<story><title>Passage by 1Password: Add passkey support to your app or website</title><url>https://blog.1password.com/passage-by-1password/</url></story><parent_chain><item><author>artdigital</author><text>Passkey folks - can someone explain to me how this makes things more secure?&lt;p&gt;For example, let’s take Apple. Apple Passkey support is great - I can store a passkey and it syncs through iCloud to all my devices. So my phone can login, my macbook can login. Neat.&lt;p&gt;But thinking about this a little more, Passkeys on iPhones are secured with FaceID, so to login I have to use FaceID or other biometrics. But on iPhone you can skip the FaceID check if you know the device passcode as fallback. So now, if someone has access to my iPhone and knows my passcode, they have access to ALL my accounts that have Passkeys stored on my iCloud.&lt;p&gt;Previously, even if an attacker had access to my iPhone, they still wouldn’t be able to login because they don’t know my password. And 1Password itself uses a separate unique password and can’t be skipped with device passphrase.&lt;p&gt;I’m honestly surprised that we can’t lockdown passkeys on iOS with a separate password&amp;#x2F;key that’s used to encrypt those. It just seems like I’m giving up on security by switching to passkeys, away from randomly generated passwords. IMHO it should be: FaceID, and if you can’t use biometrics, you HAVE to specify that unique passkey-only encryption phrase to unlock it. Not device passcode.&lt;p&gt;If not that, then I would have expected passkeys to be factor 1 authentication to directly replace passwords, and then have something else as second factor, such as TOTP&amp;#x2F;yubikey&amp;#x2F;SMS auth. But current implementations on any website I’ve seen so far treat Passkey as “ok you’re in”, while going the password route usually triggers a second-factor check.</text></item></parent_chain><comment><author>bgentry</author><text>Your iOS device passcode also gives root access to your entire iCloud account, including the ability to reset your account password. This was highlighted a couple months ago by the Wall Street Journal in relation to a recent wave of thefts &amp;amp; account takeovers which were exploiting this: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;www.wsj.com&amp;#x2F;articles&amp;#x2F;apple-iphone-security-theft-passcode-data-privacya-basic-iphone-feature-helps-criminals-steal-your-digital-life-cbf14b1a&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;www.wsj.com&amp;#x2F;articles&amp;#x2F;apple-iphone-security-theft-pas...&lt;/a&gt;&lt;p&gt;It seems we all need to treat our iOS device passcodes with as much importance &amp;amp; sensitivity as the password to our password manager—essentially root on your digital life.</text></comment>
<story><title>Passage by 1Password: Add passkey support to your app or website</title><url>https://blog.1password.com/passage-by-1password/</url></story><parent_chain><item><author>artdigital</author><text>Passkey folks - can someone explain to me how this makes things more secure?&lt;p&gt;For example, let’s take Apple. Apple Passkey support is great - I can store a passkey and it syncs through iCloud to all my devices. So my phone can login, my macbook can login. Neat.&lt;p&gt;But thinking about this a little more, Passkeys on iPhones are secured with FaceID, so to login I have to use FaceID or other biometrics. But on iPhone you can skip the FaceID check if you know the device passcode as fallback. So now, if someone has access to my iPhone and knows my passcode, they have access to ALL my accounts that have Passkeys stored on my iCloud.&lt;p&gt;Previously, even if an attacker had access to my iPhone, they still wouldn’t be able to login because they don’t know my password. And 1Password itself uses a separate unique password and can’t be skipped with device passphrase.&lt;p&gt;I’m honestly surprised that we can’t lockdown passkeys on iOS with a separate password&amp;#x2F;key that’s used to encrypt those. It just seems like I’m giving up on security by switching to passkeys, away from randomly generated passwords. IMHO it should be: FaceID, and if you can’t use biometrics, you HAVE to specify that unique passkey-only encryption phrase to unlock it. Not device passcode.&lt;p&gt;If not that, then I would have expected passkeys to be factor 1 authentication to directly replace passwords, and then have something else as second factor, such as TOTP&amp;#x2F;yubikey&amp;#x2F;SMS auth. But current implementations on any website I’ve seen so far treat Passkey as “ok you’re in”, while going the password route usually triggers a second-factor check.</text></item></parent_chain><comment><author>AviationAtom</author><text>I think you&amp;#x27;re misunderstanding the intent of this. It&amp;#x27;s meant to stop the theft of text authenticators, from breached databases. It shifts from &amp;quot;something you know&amp;quot; to &amp;quot;something you have.&amp;quot; The problem with &amp;quot;something you have&amp;quot; to this point is that your average consumer doesn&amp;#x27;t want to buy and use a Yubikey. It&amp;#x27;s making PKI (which the DoD still uses for authentication) much more accessible, available, and convenient, for the average user.</text></comment>