases where the application explicitly allows it. But I can't even think of any. The whole idea of passkeys is to access the private key only for a limited time, ideally never really having it in cleartext in the client device (e.g. USB token/TPM). The application can then turn this key material into a session. Password managers work differently. Dec 27, 2023 at 12:01
  • 1
    @MargaretBloom Modern password managers have taken on the role of passkey authenticators, though, storing (and roaming) the private key in their zero-trust encrypted vaults and intercepting passkey requests in the browser, which they will serve without any additional authentication (assuming the vault is unlocked). This is convenient, but - even if your password manager is more securely configured than most, such as requiring MFA to unlock - still weaker than the intended case for passkeys.
    – CBHacking
    Jan 2 at 8:53

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .