There’s another foot gun I wrote about recently:

https://cedwards.xyz/passkeys-are-not-2fa/

I was reading your other blog post about storing them in bitwarden I have to disagree with this point:

> Unless you were forced to by some organisational policy, there’s no point setting up 2FA only to reduce the effective security to 1FA because of convenience features.

2FA both stored in your password manager is less secure than storing than separately, but it still offers security compared to a single factor. The attack methods you mentioned (RAT, keylogger) require your device to be compromised, and if your device is not compromised 2fa will help you.

To slip into opinion mode, I consider my password manager being compromised to be mostly total compromise anyway.

Also I really like the style and font of your blog.

	▲	TacticalCoder an hour ago \| parent [-]
		> To slip into opinion mode, I consider my password manager being compromised to be mostly total compromise anyway. But how is that no the entire point? If your 2FA is a proper device, like a Yubikey, the attack surface is tinier than tiny and the device ensures that your secret never leaves the device. We did see cases of passwords managers getting compromised. We haven't seen yet a secret being extracted from a Yubikey. So where you say you consider that your software (password manager) getting compromised is total compromise, we're saying: "as long as the HSM on a Yubikey does its job, we have actual 2FA and there cannot be a total compromise".

▲

JasonADrury 3 hours ago | parent | prev | next [-]

This isn't a footgun, you just have absurd security requirements.

>It should be pretty obvious that using a passkey, which lives in the same password manager as your main sign-in password/passkey is not two factors. Setting it up like this would be pointless.

You simply do not need two factors with passkeys. Using passkeys is not pointless, they are vastly more secure than most combined password+2fa solutions.

There are extremely few contexts where an yubikey would be meaningfully safer than the secure element in your macbook.

▲

YmiYugy an hour ago | parent | next [-]

How is it not 2FA? It's MacBook + Fingerprint.

	▲	JasonADrury an hour ago \| parent [-]
		It's not 2fa if you assume some catastrophic exploit chain that allows an attacker to dump your macbooks secure element. I don't think that's a reasonable assumption for most people, and you're screwed in that situation even if you use yubikeys.

▲

gregoriol 3 hours ago | parent | prev [-]

2FA is more secure than 1FA even if that one has a high security level

▲

nixpulvis 2 hours ago | parent | next [-]

To be clear. Proper 2FA, via something like a smartcard or any truly external device is still much more secure. You could have one of those factors be a passkey, that's fine, and may be a good idea.

But there are UX issues with passkeys as well, that aren't all well addressed. My biggest gripe is that there is often no way to migrate from one passkey provider to another, though apparently there may be a standard for this in the works?

▲

Genbox 2 hours ago | parent | prev | next [-]

Are you saying that two weak factors are more secure than one strong factor?

	▲	lazide 2 hours ago \| parent [-]
		Not who you are replying too. But a yubikey is not a weak factor. In fact, it’s not even meaningfully more secure than passkey (as passkey is designed) - passkey is, however, more convenient. So it’s more ‘one weak factor + (really times) one medium/strong factor’ vs ‘one medium/strong factor’. Which yes, the first one is better in every way from a security perspective. At least in isolation. The tricky part is that passkeys for most users are way more convenient, meaning they’ll actually get used more, which means if adopted they’ll likely result in more actual security on average. Yubikeys work well if you’re paying attention, have a security mindset, don’t lose them, etc. which good luck for your average user.

▲

PunchyHamster 3 hours ago | parent | prev | next [-]

if 2fa is "use the second factor that's on same device as first factor" (like when using phone apps in many cases, password + 2fa from email/sms/authenticator app on same device), I disagree.

▲

JasonADrury 2 hours ago | parent | prev [-]

Nonsense, depends entirely on the value of the authentication factor.

▲

lxgr 3 hours ago | parent | prev | next [-]

> It should be pretty obvious that using a passkey, which lives in the same password manager as your main sign-in password/passkey is not two factors. Setting it up like this would be pointless.

If your password manager is itself protected by two factors, I'd still call this two-factor authentication.

▲

FreakLegion 4 hours ago | parent | prev [-]

Passkeys are meant to replace passwords. Not being second factors is the point.

▲

lxgr 3 hours ago | parent | next [-]

Passkeys can absolutely constitute two factors. At least the iOS and Android default implementations back user verification (which the website/relying party can explicitly request) with biometric authentication, which together with device possession makes them two factor.

▲

FreakLegion 2 hours ago | parent [-]

That's not what two-factor means. Forget about passkeys -- if you use a password manager, and that password manager has a biometric lock, your accounts don't thereby have a biometric lock as a second factor. The transitive property doesn't apply here.

	▲	lxgr 38 minutes ago \| parent [-]
		I’d say it does apply transitively, but only if the weakest link itself is also strong enough, and passwords are not.

▲

embedding-shape 3 hours ago | parent | prev [-]

Someone gotta tell all these SaaS about that if so, because currently everyone is treating Passkeys as an alternative to 2FA. Take a look at how GitHub handles it for example when you use TOTP, they'll ask you to replace TOTP with passkeys.

	▲	vladvasiliu 3 hours ago \| parent [-]
		Many do what you describe, probably because some manager somewhere needs to tick some checkbox. But GitHub, specifically, allows you to sign in with a passkey. On the sign-in page, there's a "sign in with passkey" link. It activates my 1Password extension, asking if I want to use my passkey. I say yes, and I'm in, I don't type anything. This also works the same way with my YubiKey.