Passkeys

[pjroutledge]

Fastmail has apparently introduced passkeys in production.

I just successfully created a passkey.

But it doesn't seem to be possible to log in to Fastmail (the passkey is not recognised).

Don't delete your password yet!

[Fenman]

It just worked fine for me.

Edit: It made me wonder whether some ways work better than others. I'm using webmail Firefox and the passkey is stored in the Bitwarden addon. It's worked both in beta and production.

[dryoldlime]

I tried reading about Passkeys but still do not understand. Explain what and how you can.

[pjroutledge]

I'm using a Firefox fork 'Floorp' and Bitwarden.

Earlier I got the message that the passkey wasn't recognised (can't remember exact wording).

Now I get "Could not connect to server." when using the passkey, but I can log on quickly and easily using my userid and password.

Teething problems, perhaps.

[JeremyNicoll]

Originally Posted by dryoldlime

I tried reading about Passkeys but still do not understand. Explain what and how you can.

Assuming you read about it on the FM blog, tell us which bits (presumably some of the introduction, maybe the "why are they better" part) you DID understand, and where you begin not to understand.


Also, do you understand anything of how public key cryptography works?

See: https://en.wikipedia.org/wiki/Public-key_cryptography

[evfrson]

As far as I understand things, it seems you need very recent versions of operating systems (in the Apple ecosystem in particular) for passkeys to work.
Is this correct ?

[somdcomputerguy]

Originally Posted by pjroutledge

I'm using a Firefox fork 'Floorp' and Bitwarden.

I use floorp also, but as my 'main secondary' browser, the role of 'primary browser' is played by Pale Moon. I use KeePass, not Bitwarden to manage my passwords and other data.

- Bruce

[placebo]

It worked for me using Safari and 1Password. I already had a passkey set up to be used as a security key for 2FA, so I had to remove that one from my account before creating the passkey for login.

When I created the passkey, 1Password replaced the old one I had stored. I logged out and then tried to log in again. I was prompted to use the passkey to log in to my account, and it let me right in.

ETA: I just verified that the passkey works in Firefox, Brave, and Arc as well.

[placebo]

Originally Posted by evfrson

As far as I understand things, it seems you need very recent versions of operating systems (in the Apple ecosystem in particular) for passkeys to work.
Is this correct ?

I think this is true if you want OS-level support for passkeys, like being able to share passkeys between devices using iCloud Keychain. But if you use a password manager, like 1Password, which doesn't use iCloud for synchronizing, I expect you can use older versions of the operating system on which the password manager can run.

[pjroutledge]

My Fastmail passkey (same one I created a few days ago) is working this morning.

Still using Floorp and Bitwarden.

Yay!

[easemail]

Some more details about passkeys in the help file: https://www.fastmail.help/hc/en-us/a...44335-Passkeys

Passkeys seem like such a niche solution that it's hard to imagine wide adoption, but then again so did 2FA not that long ago either, and now that stuff is everywhere.

[TenFour]

What I don't understand is why passkeys are supposedly more secure when you still have the option of using a username and password to login. Doesn't that mean that hackers can bypass the passkey and get in the old-fashioned way? I tried passkeys on several accounts, but they just seemed like a hassle with no additional benefits. In every case they were used as a possible 2FA factor but you still needed alternate methods of logging in or 2FA. Using Linux, I was never able to get Google to let me log in using just a passkey. Plus, more than once the passkey logins just failed.

[pjroutledge]

Originally Posted by TenFour

What I don't understand is why passkeys are supposedly more secure when you still have the option of using a username and password to login. Doesn't that mean that hackers can bypass the passkey and get in the old-fashioned way?

Yes, it does.

The idea is that you should delete your username and password access, so that a passkey is your only option. Then your account is more secure.

But, of course, it would also mean that you are totally dependent on your passkey. No fall-back alternative if you lose it or corrupt it.

I feel more comfortable with a passkey and with a userid/password with 2FA as a backup.

I am inclined to think usernames and passwords are too well entrenched to be replaced by passkeys. I think passkeys would only take off if the big sites (Google, Microsoft, Apple, etc) enforce them.

[trikotret]

Originally Posted by pjroutledge

Yes, it does.

The idea is that you should delete your username and password access, so that a passkey is your only option. Then your account is more secure.

But, of course, it would also mean that you are totally dependent on your passkey. No fall-back alternative if you lose it or corrupt it.

I feel more comfortable with a passkey and with a userid/password with 2FA as a backup.

I am inclined to think usernames and passwords are too well entrenched to be replaced by passkeys. I think passkeys would only take off if the big sites (Google, Microsoft, Apple, etc) enforce them.

Ya I am using passkey with Gmail and fastmail with my username/password as backup. The only reason I decided to use passkey with my emails, just incase I need to login on someone else's computer to access my email. Otherwise, I am sticking my with username/passwords and 2fa for all other sites. Everything stored on Proton Pass.

[dryoldlime]

Originally Posted by JeremyNicoll

Assuming you read about it on the FM blog, tell us which bits (presumably some of the introduction, maybe the "why are they better" part) you DID understand, and where you begin not to understand.


Also, do you understand anything of how public key cryptography works?

See: https://en.wikipedia.org/wiki/Public-key_cryptography

I just tried a web search and found https://www.fastmail.com/blog/introducing-passkeys/ .
I read some of it, and reached and read into the part, "What are passkeys and why are they better than passwords?" Then the first paragraph there I do not fully understand. Part of the stoppage of my understanding, is that I use my username and password to verify "It's Me". I never expect these to change unless I make the change and only rarely.

I do not know do not understand how public key cryptography works.