Thursday, August 20, 2026

Tuesday, August 18, 2026

Saturday, August 15, 2026

Wednesday, August 12, 2026

Authenticators, Passkeys, and more - Oh my

Most major online sites  (Google, Microsoft, Banks, etc.) are now requiring some sort of multi-factor authentication (MFA) due to the number of compromised accounts.  MFA basically means you need two things to login in such as a password and something else like a code from a SMS text.  MFA comes in several flavors such as:

  • A code sent to you via email, SMS text, or voice
  • An authenticator app that generates a code such as Proton, Microsoft, or Google Authenticators
  • A passkey which uses asymmetric authentication where you store the private key on your device and the vendor stores your public key.  They have to match for it to work

Microsoft has already disabled email MFA and, as of February 1st, 2027, Microsoft will disable SMS text and voice for MFA for their enterprise accounts (consumer accounts are not affected).  This is because it is just too easy for these methods to be hacked as they require a remote system to send you a code in plaintext which provides many opportunities for someone to intercept the code (e.g. social engineering, SIM cloning, forwarding all emails to the bad guy, etc.).

So why are passkeys better? There are several:

  • They are based on asymmetric encryption so you hold the private key and the vendor has the public key.  If the vendor is broken into, the bad guys cannot get a bunch of passwords to hack  and the cannot get your private key part as that is on your device (see next item)
  • The private key part is stored on your device or in a secure password keeper such as Bitwarden.  What this means is that a bad guy cannot remotely try to break into your account at the vendor; they need your device or access to your secure password keeper.
  • You have no idea what the private key part is and it is very long so social engineering attacks will not work easily.
  • The passkey is different for each account and site you visit.  So no more reusing passwords across multiple sites.
  • Fake phishing websites will not work as they do not have the public key so you will not be able to login.  Also since you do not enter a password, they cannot get your passwords.
  • You do not need to use an account id or password to login, just click on the passkey.  So it is much easier.
But like most things, there are some downsides:
  • They are typically stored in a secure store on the device.  This means you have to set up separate passkeys on each device to access a single service (e.g. a bank account).
  • In some cases, local devices (looking at you Windows 11) only allow you to store one passkey per service (e.g. Office.com) instead of a passkey for each account you have on the service.  So if you have work and personal Office.com accounts, you can only use a passkey with one of them. Sigh.
  • To access a passkey, they typically use a short PIN (not good - looking at you Windows Hello) or some sort of biometric (e.g. finger or face id - good).
  • If you loose a device or if fails, you loose all your passkeys and will have to regenerate them.  So always, always, set up an authenticator app as a back up MFA option.
  • To get around the above issues, Microsoft, Apple, Google, and most major secure password keepers allow you to store the private key part with them instead of on the device which means you have to login to their services just to access the passkeys.  Frankly, I do not trust Microsoft and Google with my private key parts and I do not want them knowing whenever I use a passkey to access my bank account.  Instead I use Bitwarden secure password keeper.  If you do this, then the first 4 issues disappear (although in the case of item 4 you can log in with the passkey on a different device to regenerate the passkeys).
  • Passkeys are implemented very differently by the different vendors.  Some like a Bank I use, do not ask for a PIN code so if someone gets my computer, they have full access to that bank account - oh boy.  Others use a passkey with SMS. Some, like Microsoft Windows 11,  only allow 1 passkey per service so no multiple accounts.  Some still require you to enter a login id, some do not.  Until this  gets sorted out and standardized, passkeys are a bit of challenge to set up and use.
  • The worst thing though is if a bad guy gets your phone or computer and you are using a short, easily guessable PIN to access your passkeys, they can guess it and get access to all your accounts.
Even with that last problem, passkeys are better than Passwords with Email/SMS/Voice MFA as you really cannot do remote attacks with passkeys.  The bad guys have to get your device which is a much lower probability than a remote attack or vendor compromise.

So how to make passkeys work best for you:
  • Use a secure passsword keeper such as Bitwarden (not LastPass as they get hacked almost every year).  This allows you to share passkeys between devices.
  • Use a biometric ID of some sort such as Face or Fingerprint ID to unlock passkeys or, in the case of a secure password keeper a very long password that you use no where else.  Do not use a simple pin code because it is too easy to guess if a bad guy gets your device.
  • Always set up authenticators such as Proton Authenticator as backups to passkeys in case you loose one of your devices and have to redo all your passkeys.

Sunday, August 2, 2026

Subscribe to: Posts (Atom)