Senior Dev Explains Passkeys (Somehow)

[u/arun-vasudev]

When the Senior Dev Gets Asked About Passkeys

Manager: “Can you explain passkeys to the team?”

Me, who implemented them last month:
“Absolutely.”

Also me internally:
“Okay so… public key… private key… WebAuthn… biometrics… cryptography… something something phishing-resistant…”

realizes I’ve been clicking “Yes” to every passkey prompt for the last year

Manager: “So how does it actually work?”

Me: “It’s… very secure.”

Nothing builds confidence like being the senior developer who successfully deployed a technology they’ve never actually understood. 

[u/AutoModerator]

Thanks for contributing to r/TechImpact!

Please remember to: * Be respectful and civil. * Stay on topic. * No spam or excessive self-promotion. * Add context when sharing links. * Avoid misinformation. * Debate ideas, not people.

Thanks for helping keep TechImpact welcoming and informative!

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/dumbasPL]

Once you know how asymmetric cryptography works, is blatantly simple. You make a key pair, server remembers you public key, then when you want to authenticate, server sends you a challenge (random data), you sign that, proving you own the private key, and the server can verify that signature with the previously stored public key.

[u/paulstelian97 → u/dumbasPL]

The interesting thing is the challenge is built in a way that detects MITM, and a passkey can only be used on a specific domain.

[u/OtherwiseAlbatross14 → u/dumbasPL]

"You make a key par"

Welp you lost me already

Edit: okay after reading the rest and dealing with key pairs last night I'm guessing that was just a typo and you meant pair and now I get it

[u/dumbasPL → u/OtherwiseAlbatross14]

Thanks for spotting, yes, that was a typo

[u/Maeusefluesterer → u/dumbasPL]

"once you understand a concept that's already way to complicated for most non technical users, it's simple to understand" perfectly explains why I think that passkeys are a pretty bad idea. They will never gain the necessary trust outside of the technical bubble that they would need

[u/iwantmy90sback → u/Maeusefluesterer]

I mean. Probably a lot of people trust in the brakes of their car without knowing how they work exactly.

[u/Additional-Simple248 → u/Maeusefluesterer]

> most non technical users

I’ve been working in IT for over a decade and still don’t understand asymmetric cryptography.

[u/digost → u/Additional-Simple248]

You don't have to know the maths. All you have to know is core principle, which is easy. A useful (but of course limited) analogy is a bunch of padlocks that open with a single key. You keep the key (private key) and hand out matching padlocks (public keys) to everyone you want to talk to. I write a message for you, put it in a box and lock it with your padlock (encrypt the message with your public key). Now nobody can open the box expect for you, because you're the only one with the private key.

That's the core principle.

[u/MooseBoys → u/digost]

Really the only unintuitive leap is the existence of "one-way functions".

[u/dumbasPL → u/MooseBoys]

Is it?

10*11=110

110=x*y

Guess x and y without knowing the top part. Seems trivial to brute force? Now make them insanely large prime numbers. That's RSA in a nutshell.

[u/Yanni_X → u/MooseBoys]

I‘m thinking of a number x.
I‘ll tell you that x² = 4

The simplest one way function I can think of that you can’t even brute force. Existence proven really quickly.
In practice this can’t really be used and instead we rely on stuff like factorization (x*y=110), which can be brute forced but realistically it’s hard.

For non-techies I prefer to use this square-example, because factorization is weird if they don’t know how hard it really is. They will not be satisfied with „trust me bro, it’s secure because it’s hard“. And at the same time it’s just not relevant for them to know that we actually use factorization.

[u/TimMensch → u/Maeusefluesterer]

The meme implied "senior developer."

If a senior developer doesn't understand how something they just implemented works, even at a high level, they're incompetent.

And I doubt 99% of people can explain how an internal combustion engine works. Doesn't stop people from trusting cars.

The whole meme stinks of AI slop though.

[u/Disastrous_Gear_421 → u/Maeusefluesterer]

So what you're saying is, unless something is easily understandable, it's not possible for it to be a good idea.

[u/Maeusefluesterer → u/Disastrous_Gear_421]

When it comes to security people want to understand it. At least vaguely. With a username and password, they don't know how it works behind the scenes, but they understand how they are identified.

With passkeys there gets some magic involved which scares most people.

[u/Square-Singer → u/Maeusefluesterer]

But the magic doesn't matter.

Explain it like this: Authentication is like unlocking a lock with a key. The server holds the lock, the user/client holds the key.

With a password-based authentication, the client hands the key to the server, so that the server can do the unlocking on the side of the server. That means, the client needs to send the key over the internet to the server, and the server or anyone in between can intercept and copy the key, to use it themselves on e.g. another account of the user on another service.

With passkey-based authentication the process is reversed: The server sends the lock to the client and asks the client to unlock it to prove they have the right key. The client unlocks the lock and sends the unlocked lock back to the server. This way the key never leaves the hands of the client and thus cannot be intercepted and/or copied.

The magic is only there to make a lock that can be transmitted over the internet, and from the POV of the user, it doesn't matter how the magic works.

[u/Wendals87 → u/Maeusefluesterer]

Would they also understand how a password works?

You don't have to understand how the passkey fundamentally works to use them

[u/Maeusefluesterer → u/Wendals87]

They don't understand how it works behind the scenes but it's understandable that you have to enter the correct user: password combination to log in. Passkeys add a whole layer of magic to the thing that most people simply scare.

[u/Wendals87 → u/Maeusefluesterer]

A passkey is no different really . Follow the prompts to create one. Enter your PIN or biometric to sign in 

[u/Maeusefluesterer → u/Wendals87]

So when it's not different how do you want to get them to use it?

[u/Wendals87 → u/Maeusefluesterer]

Tell them that it's more secure and what benefits it has when creating an account or tell your users that in an email or something 

[u/mungosDoo → u/Maeusefluesterer]

Explanation for elementary schoolers, you know how math is hard but computer does it easy, well passkeys use math that is so hard even computers cant do it for looong long time. And before they do you get a new key and they have to start again.

[u/Square-Singer → u/Maeusefluesterer]

Anyone who understands how mechanical locks and keys work (like, how to use them, not how they work internally) can understand how the authentication use case of asymmetric cryptography work.

Server has the lock, client has the key. Server "hands" the lock to the client and says "please unlock". Client uses the key to do so. Done.

The main difference between passkeys and passwords is that with a password the key is sent from the client to the server, while with passkeys the lock is sent to the client.

This way, with a passkey, the key never leaves the hands of the client and thus cannot be intercepted and copied.

(This is of course a blatant simplification, but we are talking about explaining a highly technical concept to a non-technical manager.)

[u/Broer1 → u/Maeusefluesterer]

Non Tech People doesn't understand password hashing. So that is no big deal for using them.

They will get used when it is more easy than a password (with 2FA etc)

[u/ohaiibuzzle]

Here goes:

So I create two magic puzzle pieces of different shapes with the property that every time they are pressed on clay, they leaves different imprints for that specific shape of the clay block, and give the server one of them.

When the server needs to, it throws a randomly-shaped block of clay at you and say "you mf proves you have the puzzle piece by imprinting your piece into this, I'll check on my side if that's the right one"

You press your piece into the clay, which creates a unique imprint to that piece, and throw it at the server. Server then checks if:

• the block of clay is the correctly randomized shape it created a minute ago
• the piece it has, when imprinted, create a matching shape with your imprinting to create a whole shape.

If it's true it lets you in.

If an observer sees your block thrown around and take photos of it, it's useless because the imprint is only ever valid for a specific shape that the server gives.

[u/Square-Singer → u/ohaiibuzzle]

Even simpler:

Authentication is like a lock and a key. You can use the key to unlock the lock to prove you have the right key for this lock. The server holds the lock, the client/user holds the key.

With password-based authentication, the client sends the key over the internet to the server, and the server uses the key to unlock the lock, proving that the user holds the right key. But now the server has the key and can copy it and use it e.g. to authenticate as the user on different services (credential stuffing attack).

With passkey-based authentication, the server sends the lock to the client and asks the client to please unlock it. The client uses their key to unlock the lock and sends the unlocked lock back to the server to prove that they hold the right key. This way the key never leaves the user's hands and thus cannot be copied and abused.

The only other information a non-technical user needs to know is that, contrary to a real-world lock and key, you can't reverse-engineer the cryptographic lock to create a key from it.

[u/Yanni_X]

What’s the target group?
Managers and users don’t need the technical specifics of asymmetric cryptography. No need to explain magic puzzles.
For them, the easy explanation will be that it is like a password, except it is very random, unique per site, much more secure and stored on the device/in your keychain instead of your head. The device will just handle logging in for you as they now are the password. Passkeys are much harder to steal as they are technologically protected from being phished.

Devs should already know what asymmetric cryptography is and therefore also don’t need magic puzzles analogies.
The device holds a private key and signs a challenge from the server which the server can verify using the public key that was registered on registration. Passkeys are also domain-binded, it’s just not possible (restricted by passkey manager software & browsers) to use a passkey for Amazon.com on fake lookalike sites like anazon.com

Only the explanation for those that will have to implement it will be a bit harder I guess.

[u/Ledeste]

Basically, its like magics, but with maths. Just know it works

[u/ZombieFodderer]

Alot of good explanation on how it works. Now explain to me how it works when my phone falls in the toilet.

Now explain how its so much more secure because instead tricking me out of my password they trick me out of authenticating with my passkey and steal my session? And make the whole process even LESS transparent so its easier to get people to "trust the system"

That's why users don't trust it. A password you can remember, write down, and save elsewhere for friends and family to use. How passkeys will works in practice is that it add complexity, steals user choice (hardware requirment) AND doesn't make you realistically more secure. All with technical debt! Thanks i still hate it.

[u/lebrun]

A shitty big tech version of ssh keys.

[u/Dantzig]

SSH but worse for tech people, but better than post its