Explain it to me, please: Pass Codes

I think you mean passkey...

its usually an alternative to passwords.

It uses a public/private key pair, a different pair for each user. So the server has a public key, you have a private key. When you logon to a web site the server sends you a challenge phrase. Your "device" asks you to verify yourself , and if you do so it signs the challenge phrase with your private key and sends it to the server. Only someone with the private key can do this.

If you want to logon from more than one location then its usualt to use cloud to sync the locations, so sign into windows with a microsoft account, they get synced.

Not really, because they rely on public/private keys I think its hard to explain.

Dave

Pass code or passkey?

(I ask because when trying to log in to my ISP I've just been forced to give an email address to receive a pass code (6 digit number, valid for 20 minutes); and then a landline or mobile phone number for another passcode; and their landline rang but did not manage to give me a passcode; so give them a mobile number and get a text with another passcode (6 digit number, valid for 20 minutes). And then I get a text reading "You've successfully enabled 2FA. If you didn't ask for this please call ... ". )

Humans are bad at picking passwords, they either use the same/similar ones everywhere, or make them easy to remember/guess/brute-force.

So the idea of passcodes is to make the device generate long random passwords per website, store them in such a way they are protected by fingerprint, or face recognition (either on the same device or on a companion device) or at a push, just by a PIN.

Given that they're better you shouldn't be too afraid if that is the future.

At the moment they don't replace, so e.g. if my laptop has a passcode for amazon that requires me to touch a fingerprint sensor, I can still logon to amazon from A.N.Other computer using my password instead of the passcode, if I have two laptops, each of them can have a separate passcode for amazon, no need to sync between them.

Nothing. Well nothing other than cryptographic proof that your computer has has the private bit of the passcode that was previously sent to you by them, and matches the public bit they kept. Because amazon only sees their own private bit, they can't even accidentally leak anything what might be useful for a bent amazon employee to login to your ebay account with.

The passcodes are per website, per user account, per client device.

Beware, several sites trying to explain passcodes are actually just explaining PINs.

The "problem" [TINP] with passcodes is that they're being pushed onto people, with very little explanation, on the basis that Joe Public won't understand, so don't bother explaining.

I will admit the first time Amazon in their sneaky bastard way tricked me into creating a passcode without realising I'd done it, I was upset at being tricked and deleted it, I've since purchased a hardware fingerprint token and recreated a new passcode using it.

This article (well, the comments, really) from TheRegister make some good points...

Don't think the 'how' is that simple - the 'what' passkeys are is a simpler, easier and more secure way of logging in to apps and web sites. The big difference to 2FA and plain old user names and passwords is that it adds a device only you use in that moment of logging on (typically a phone or computer) as an extra layer of security. IIUC - probably not :-) . . .

I found this to be a decent summary:

The older I get, the more complicated life becomes. Bring back postal orders, I say!

How about Traveller's Cheques? Or do they still exist? All this Passcode stuff, it seems to assume your PC has fingerprint or eye-scanning devices. What if it doesn't? Bear in mind I don't have a 'smart' phone, I have a PC and a mobile 'phone.

It doesn't require it, just works better if you have it, if not you can enter a PIN instead of using biometrics.

Maybe I'm not getting it, but it seems to me that the passkey validates if:

a) You have access to the private cryptographic key for that site, account and user, and b) You have access to the device it is paired with, and c) You have the unlock code for that device.

With a different private key for each device you use to access that account.

nib

Actually I get on just fine with password, key sent to my phone as a text or pin sentry.

beats writing out a cheque every time

My phone isn't even locked. Horrid thing

Sounds like you /do/ get it, why don't you think that amounts to a good thing?

The PIN doesn't have to be on your phone, it can be on your password manager (many of which can also act as passkey managers).

I think I do. This shows you right away the level of understanding in me that you are dealing with

I know that whenever I use my bank card or bus pass the information goes off to The Cloud but as far as possible I try to keep all my personal writing, pictures, finance and stuff away from intermediaries' servers. I father and grandfather my backups onto separate external drives - originally because when these companies were start-ups you could never be sure when they would shut down again without warning. These days because you never know when somebody else's government is going to tell them to shut country x, y. or z down without warning. Paranoid, moi? I may have to think through this pass code thing again.

That's very interesting. Thanks Dave.

Nick

Thanks, Rob.

Nick

Berloimey! Those commentards at El Reg are none too keen, are they?

Thanks,

Nick

Thanks Andy. Appreciated.

Nick

I have found passkey explanations very unclear, but came across a website which explains it much more clearly because it refers to the generation of *two* cryptographic keys and how they are used. From

Isn't this a bit like how PGP works?

Its how almost every secure connection works, its called public key encryption. So its used in SSL session establishment to exchange a key for symmetric encryption, (you could use asymmetric public/private for the whole session, but its very CPU intensive)

If you make a contactless transaction it uses the same technique.

It relies on the fact that given the public key its very hard to discover the matching private key. There are fears that quantum computing may render this assumption false.

Dave