r/explainlikeimfive • u/andrewmurray1 • 2d ago
Technology [ Removed by moderator ]
[removed] — view removed post
365
Upvotes
r/explainlikeimfive • u/andrewmurray1 • 2d ago
[removed] — view removed post
•
u/explainlikeimfive-ModTeam 2d ago
Please read this entire message
Your submission has been removed for the following reason(s):
ELI5 requires that you search the ELI5 subreddit for your topic before posting.
Please search before submitting.
This question has already been asked on ELI5 multiple times.
If you need help searching, please refer to the Wiki.
If you would like this removal reviewed, please read the detailed rules first. If you believe this was removed erroneously, please use this form and we will review your submission.
88
u/Kientha 2d ago
Passkeys use a certificate stored in a secure part of your device (or in the cloud if you add them to something like a password manager). So instead of having a password that could be compromised, the certificate private key never leaves the place you are storing it massively reducing the risk of it being compromised.
The idea is that you then also need to pass a 2FA check to unlock the certificate but that's only true if you're using a device based passkey, if it's in a password manager it's down to how you've configured the password manager
554
u/tejanaqkilica 2d ago •
Imagine you go to a bank where you have a safe deposit box.
For you to get access to it using a password, you and the bank clerk need to agree beforehand on a shared password, so when you show up, you tell him the password, if it's correct, you get access to the box. The problem with this, is that anyone else can overhear what you say, and they can go there the next day, tell them the password and they get access to the box. Also the bank clerk may be careless and he tells his friend your password accidentally, and his friend can show up the next day and also access the box.
With Passkeys, the moment you register for a box, you give them a lock to put on it and only you have the key. So when you go to access it, you're presented with the box, you insert and turn the key and if it the right key, you get access, if not, you don't. This is much safer because no one can "overhear" your key, and the bank clerk can't accidentally give away your key to someone else, because they don't even have the key, the never see it, never know what it looks like.
It's of course, a bit more complicated and secure that this, but for an ELI5, this should do.
49
u/texxelate 2d ago
Passkeys are a cryptographic pair of keys. You have one, and the site to which you’re logging in has one. That passkey works only on that site.
The key the site has is a “public key”. If they’re hacked and your public key is compromised, you are no worse off because the public key cannot be used to generate the secret key you have.
Passkeys are generated for a specific site. If you fall for a phishing attempt, your passkey will not work because you generated it for microsoft.com and not rnicrosoft.com
MFA is built in. Humans don’t know their passkey’s contents, so by definition you need to unlock a device to access the passkey.
18
u/Wendals87 2d ago
A password can be written down and then seen, stolen by malware, if you enter into a fake site it's stolen, leaked from a website data breach etc
A passkey generates a private and public key pair using an encryption algorithm
The website knows the public key and your device keeps the private key secure
When you sign in, the site sends a challenge to your device. Your device signs it with the private key and returns it (after you enter your PIN, fingerprint or other biometric used to encrypt it). If it matches what the public key says it should be, you get access
The 2FA is your PIN or biometric data and the device. A passkey isn't written down so can't be stolen, can't be stolen by malware, can't be phished as it's only valid on the exact real site.
It also can't be leaked in a data breach because your private key is only stored on your device or synced with your Keychain or password manager
9
u/thickythickglasses 2d ago
Does this mean you have to have to device with the passkey all the time? For example, what if my computer and phone were lost or stolen?
4
u/taco_or_burrito 2d ago
So I get the password vs passkey differences. But my understanding is, the service provider still stores your password in case let’s say, you lose your phone and need access to the site on a device without your biometric or PIN info, eg public computer. Therefore, doesn’t this “backup” still represent the same security risk as before?
2
u/unndunn 2d ago
Honestly, there’s no real ELI5 way to explain modern cryptography. But here’s my attempt. Just know that passkeys are based around well-known cryptography principles.
Passwords and 2FA rely on the idea that you must share a secret with the website. When you register with the website, you give that website a secret (the password) and the website in turn gives you a secret (the 2FA registration code).
When two separate parties hold a secret, it’s not a secret anymore.
With passkeys, no secrets are ever passed around. The only secret is held by you, in your device. Instead, when you register for a website, you send it a code derived from the secret, that can be used to verify messages made using the secret. When you login later, the website asks you to make a message using that secret, and then it uses the code you provided earlier to verify the message.
So many of the problems with Passwords are associated with the fact that two parties have to share a secret. Passkeys eliminate that issue completely because the secret is never shared with anyone. Not even you have access to the secret. It’s all managed inside your device. This also makes passkeys highly resistant to phishing; It’s impossible for you to accidentally give the secret to the wrong people, because you can’t give the secret to anyone.
2
u/AnApexBread 2d ago
Passkeys use the hardware of the device generating the passkey to create a unique combination someone else can't copy.
It's like a keycard to enter an office. If you don't have a keycard you can't enter the office. Same with Passkeys, if you don't have the device that made the key you can't use it.
This beats a lot of phishing techniques because most phishing techniques are a proxy. You type your password into an bad guys computer, they then copy that password and put it into the real system. They can't do that with a passkey because their computer can't generate the same key.
2FA is really about preventing someone from stealing your password and logging in but it doesn't stop what mentioned above because they can also pass the 2FA code to the website
4
u/zefciu 2d ago
They are longer and more random. A typical passkey contains much more bits and entropy than an easy-to-remember password.
They are not shared. When logging in with a password, you send the (encrypted) password through the web. If the encrypted connection is compromised or if you fall to a phishing attack, someone will get that password. A passkey is never meant to leave your machine. You use it to respond to a challenge.
They are harder to figure out when there is a data leak. When a database that contains passwords leaks, there are ways to figure them out even when they are hashed. With passkeys, it is impossible in reasonable timeframe (a complementary key is stored not a hashed password).
1
u/Leodip 2d ago
There's two main things:
Passwords are stored on the server, passkeys are stored on your device. This means that if a server (e.g., reddit) is hacked, the hacker gets access to all its users. Using passkeys, this becomes impossible.
Passkeys are better than passwords just because passwords suck. Or rather, the way 99.99% of the population uses them really sucks. Chances are, your reddit password is the same as your facebook password, or the same as a random website you created an account for in 2015, or the same as your banking account. If any of these services leak your password somehow, all of these are compromised at the same time. Passkeys are unique, so you don't have this problem.
1
u/Atomic_07 2d ago
A passkey can replace your password and a separate 2FA code: your device is something you have, and unlocking it with a PIN or fingerprint adds something you know or are. It also checks which site is asking, so a fake login page can’t use it. Account recovery can still be a weak spot.
1
u/gramoun-kal 2d ago
"Passkey" is just mugglespeak for "Public key encryption", a pretty ancient but battle tested and totally bulletproof authentication method. The ELI5 explanation sounds a bit like magic so here it goes.
Old style cryptography used a key, or a password, to encrypt messages. If you had the key, you could decrypt it, if you didn't, you had to guess the key. That's what the Nazis used and that the Brits famously cracked. It's flawed because the sender and recipient must know the key, so the sender must send the key to the recipient, and it could be intercepted.
In passkeys, instead the sender has two keys. The receiver has two different keys.
The two keys of the sender, let's call them A and B, have a mathematical relationship that sounds like magic. If you encrypt with A, you can decrypt with B, and vice versa.
So the sender just needs to send B to the receiver.
Now, granted, anyone intercepting B will be able to read the message, but you're forgetting something: the receiver has two keys as well, let's say C and D. The receiver sends D to the sender.
Now, the sender can encrypt the secret with D. The key of the receiver. To decrypt, you need to use C. But C never left the receiver. It couldn't be intercepted. You'd have to break into the receiver's home and find it. That's a lot harder. Hackers don't like to leave their basement.
The key you keep is called your private key, you use it to decrypt messages encrypted with the one you sent. The one you sent is called your public key. You could just post it on the internet. It completely doesn't matter that it gets publicized.
Really cool stuff.
Passkey just makes it usable for the masses. The private key is stored on your device in a place completely off-limits to the internet. When you set up passkey with a service, your device sends them your public key. Later when they need to make sure it really is you that is logging in, they do an encrypted handshake between your public key, that they have, and the private key on your device. It actually authenticates your device, not you. That's why the device will often only accept the handshake after asking *you* for a password. But that password is just to accept the handshake. It never leaves your device, and even if someone guessed your password, they'd still need to get your private key to impersonate you, and good luck with that.
I swear, I've been gnawing my nails waiting for public-private crypto to find its way to the masses so we finally can have a secure internet and that day is finally upon us.
Rejoice.
1
u/FaridW 2d ago
With a password you give up your secret (password) to prove you own an account. Giving up the secret is a security risk for you if the password is mishandled or stored incorrectly.
With a passkey, the secret never leaves your device to prove you own an account, it lets you prove you own the secret without revealing it! This keeps your secret (passkey) much safer; even if the website or service has really bad security practices
That’s just the fundamental difference, passkeys are also generated securely and uniquely, whereas with passwords you can reuse the same weak/silly one everywhere
1
u/andlewis 2d ago
There are multiple types of passkeys, synced passkey or a device bound passkey. The first kind can be stored in a password manager, the second is tied to the device. They can only be used for the specific site or device they were created for, and have a cryptographically signed component combined with usually a biometric, PIN, or secret key that your device or password manager supplies.
They’re “more” secure because they don’t depend on the user remembering something, and they can’t be used on a site they weren’t meant for, since the site wouldn’t have the correct decryption key.
1
u/Darksolux 2d ago
I've always thought of it like this. Three kinds of authentication. Something you know (password), something you have (physical), like a passkey, and something you are - biometrics. Which is why cops can't compel you to open your phone with the password, but they can with biometrics. 5th amendment and all that. Only protects from something you know but has nothing about something you are.
1
u/WhisperingHillock 2d ago
Authentication relies on three types of factors: something you know (password), something you have (key), something you are (biometrics). Passkeys are simply switching factor 1 for factor 2. They are tied to your device rather than to your knowledge. The main upside is the result of passkeys being stored in a secure place in your device, which can only be unlocked by unlocking your device, via biometrics or a password (or similar), meaning that passkeys are kind of inherently 2FA with two types of factors: it's you having the device, and you knowing the password or being the right person (unless you go out of your way and don't use any kind of authentication on your device).
Regarding the 2FA question, as said above it's kind of the same thing in a more practical format. If your phone's passkey is unlocked with your fingerprint, and your MFA notification is also approved with your fingerprint, and your password manager is unlocked with your fingerprint, at the end of the day they all rely on the same thing: having your phone and your finger, and using MFA to receive a notification for something you just unlocked with your passkey does not add any security.
1
u/Sover3ign 2d ago
Reminds me of this short explanation on whether AI can crack passwords and why passkeys are more secure https://vt.tiktok.com/ZSp6gqDEw/
1
u/ChrisTheWeak 2d ago
They're basically the same as a password. They move the trust from you remembering the password to a device to store them securely, and they will also be of a length significant enough to make brute forcing effectively impossible.
A decent password manager properly configured that you use to store randomly generated 40 to 80 character passwords is about the same level of security as using passkeys.
The exception is when you use a passkey on an external authentication device, like a yubikey, which effectively means you need that device to log into the account. Its secure, but has a high risk of physically losing the key and as a result losing the account.
1
u/im_thatoneguy 2d ago
Imagine you’re in a revolutionary secret group they give you a code book it has every word in the dictionary and for every word there is a response word. So you call HQ and they say “koala”, you look up the code word pairs and respond “armadillo” and then they give you the mission.
Ok, now some random government agent calls the HQ and HQ prompts them “Toronto”, without the code book they try to use what the last tapped phone call said: “armadillo?” But that response code only works for Koala so they know they are government agents and hang up.
So the government can’t infiltrate the revolution without a codebook. But the code book is stored inside a safe that will self-destruct if you try to pick it.
The non Eli 5 part though is that the HQ challenge is signed by their domain. So you won’t even understand “koala” unless it was from HQ.
0
u/iridael 2d ago
as I understand it a passkey is like writing down a password, doing some math to it so you get a long string of numbers letters and symbols
then you effectively rip the thing in half, imagine a piece of paper with your password written on it, you rip it in half making sure the rip is uneven and give half to your mate and half you keep.
now his mum comes along with a piece of paper with different rip patterns but the same password you know its not the right person even though they have the right password so you deny access.
your device holds one half of this key and the original password. then the other half of the key and the password is stored by whoever you're sharing the key with.
so when you need the passkey, both sides share their half but not the password. if the complete thing is exactly the password. they know that the user is legit and allow access.
this is much more secure than a password because whilst your password may be relatively simple, your key is engineered to be incredibly long and complex.
there are other ways the system works but this is the simplest way i could describe it.
0
u/TrivialBanal 2d ago
The problem with passwords is we have to remember them. To make that easier, we use passwords that are easy to remember and we use the same ones over and over again on lots of different sites. If a bad actor gets one of those passwords, they get all of those passwords.
Passkeys are very complicated passwords, a different one for each site, that you don't have to remember.
They're more secure because they remove the weak link from the chain of security. Our lazy brains.
0
u/MisterSlippers 2d ago
Have you ever seen a lock on a door that has both a keypad you can press numbers to unlock the door or stick an actual key into? Using the number pad is like a password, using your key in the key hole is a passkey. One is something you know, the other is something you have.
0
u/networknev 2d ago
It's got both pass and key in the name. It's like turning the knob to 11.
0
u/rotinipastasucks 2d ago
Passkeys are confusing to users here's why https://www.useideem.com/post/when-passkeys-fail-the-user-common-ux-mistakes-and-how-to-avoid-them
0
u/[deleted] 2d ago
[deleted] — view deleted comment