RIP Passwords Again?

Security advances. 

 RIP Passwords? Passkey support rolls out to Chrome stable

With a huge list of caveats, initial Google passkey support is here.

RON AMADEO

Passkeys are here to (try to) kill the password. Following Google's beta rollout of the feature in October, passkeys are now hitting Chrome stable M108. "Passkey" is built on industry standards and backed by all the big platform vendors—Google, Apple, Microsoft—along with the FIDO Alliance. Google's latest blog says: "With the latest version of Chrome, we're enabling passkeys on Windows 11, macOS, and Android." The Google Password Manager on Android is ready to sync all your passkeys to the cloud, and if you can meet all the hardware requirements and find a supporting service, you can now sign-in to something with a passkey.

Passkeys are the next step in evolution of password managers. Today password managers are a bit of a hack—the password text box was originally meant for a human to manually type text into, and you were expected to remember your password. Then, password managers started automating that typing and memorization, making it convenient to use longer, more secure passwords. Today, the right way to deal with a password field is to have your password manager generate a string of random, unmemorable junk characters to stick in the password field. The passkey gets rid of that legacy text box interface and instead stores a secret, passes that secret to a website, and if it matches, you're logged in. Instead of passing a randomly generated string of text, passkeys use the "WebAuthn" standard to generate a public-private keypair, just like SSH.  ... ' 

Is the Password Done? Safely?

 Is this finally the case?   See:  

Apple Just Killed the Password—for Real This Time

By Wired, June 8, 2022

Your passwords are terrible. Year after year, the most popular passwords leaked in data breaches are 123456, 123456789, and 12345—'qwerty' and 'password' come close behind—and using these weak passwords leaves you vulnerable to all sorts of hacking. Weak and repeated passwords are one of the most significant risks to your online life.

For years, we've been promised a more secure, password-free future, but it seems like 2022 will actually be the year that millions of people start to move away from passwords. At Apple's Worldwide Developer Conference yesterday, the company announced it will launch passwordless logins across Macs, iPhones, iPads, and Apple TVs around September of this year. Instead of using passwords, you will be able to log in to websites and apps using "Passkeys" with iOS 16 and macOS Ventura. It's the first major real-world shift to password elimination.

So how does it work? Passkeys replace your tired old passwords by creating new digital keys using Touch ID or Face ID, Apple's vice president of internet technologies, Darin Adler, explained at WWDC. When you are creating an online account with a website, you can use a Passkey instead of a password. "To create a Passkey, just use Touch ID or Face ID to authenticate, and you're done," Adler said.

From Wired  Full Article.

>     See also from TWIT regarding PassKeys

https://twit.tv/shows/security-now/episodes/874?autostart=false       Podcast

https://www.grc.com/sn/SN-874-Notes.pdf ,   p 9-10      Notes

Steve Gibson/Security Now's overridding conclusion is here for my own reference:   "...For those of us here, in the know, we’re probably better off allowing the Apple, Google and Microsoft Passkeys fanfare to drive industry-wide adoption (assuming that it does) while holding off, ourselves, until either the cross-platform Passkeys dynamic sharing question is answered — and I don’t know how it can be — or waiting until the inevitable 3rd-party supplier creates a deliberately cross-platform solution. That’s probably the answer. ... "   Will be following this closely.