Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple Passkey

developer.apple.com

Post reply on HN
Print view View original

61–70 of 421 posts

Re: Apple Passkey

#61

Post by mwcampbell »

e_y_ wrote: post #53
michael1999 wrote: post #26

Earlier quoted context omitted.

I'm not sure this is any more locked in then the parent post is locked into 1password. Moving auth tools is a pain. Anyone implementing FIDO should allow you to enrol multiple devices. As long as the auth consumers allow multiple keys, there's no lock-in. You just need to setup your new device before ditching apple.

Looking at how various places do 2FA, it's likely that at least some websites will not support multiple keys even if they ought to. Also, I imagine that many people do not have the luxury of multiple devices. So if you lose your phone, you'll need to buy or at least borrow another iOS device to recover it from iCloud before you could switch to Android.

How common would it be for someone who has just lost their phone to want to immediately switch platforms? Isn't it much more likely that they'd want a new device on the same platform as the one they just lost?

Re: Apple Passkey

#62

Post by swamp40 »

anony999 wrote: post #43
albertgoeswoof wrote: post #23

Does anyone know if this is different to Webauthn? You can already login with touchid/faceid, with the private key stored in apples keychain. Lots of sites support it, I just added it as 2FA to Mailpace ( https://blog.mailpace.com/blog/why-we-use-webauthn-for-2fa/ ), making it passwordless login instead of 2FA is trivial and fully supported by webauthn. What’s different about this?

>> Apple has described Passkey as a new kind of credential in the iCloud keychain. The technology is based on the Web Authentication API (WebAuthn), a rapidly emerging standard that uses public key cryptography instead of passwords for authenticating users to websites and applications. Whatever "based on webauthn" means...Let's hope it's not just a buggy implementation of WebAuthn as they did with OpenID Connect

Same as what they did with Bluetooth and AirTags, AirPods, etc.

They start with the standardized technology, do their little twist (which usually involves fixing some standardized bug that affects performance and people have been complaining about for years), and patent it.

Re: Apple Passkey

#63

Post by mhoad »

How do I leave the Apple ecosystem if I go all in on this? Sounds like major vendor lock in under a deceptive title of “open standards” but I’m hoping I’m wrong here. Does anybody happen to know yet?

Re: Apple Passkey

#64

Post by threeseed »

jeroenhd wrote: post #54
jdminhbg wrote: post #34

Earlier quoted context omitted.

The video presentation said it was part of the FIDO standard.

Ah, okay. I'm not interested in Apple's periodic product ads so I didn't really understand why this was linked again, especially since it's been available for a while now.

It is linked because it was covered in the keynote.

And what is new is that it looks to become a widely supported FIDO standard i.e. Google/Microsoft are onboard whereas before it was an iOS/macOS only technology.

Re: Apple Passkey

#65

Post by howinteresting »

derefr wrote: post #60
howinteresting wrote: post #48

Earlier quoted context omitted.

Your first paragraph, restated, is that passwords are superior to tokens. Your "proper way" is absurd and nonsensical for the vast majority of users. The first time they get burned by this is the last time they'd rely on anything but the one memorized password they reuse everywhere.

MFA itself is absurd and nonsensical for the vast majority of users. It's security theatre unless you do it right, and if you're doing it right, it's — as you've said — too hard for most people to bother. Properly implemented, MFA is an Enterprise feature, not a personal feature. Like SAML SSO, or having audit-log APIs. The point of setting up MFA is to secure things that really need to be secure, where the person wi…

????

The goal of all this is to make auth tokens be single-factor, not one factor in MFA. If you read the Ars article linked elsewhere in the thread the people behind it are pretty clear about their desire to get rid of passwords.

Re: Apple Passkey

#66

Post by mceachen »

epaulson wrote: post #56

I can be onboard with this if Apple opens up an iCloud API for syncing, so I can sync a non-Apple device through iCloud, and if I leave Apple and iCloud behind, my non-Apple devices keep working, even if I never sync through iCloud again.

C'mon. Non-Apple devices aren't _even remotely_ a priority for them. Just look how bad Apple Music is on Android and web.

Re: Apple Passkey

#67

Post by MBCook »

jeroenhd wrote: post #54
jdminhbg wrote: post #34

Earlier quoted context omitted.

The video presentation said it was part of the FIDO standard.

Ah, okay. I'm not interested in Apple's periodic product ads so I didn't really understand why this was linked again, especially since it's been available for a while now.

It’s been available in beta/nightly form for a little while, I think.

But at todays WWDC presentation they announced it as an official complete feature for the next releases of their OSes.

(That’s why there is so much Apple stuff, presentation just eneed about 15m ago)

Re: Apple Passkey

#69

Post by judge2020 »

aseipp wrote: post #50
albertgoeswoof wrote: post #23

Does anyone know if this is different to Webauthn? You can already login with touchid/faceid, with the private key stored in apples keychain. Lots of sites support it, I just added it as 2FA to Mailpace ( https://blog.mailpace.com/blog/why-we-use-webauthn-for-2fa/ ), making it passwordless login instead of 2FA is trivial and fully supported by webauthn. What’s different about this?

Passkeys are available for general use in any application through the system frameworks, not just the browser; they simply use WebAuthn under the hood, but it's meant to expand support outside of the browser for more apps in more use cases. I wrote another comment elsewhere but there are some other issues with using WebAuthn as a primary authentication mechanism right now, especially things like new device enrollment…

> Also we still need ways of exporting keys and software (like 1password) needs to synchronize them, manage them securely. There's still a long ways to go on that front, which probably won't be handled until stuff like this has settled.

That's the point of passkeys here: iCloud Keychain syncs them, and if you want to use your keys on a non-apple device you'll be able to scan a QR code, which initiates a new BLE connection so that your phone can sign the login request remotely.

Re: Apple Passkey

#70

Post by babypuncher »

hackererror404 wrote: post #8

What happens if you lose your device or it breaks or something? Do you lose access to anything tied to it?

It sounds like your private keys are stored in iCloud, so they should be accessible on a new device as long as you remember your Apple ID, password, the device-specific PIN/passcode from your old phone.
Post reply on HN