Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple Passkey

developer.apple.com

Post reply on HN
Print view View original

251–260 of 421 posts

Re: Apple Passkey

#251

Post by judge2020 »

SamuelAdams wrote: post #191
jtokoph wrote: post #158

Earlier quoted context omitted.

I would assume that they are at least encrypted locally before being uploaded to iCloud. (But yes, Apple could always change things)

Don’t be so certain - we need more details from Apple on this. Last I checked iMessage was still (!) not encrypted when backed up to iCloud. https://www.howtogeek.com/710509/apples-imessage-is-secure.....

iCloud Keychain is end-to-end encrypted, Messages isn't because Apple took the tradeoff of allowing people to keep their imessage history even upon a support-initiated account reset, which otherwise will wipe your entire iCloud Keychain.

Re: Apple Passkey

#252

Post by leodriesch »

javajosh wrote: post #236
theonething wrote: post #224

Earlier quoted context omitted.

1Password supports mobile apps. Probably other password managers do too.

Sure, but how does that relate to the GP's comment about Firefox? Did Mozilla release a FirefoxOS for Apple devices that I didn't hear about?!

Firefox also acts as a password manager on iOS and supports the standard system-wide auto-fill APIs [0].

[0]: https://support.mozilla.org/en-US/kb/end-of-support-firefox-...

Re: Apple Passkey

#253

Post by samcat116 »

sholladay wrote: post #195

What I want is to use the device password instead of biometrics. So the device itself and its TPM are the FIDO authenticator, the thing I have in 2FA terms, and the device password is the thing I know. Personally, I feel I can better protect a password than my fingerprint. But I still want the benefits of 2FA and public key crypto where the app/website doesn’t receive any sensitive information. I’d be okay with press…

That first part is literally how it works. If you have your Mac closed (so you can't access TouchID), it asks for your Mac password.

Re: Apple Passkey

#254

Post by samcat116 »

colemcallister wrote: post #28

I wonder what this means for services like Plaid and other aggregators. Will apps / websites continue on with standard username/password option?

I feel like a bank implementing this before they did Oauth (the proper way for those sorts of services like Plaud) would be kinda strange.

Re: Apple Passkey

#255

Post by judge2020 »

cycomanic wrote: post #217
hoorible wrote: post #206

Earlier quoted context omitted.

The password stored in your backup via iCloud Keychain use the passcode of your devices as a secondary encryption/lock method, which doesn’t have a password recovery mechanism like the Apple ID used to secure your iCloud backup. Not sure that meets the definition of E2EE but it’s not like the passwords are recoverable by another party (or even you, if you forget the passcode) just because they’re in your iCloud backu…

So maybe I don't get it, but I always understood that 2FA means something you know and something physical you have. Now if I can get they keychain using something I know, does that not somewhat defeat the purpose of 2FA?

In general it's "who you are" (biometrics) as well as "what you have", with the OS being the one ensuring that the phone itself was unlocked and having an extra biometric check when signing in with passkeys; this is how iOS currently works, it pops up face ID before it signs any Webauthn challenges.

Also, ideally, your syncing passkey solution (whether that be 1password or iCloud Keychain) would itself be a combination of multiple factors before you can get in - in the case of iCloud Keychain, 2fa is on by default on your Apple account, and the keychain is also protected by your password plus the passcode of one of your devices. In general this is already immensely more secure than passwords because the website is verifying a signature instead of the correctness of a shared secret. So, it'd still be possible to have 2fa with the first factor being passkey and the second factor perhaps being another physical security key or maybe verification of an email code, but that would likely be reserved to enterprises and high-security applications.

(I assume Apple themselves aren't going passwordless themselves anytime soon, especially with how that'd work on fresh devices).

Re: Apple Passkey

#256

Post by cpressland »

Could Passkeys ever be used for SSH? I purchased a Yubikey to use as an ed25519-sk key but found the implementation to be too drastic of a change to my workflow to be comfortable with. TouchID / FaceID for SSH would be a totally palatable solution however.

Re: Apple Passkey

#257

Post by duskwuff »

systemvoltage wrote: post #24
whiteboardr wrote: post #9

For context: https://arstechnica.com/information-technology/2022/05/how-a...

> available to the masses in the form of a standard adopted by Apple, Google, and Microsoft that allows for cross-platform and cross-service passkeys. Any way to use this standard if you're not Apple/Google/Microsoft? I'd prefer an option that Apple/Google/Microsoft can call a service (that I control and authorize). I want to be able to self host such a service or have an open marketplace that can compete to serve th…

Apple Passkey is an implementation of WebAuthn. It's a feature which their devices support (and will soon be able to synchronize through iCloud), not a service -- there's nothing that needs to be "hosted".

https://webauthn.io/

Re: Apple Passkey

#258

Post by samcat116 »

Apocryphon wrote: post #22
howinteresting wrote: post #14

Importantly, if you switch platforms you lose all your auth tokens and have to reauth everywhere. It ultimately is yet another way to do vendor lockin, except it has the FIDO alliance's blessing this time. The competition, password managers like 1password and bitwarden, do not have any sort of vendor lockin. You can freely export your passwords from one manager and into another.

As a long-time Safari user who uses keychain heavily in lieu of 1Password or other managers, I probably will migrate to using Passkey because it sounds pretty seamless. But the lock-in point seems like a founded critique. Does anyone disagree with this claim?

I think they must know they need to have some sort of migration/export strategy. Maybe its just to early for that to be implemented yet. I mean I'm not even aware of any websites that support Passkeys as the sole auth method.

How are these handled in Chrome/FF/Windows/etc.

Re: Apple Passkey

#259

Post by philistine »

jupp0r wrote: post #234
om2 wrote: post #208

Earlier quoted context omitted.

It’s end to end encrypted. Apple doesn’t have access.

Same as the don't have access to your iMessage messages ... unless you happen to use iCloud which they purposefully make really inconvenient to not use.

Yes Apple is willingly staying quiet about your iMessage backup being accessible by them. But it does not change the fact that iCloud Keychain is end-to-end encrypted with Apple incapable of accessing your keychain.

Re: Apple Passkey

#260

Post by makeitdouble »

bigiain wrote: post #235
jjav wrote: post #223

Earlier quoted context omitted.

> as a means to avoid locking 2FA to hardware Tying 2FA to hardware is for most of the common use cases a bad idea. Instead always use TOTP and keep the seed in a secure storage with multiple backups. If on top of that you like to keep it on your phone to generate the code that way, fine. But at that point you can destroy the phone and it doesn't matter, you'll still have access. > While I don't like passwords and un…

> Tying 2FA to hardware is for most of the common use cases a bad idea. For me, I don't consider that to be true. I have a Yubikey on my keyring, and a backup Yubikey in my safe. Losing my keys is an extremely rare thing (I've never actually lost my keys, closest I've come in the last 30 years is temporarily misplacing them or locking them inside). I'm happy enough to deal with losing my digital access (via 2FA) tea[…

> I'm happy enough to deal with losing my digital access (via 2FA) temporarily under the same sort of circumstances where I've lost my keys.

To me the critical difference would be that my house keys are single purpose and only serve at a single location. I lost/broke keys a few times in my life, and the only issue was to wait outside the house for a few hours.

I didn't need to authorize 3d secure transactions when paying for the hotel or a taxi, didn't need to authorize accessing my Gitlab account at work, nor validate that I'm really me in the flurry of 2FA services. Nowadays phones and computers are more akin to wallets, and I'm actually more in trouble when losing access to my phone than when losing my wallet.

Post reply on HN