Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple Passkey

developer.apple.com

Post reply on HN
Print view View original

221–230 of 421 posts

Re: Apple Passkey

#221

Post by varenc »

hoorible wrote: post #202
al_borland wrote: post #187

Earlier quoted context omitted.

>Currently you need remember to register at least 2 security keys, in case one is lost/misplaced. This is always my issue with 2FA or passwordless auth. You're forced to have 2 devices and are kind of screwed if you don't hvae two on you. I was on a trip and broke my iPhone. It had my plane tickets on it to get home. I was able to get a replacement from Apple, they just gave it to me and sent me on my way. When I tur…

Apple’s implementation uses SMS as a backup. Thinking is probably that if you only have one device, it’s usually your phone; so you would have been able get your 2FA code via text. It’s not easily discoverable though, so easy for you to miss it.

You can use SMS as a backup 2FA to login to your online Apple ID account, but that's not enough to access the iCloud keychain.

The decryption keys for that data are only stored on your iDevices. It's E2EE after all. So while you can access your Apple account via the SMS 2FA backup, you won't be able access your actual iCloud Keychain data/passkeys without some sort of access to your iDevices. (it might be sufficient if they're online somewhere and you have their login credentials?)

A bit confusing, but if it really is E2EE, then you can see why SMS alone wouldn't be enough to recover your Passkeys.

Re: Apple Passkey

#222

Post by javajosh »

alerighi wrote: post #219

I don't get what it's all about this passwordless. I make my browser (Firefox) generate strong password and store them in its password manager, this is synchronized with end to end encryption to all my devices, I have only to remember a master password. It's kind of the same but it works with every website. It is not complicated, doesn't require certificates that you may loose, and that sort of things.

Apps.

Re: Apple Passkey

#223

Post by jjav »

al_borland wrote: post #187
zxcvgm wrote: post #46

This is based on the open standards WebAuthn and FIDO2, where the credentials (“passkeys”) are synced via iCloud Keychain. Currently you need remember to register at least 2 security keys, in case one is lost/misplaced. The syncing of passkeys in iCloud solves this backup problem. https://fidoalliance.org/apple-google-and-microsoft-commit-t...

>Currently you need remember to register at least 2 security keys, in case one is lost/misplaced. This is always my issue with 2FA or passwordless auth. You're forced to have 2 devices and are kind of screwed if you don't hvae two on you. I was on a trip and broke my iPhone. It had my plane tickets on it to get home. I was able to get a replacement from Apple, they just gave it to me and sent me on my way. When I tur…

> as a means to avoid locking 2FA to hardware

Tying 2FA to hardware is for most of the common use cases a bad idea. Instead always use TOTP and keep the seed in a secure storage with multiple backups.

If on top of that you like to keep it on your phone to generate the code that way, fine. But at that point you can destroy the phone and it doesn't matter, you'll still have access.

> While I don't like passwords and understand their very real security limitations.

When used correctly, password are a fairly great solution with fewer limitations than competing solutions. By properly I mean generate yourself 128 bits from /dev/random, never reuse and store securely.

Re: Apple Passkey

#224

Post by theonething »

javajosh wrote: post #222
alerighi wrote: post #219

I don't get what it's all about this passwordless. I make my browser (Firefox) generate strong password and store them in its password manager, this is synchronized with end to end encryption to all my devices, I have only to remember a master password. It's kind of the same but it works with every website. It is not complicated, doesn't require certificates that you may loose, and that sort of things.

Apps.

1Password supports mobile apps. Probably other password managers do too.

Re: Apple Passkey

#225

Post by ghughes »

alerighi wrote: post #219

I don't get what it's all about this passwordless. I make my browser (Firefox) generate strong password and store them in its password manager, this is synchronized with end to end encryption to all my devices, I have only to remember a master password. It's kind of the same but it works with every website. It is not complicated, doesn't require certificates that you may loose, and that sort of things.

The point is to make it harder to export your credentials to another platform. An iOS refugee with a keychain full of passkeys will have to do a password reset for every account, instead of a relatively simple export/import into a third-party password manager.

Re: Apple Passkey

#226

Post by soheil »

I hope 1password gets annihilated by this move. I really liked what they built but over the past few years they have been very user hostile to ensure their extensions fail the Chrome binary signature. When you build a product that people start relying on it's very much of a dick move to go out of your way and make them not work anymore in hopes that they start dishing out a monthly subscription fee. Imagine if Gmail started charging money to read your email.

Re: Apple Passkey

#227

Post by tuxone »

alerighi wrote: post #219

I don't get what it's all about this passwordless. I make my browser (Firefox) generate strong password and store them in its password manager, this is synchronized with end to end encryption to all my devices, I have only to remember a master password. It's kind of the same but it works with every website. It is not complicated, doesn't require certificates that you may loose, and that sort of things.

I don’t get that too, you can already build such a system yourself quite trivially with gpg+rsync

Re: Apple Passkey

#228

Post by 1f60c »

I don’t understand how passkeys aren’t stored on external servers and can’t be phished, and yet they sync via iCloud Keychain (which is a nice thing to have). How does that work? Or do you have to trust Apple not to get hacked?

Re: Apple Passkey

#229

Post by tinus_hn »

alerighi wrote: post #219

I don't get what it's all about this passwordless. I make my browser (Firefox) generate strong password and store them in its password manager, this is synchronized with end to end encryption to all my devices, I have only to remember a master password. It's kind of the same but it works with every website. It is not complicated, doesn't require certificates that you may loose, and that sort of things.

It’s not the same because you have to actually tell the websites your password, while with this, like with certificates, you only have to prove that you have access to the private key. So, if the server is hacked they don’t get a dump of encrypted passwords and if the hack persists they can’t sniff your password. Because the server never gets your password.

Re: Apple Passkey

#230

Post by clysm »

jjav wrote: post #223
al_borland wrote: post #187

Earlier quoted context omitted.

>Currently you need remember to register at least 2 security keys, in case one is lost/misplaced. This is always my issue with 2FA or passwordless auth. You're forced to have 2 devices and are kind of screwed if you don't hvae two on you. I was on a trip and broke my iPhone. It had my plane tickets on it to get home. I was able to get a replacement from Apple, they just gave it to me and sent me on my way. When I tur…

> as a means to avoid locking 2FA to hardware Tying 2FA to hardware is for most of the common use cases a bad idea. Instead always use TOTP and keep the seed in a secure storage with multiple backups. If on top of that you like to keep it on your phone to generate the code that way, fine. But at that point you can destroy the phone and it doesn't matter, you'll still have access. > While I don't like passwords and un…

> always use TOTP

TOTP can be phished or man-in-the-middle'd and isn't as secure.

Post reply on HN