Passkeys 如何工作：WebAuthn、反钓鱼及为何无法迁移
互联网充斥着密码——那些我们本应记住、复用并偶尔重置的长字符字符串。但密码存在缺陷。它们容易被猜到，难以管理，而且最危险的是，它们是钓鱼攻击的主要目标。现在，让我们介绍 passkeys：一种更安全、更友好的替代方案，正逐渐获得关注。但 passkeys究竟是什么，又为何如此革命性？让我们深入探讨 passkeys 的机制，了解 WebAuthn、反钓鱼特性，以及它们为何与您的设备紧密相连的原因。
Passkeys 是什么？
本质上，passkey 是一种不依赖密码的身份验证方式。相反，它使用您的设备（如智能手机或笔记本电脑）创建一个独特的加密密钥对。该密钥对由一个私钥组成，安全地保存在您的设备上，以及一个公钥，后者与您尝试访问的服务共享。
passkeys 的美妙之处在于它们是无密码的。您永远不会看到您的 passkey，永远不会输入它，也永远不会分享它。当您登录支持 passkeys 的服务时，您的设备使用私钥对服务发送的挑战进行签名。然后，服务使用公钥验证签名。如果签名有效，您即可登录。
WebAuthn：Passkeys 的基础
WebAuthn（Web 身份验证）是使 passkeys 成为可能的标准协议。它是万维网联盟（W3C）和 FIDO 联盟开发的一个开放标准。WebAuthn 允许用户使用公钥密码学进行安全身份验证，无需密码。
以下是 WebAuthn 的底层工作原理：
-
注册：当您首次为某个服务设置 passkey 时，您的设备会生成一个密钥对。服务接收公钥并安全地存储它。私钥保留在您的设备上，永远不会被共享。
```javascript
// 使用 WebAuthn API 注册 passkey 的示例
const publicKeyCredential = await navigator.credentials.get({
publicKey: {
// 挑战、RP（域）、用户标识符等
}
});
// 将 publicKeyCredential 发送到服务器进行存储
```
-
身份验证：当您尝试登录时，服务向您的设备发送一个挑战。您的设备使用私钥对这个挑战进行签名，并将签名的响应发送回服务。
```javascript
// 使用 passkey 进行身份验证的示例
const publicKeyCredential = await navigator.credentials.get({
publicKey: {
// 挑战、RP（域）、用户标识符等
}
});
// 将 publicKeyCredential 发送到服务器进行验证
```
-
验证：服务使用存储的公钥验证签名的挑战。如果签名有效，服务将授予您访问权限。
WebAuthn 支持多种身份验证器，包括设备内置功能，如指纹扫描仪、面部识别和安全元件。这种灵活性确保 passkeys 可以跨多种设备和平台工作。
Passkeys 如何阻止钓鱼攻击
钓鱼攻击是对在线安全最大的威胁之一。攻击者通过创建与合法网站外观相同的假冒网站，诱骗用户泄露密码。一旦用户输入凭证，攻击者就会窃取它们。
然而，passkeys 具有内在的反钓鱼特性。由于私钥永远不会离开您的设备，攻击者不可能通过钓鱼诈骗窃取它。即使攻击者设法创建了一个假冒的登录页面，您的设备也不会签名任何挑战，除非它正在与合法服务交互。
这与密码形成鲜明对比，密码在钓鱼攻击期间很容易被拦截。使用 passkeys，身份验证过程在设计上就是安全的。
内在限制：您无法迁移 Passkeys
passkeys 最引人注目的方面之一是它们是设备锁定的。与可以在多个设备上使用的密码不同，passkeys 与生成它们的特定设备绑定。这意味着您无法将 passkey 从一个设备迁移到另一个设备。
例如，如果您在 iPhone 上创建 passkey，您无法在 Android 手机上使用它。同样，如果您丢失了设备，您无法恢复 passkey，除非您失去对它们所保护服务的访问权限。
这一限制引发了相当大的争议。一方面，它通过确保 passkeys 无法轻易被窃取或转移到未经授权的设备，增强了安全性。另一方面，对于希望跨多个设备使用其凭证的用户来说，这可能非常不便。
权衡：安全与便利
passkeys 的争议突显了安全与便利之间的固有权衡。Passkeys 通过消除与密码和钓鱼相关的风险，提供了更高的安全级别。然而，它们的设备锁定特性可能对重视灵活性的用户来说是一个重大缺点。
以下是几个关键考虑因素：
- 安全性：Passkeys 几乎能抵御钓鱼攻击和其他与密码相关的威胁。
- 便利性：依赖多个设备的用户可能会发现仅在一个设备上使用 passkeys 很不方便。
- 互操作性：人们正在努力改善不同平台和设备之间的互操作性，但进展缓慢。
意义
Passkeys 代表了在线安全的一大进步。通过消除密码并利用 WebAuthn，它们提供了一种更安全、更友好的身份验证方法。然而，它们的设备锁定特性构成了一项挑战，需要解决才能实现更广泛的采用。
随着数字环境的演变，安全与便利之间的平衡将继续变化。Passkeys 是一个有前景的解决方案，但它们并非万能药。在互操作性和灵活性得到改善之前，用户需要仔细权衡利弊。
要点：Passkeys 是增强在线安全的有力工具，但它们的局限性意味着它们并非万能解决方案。随着技术的成熟，我们可以期待看到改进，使 passkeys 更灵活、更易于更广泛的受众使用。
How Passkeys Work: WebAuthn, Phishing, and Why You Can't Move Them
The internet is rife with passwords—long strings of characters that we're supposed to remember, reuse, and occasionally reset. But passwords are flawed. They're easy to guess, hard to manage, and, most dangerously, they're the primary targets of phishing attacks. Enter passkeys: a more secure, user-friendly alternative that's gaining traction. But what exactly are passkeys, and why are they so revolutionary? Let's dive into the mechanics of passkeys, exploring WebAuthn, phishing resistance, and the intriguing reason they're inherently tied to your device.
What Are Passkeys?
At its core, a passkey is a form of authentication that doesn't rely on passwords. Instead, it uses your device (like your smartphone or laptop) to create a unique, cryptographic key pair. This pair consists of a private key, which stays securely on your device, and a public key, which is shared with the service you're trying to access.
The beauty of passkeys is that they are passwordless. You never see your passkey, you never type it, and you never share it. When you log in to a service that supports passkeys, your device uses the private key to sign a challenge sent by the service. The service then verifies the signature using the public key. If the signature is valid, you're logged in.
WebAuthn: The Foundation of Passkeys
WebAuthn (Web Authentication) is the protocol that enables passkeys. It's an open standard developed by the World Wide Web Consortium (W3C) and the FIDO Alliance. WebAuthn allows users to authenticate securely using public-key cryptography, eliminating the need for passwords.
Here’s how WebAuthn works under the hood:
-
Registration: When you first set up a passkey for a service, your device generates a key pair. The service receives the public key and stores it securely. The private key remains on your device and is never shared.
```javascript
// Example of registering a passkey using the WebAuthn API
const publicKeyCredential = await navigator.credentials.get({
publicKey: {
// Challenge, RP (Realm), user identifier, etc.
}
});
// Send publicKeyCredential to the server for storage
```
-
Authentication: When you try to log in, the service sends a challenge to your device. Your device uses the private key to sign this challenge and sends the signed response back to the service.
```javascript
// Example of authenticating using a passkey
const publicKeyCredential = await navigator.credentials.get({
publicKey: {
// Challenge, RP (Realm), user identifier, etc.
}
});
// Send publicKeyCredential to the server for verification
```
-
Verification: The service uses the stored public key to verify the signed challenge. If the signature is valid, the service grants you access.
WebAuthn supports various authenticators, including built-in device features like fingerprint scanners, facial recognition, and secure elements. This flexibility ensures that passkeys can work across a wide range of devices and platforms.
Why Passkeys Stop Phishing
Phishing attacks are one of the biggest threats to online security. Attackers trick users into revealing their passwords by creating fake websites that look identical to legitimate ones. Once the user enters their credentials, the attacker steals them.
Passkeys, however, are inherently resistant to phishing. Because the private key never leaves your device, it's impossible for an attacker to steal it via a phishing scam. Even if an attacker manages to create a fake login page, your device will refuse to sign any challenge unless it's interacting with the legitimate service.
This is a stark contrast to passwords, which can be easily intercepted during a phishing attack. With passkeys, the authentication process is secure by design.
The Inherent Limitation: You Can't Move Passkeys
One of the most intriguing aspects of passkeys is that they are device-locked. Unlike passwords, which you can use across multiple devices, passkeys are tied to the specific device that generated them. This means you can't transfer a passkey from one device to another.
For example, if you create a passkey on your iPhone, you can't use it on your Android phone. Similarly, if you lose your device, you can't recover your passkeys without losing access to the services they protect.
This limitation has sparked considerable debate. On one hand, it enhances security by ensuring that passkeys can't be easily compromised or transferred to unauthorized devices. On the other hand, it can be inconvenient for users who want the flexibility to use their credentials across multiple devices.
The Trade-Off: Security vs. Convenience
The debate over passkeys highlights the inherent trade-off between security and convenience. Passkeys offer a higher level of security by eliminating the risks associated with passwords and phishing. However, their device-locked nature can be a significant drawback for users who value flexibility.
Here are some key considerations:
- Security: Passkeys are virtually immune to phishing attacks and other password-related threats.
- Convenience: Users who rely on multiple devices may find it cumbersome to use passkeys exclusively on one device.
- Interoperability: Efforts are underway to improve interoperability between different platforms and devices, but progress is slow.
What This Means
Passkeys represent a significant step forward in online security. By eliminating passwords and leveraging WebAuthn, they offer a more secure and user-friendly authentication method. However, their device-locked nature presents a challenge that needs to be addressed for broader adoption.
As the digital landscape evolves, the balance between security and convenience will continue to shift. Passkeys are a promising solution, but they're not a silver bullet. Until interoperability and flexibility improve, users will need to weigh the benefits and drawbacks carefully.
Takeaway: Passkeys are a powerful tool for enhancing online security, but their limitations mean they're not a one-size-fits-all solution. As the technology matures, we can expect to see improvements that make passkeys more flexible and accessible to a wider audience.
