1

Other than a user revoking their own passkey, or a service no longer accepting a particular passkey (either they banned the user or something else happened that their account on the service is disabled), is it possible for any other parties to revoke a passkey for a user?

Put another way: if I log into a service, Service B, with a passkey on my Apple or Google device, is it possible for Apple or Google to revoke said passkey so I can no longer sign in to Service B?

The implication I'm trying to understand is that passkeys are touted as enabling a password-free future, but I'm wondering if users should still be encouraged to make passwords as a backup authentication option (though it's probably a good idea anyway).

4 Answers 4

3

No, passkeys managed by a platform are end to end encrypted. Only the user has access to them.

1
  • Apple has a pretty tight security concept around Keychain sync: support.apple.com/en-us/HT213305 It is expected that Google and Microsoft are going to deploy similar mechanisms.
    – FlxMgdnz
    Oct 6, 2022 at 7:34
2

The up-coming implementations of Passkeys are tied to Apple, Google and Microsoft accounts. If you're locked out of these, you can no longer access your passkeys. While they haven't been revoked, the effect is more or less the same.

This isn't inherent to Passkeys however. They could also be implemented independent of Apple, Google and Microsoft. But such implementations will likely have a poor integration into browser and thus lack one of the Passkey advantages: convenience.

Independent of this: Passwords as a backup are a bad idea. It undermines both security and convenience. One of the major advantages of Passkeys is that it doesn't just provide password-less login but more importantly password-less registration. With a backup password, on-boarding is more complex (loss of convenience) and passwords are susceptible to phishing (loss of security).

Hopefully, the accounts you are using have a better passkey recovery than using a password.

1

While @tim's answer is technically true, I won't be so sure for other reasons.

Your keyring is managed by a platform and, if that means smooth and frictionless use of Webauthn, you need to have a high level of trust that, for as long as you have need, you will always have access to your credentials. The problem is I cannot say if, e.g. by a court decision or in case of serious system intrusion, the master keys managed by those platforms or the credentials stored on the devices can be revoked or erased. It therefore depends mainly on the policy of the platform and the security means implemented.

[...] I'm wondering if users should still be encouraged to make passwords as a backup authentication option (though it's probably a good idea anyway).

No, it is not a good idea. If the service already supports Webauthn, it can easily allow users to register multiple authenticators. It is a better idea to have an extra roaming authenticator or two as a backup, in case the primary device is lost/stolen, unavailable, or destroyed.

0

Yes, if you share your passkey with AirDrop or allow someone to login to your account with a QR code, then this person has access to your account and can delete your passkey on the service, locking you out.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.