Live data from Hacker News

Launch HN: Keyri (YC S21) – Secure smartphone-based passwordless authentication

news.ycombinator.com

21–30 of 98 posts

Re: Launch HN: Keyri (YC S21) – Secure smartphone-based passwordless authentication

#21

Congratulations on the launch, Zain and Grant. I've come across a decent share of passwordless solutions in recent times (like gazepass.com and sawolabs.com to name two of the recent upstarts in the space), while GRC's SQRL has been around a lot longer. The bane of passwordless auth systems is the whole ceremony around forgot-password / change-password flows (in this case, re-associating a new public/private keypair,…

Thanks very much for the heavily referenced post. As an aside, I built the prototype of this last year in a vacuum without knowing any passwordless solutions other than FIDO2 systems. My cofounder disabused me of the notion that this was a totally novel concept. I'd never heard of gazepass or sawolabs before and now feel even less original :). That said, I think you recognize the differences between our system and those two, so I won't get in to those details unless you want me to.

Agreed, device continuity is the #1 challenge for truly passwordless systems. The Google/Apple cloud backup system we're currently on is a compromise to deliver a seamless UX for mass audiences in the majority of device transition cases. As soon as a user sets up their new phone using an iCloud / Google backup of their old phone, they will have Keyri private keys already embedded in their restored apps. Developers, optionally, can require users to input a PIN/passcode in order to restore the keys following a backup restoration.

For the minority of cases in which this cloud-backup-based device transition does not work smoothly, companies can offer customer support lines, which, as mentioned in another reply, will be far less busy than "forgot my password" CS lines, thereby making social engineering easier to detect.

Again, while not ideal, as mentioned in another reply, the current solution is based on Keychain (iOS) / KeyStore (Android), which are rather secure and private, and compromise of those systems entails... a really bad day for the victim given they're associated with saved passwords, emails, text messages, photos, etc.

And yes, we definitely plan to maintain our own cloud backup service. That is really hard to architect in a way that's both secure and frictionless, so we'll be designing that for some time. Evervault and scrt.network are great references - thank you.

Re: Launch HN: Keyri (YC S21) – Secure smartphone-based passwordless authentication

#23

For the smartphone case, why would I want to pay for Keyri, rather than use WebAuthn (for the web) or the smartphone OS-provided FIDO2 feature that ships with the OS? https://developers.google.com/identity/fido/android/native-a...

Keyri makes less sense for smartphone-only applications. The primary case we solve for is applications that have both mobile and desktop web interfaces. Phones are already essentially considered trusted devices, whether auth there happened via password, SMS OTP, OpenID, FIDO2, etc. Keyri bridges the "trust gap" between the trusted smartphone in the user's hand and the untrusted desktop computer / smart TV / whatever other screen they're sitting in front of via our QR + CV + HTTPS system.

Deploying WebAuthn / FIDO2 on desktop web/native apps is far more challenging given the standard's need for communication between the authenticator device and client device to happen via USB, Bluetooth, or NFC. USB is obviously out of the question for consumer-facing apps, and companies simply can't ask typical users to connect their devices via Bluetooth - setup and reliability are the UX issues with BT.

Re: Launch HN: Keyri (YC S21) – Secure smartphone-based passwordless authentication

#25
post #24

It seems as though every SaaS provider is already rolling their own authentication app - my iPhone is becoming crowded with them (Xero, Adobe, etc) - so the timing of Keyri is fantastic.

Thanks very much! Yes, agreed, the number of authenticator apps is becoming annoying at best and arguably daunting - not to mention the prevalence of "sign in with ___" which has left consumers confused about whether they've leveraged Google, Facebook, Apple, Xero, Github, Discord, etc for each service.

Re: Launch HN: Keyri (YC S21) – Secure smartphone-based passwordless authentication

#26

Earlier quoted context omitted.

Thanks. Yes, the concept is to productize the WhatsApp/Discord UX. Keyri differs from them on how it works behind the scenes for increased security and ease of integration. BTW - QR login is much more prevalent in China. Just about every major and minor tech platform there has QR login. I see that as a case of leapfrogging, and I hope we can accelerate its adoption in the West and other regions. Agreed that the stand…

Super interesting re: China. Curious if there are open source projects/libraries they build on or if most of that is built internally.

I don't have much inside info, but the contents of the QR codes on Alibaba, JD.com, and others differ substantially, so I suspect each is building their systems in-house, though in China, I would think there's more of an established playbook for building them given its prevalence. I haven't run across a dedicated library/package for this.

In the West, WhatsApp and Discord have massively different schemes for QR login.

Re: Launch HN: Keyri (YC S21) – Secure smartphone-based passwordless authentication

#28

iOS screenshots: “Log in Two Accounts”

Ah yes, thanks for pointing that out. The iOS app store listing is ancient and terrible. The Google Play store listing is a bit better, but still from a time when I was doing all the design work :)

Re: Launch HN: Keyri (YC S21) – Secure smartphone-based passwordless authentication

#29

For the smartphone case, why would I want to pay for Keyri, rather than use WebAuthn (for the web) or the smartphone OS-provided FIDO2 feature that ships with the OS? https://developers.google.com/identity/fido/android/native-a...

Keyri makes less sense for smartphone-only applications. The primary case we solve for is applications that have both mobile and desktop web interfaces. Phones are already essentially considered trusted devices, whether auth there happened via password, SMS OTP, OpenID, FIDO2, etc. Keyri bridges the "trust gap" between the trusted smartphone in the user's hand and the untrusted desktop computer / smart TV / whatever…

You referred to 'QR + CV + HTTPS system'. Is there more to the CV component than taking a photo?

Re: Launch HN: Keyri (YC S21) – Secure smartphone-based passwordless authentication

#30
post #20

Saas pass has a similar offering for developers for over 5 years. We need more such initiatives like yours to help raise awareness that there are passwordless options out there.

Just checked out SaaS pass and it is definitely a robust "auth in a box" solution. Thank you, yes ultimately the goal is to eliminate account takeovers and consumer headaches - we think we have the ideal solution but also look forward to other players pushing the passwordless agenda forward.
Post reply on HN