Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple Passkey

developer.apple.com

Post reply on HN
Print view View original

261–270 of 421 posts

Re: Apple Passkey

#261

Post by donarb »

alerighi wrote: post #219

I don't get what it's all about this passwordless. I make my browser (Firefox) generate strong password and store them in its password manager, this is synchronized with end to end encryption to all my devices, I have only to remember a master password. It's kind of the same but it works with every website. It is not complicated, doesn't require certificates that you may loose, and that sort of things.

It eliminates phishing since there is no password to share and the authorization is locked to a specific domain.

Re: Apple Passkey

#262

Post by judge2020 »

plonk wrote: post #189
samwillis wrote: post #186

Earlier quoted context omitted.

E2EE would have made it significantly harder for Apple to build the web based apps at iCloud.com. Not to say that shouldn’t have though, but I can understand whey they didn’t.

Does anyone use that? It's nice to have when I want to access my data from the web, which is never, and it's not worth the loss of security. But I imagine the FBU wouldn't like an end-to-end encrypted iCloud Photos at all.

I think the main thing is Find My access, but Apple seems to claim it's E2EE despite being available at icloud.com/find so perhaps it wasn't too complicated; I imagine it stores the plaintext password in memory to access the data.

Re: Apple Passkey

#263

Post by donarb »

protomyth wrote: post #37

Unless I can back it up and import it into a new device from a competitor, then there is no way I am going to use this unless forced. I do not trust one company anymore.

There's nothing to backup/import. If you have an iPhone, you use your fingerprint or Face ID. If you sell your iPhone and buy an Android, you use your fingerprint or face recognition on that device.

Re: Apple Passkey

#264

Post by judge2020 »

alerighi wrote: post #219

I don't get what it's all about this passwordless. I make my browser (Firefox) generate strong password and store them in its password manager, this is synchronized with end to end encryption to all my devices, I have only to remember a master password. It's kind of the same but it works with every website. It is not complicated, doesn't require certificates that you may loose, and that sort of things.

In general "passkey breach" events aren't possible.

Re: Apple Passkey

#265

Post by r00fus »

soheil wrote: post #226

I hope 1password gets annihilated by this move. I really liked what they built but over the past few years they have been very user hostile to ensure their extensions fail the Chrome binary signature. When you build a product that people start relying on it's very much of a dick move to go out of your way and make them not work anymore in hopes that they start dishing out a monthly subscription fee. Imagine if Gmail…

I have used 1p for several years now and it works great for e.g. me and my wife, but fails repeatedly for my parents who are just not savvy enough to deal with all the little sharp edges that a password manager can't handle (e.g. over stringent or under stringent password rules, the ability to save in all situations like password reset/update interstitials, etc).

I am hoping that if Passkey becomes mainstream they can finally stop pestering me when they hit an edge case.

I doubted Apple's touchID and FaceID but honestly, without it my parents would be a lot more vulnerable. My hope is that this gets them to strong auth everywhere instead of really weak passwords.

Re: Apple Passkey

#266

Post by makeitdouble »

sideshownz wrote: post #220
alerighi wrote: post #219

I don't get what it's all about this passwordless. I make my browser (Firefox) generate strong password and store them in its password manager, this is synchronized with end to end encryption to all my devices, I have only to remember a master password. It's kind of the same but it works with every website. It is not complicated, doesn't require certificates that you may loose, and that sort of things.

Try explaining a password manager to your nana, and having her use it. Then explain to her how she can install it on her phone and have it synchronised across all her devices. Password managers are awesome, but way too technical to become mainstream. You shouldn't have to install 3rd party software for something so fundamental. The password system really needs an overhaul and hopefully this will go along way towards…

> Try explaining a password manager to your nana

It's an interesting issue, and wildly varies depending on who manages her devices. For instance if she has an iPhone with a windows computer, a third party manager brings uniformity to how she deals with login on any device she happens to use. Same if she happens to use a Chromebook.

Or even if she uses an older Apple device, I'm assuming passkeys won't come to previous OSes, and upgrading a 2018 MBP just to get passkeys would come with a lot of trade-offs.

Perhaps I'm seeing it as, it's already a complex mess already, and Apple didn't come with a silver buller to solve all that complexity in one swoop.

PS: password managers are fairly straightforward to explain: it's a digital equivalent of the password notebook they keep in the side drawer

Re: Apple Passkey

#267

Post by sholladay »

samcat116 wrote: post #253
sholladay wrote: post #195

What I want is to use the device password instead of biometrics. So the device itself and its TPM are the FIDO authenticator, the thing I have in 2FA terms, and the device password is the thing I know. Personally, I feel I can better protect a password than my fingerprint. But I still want the benefits of 2FA and public key crypto where the app/website doesn’t receive any sensitive information. I’d be okay with press…

That first part is literally how it works. If you have your Mac closed (so you can't access TouchID), it asks for your Mac password.

I’ll have to try that. Wish there was a way without an external display. I’d like this on my phone, too.

Re: Apple Passkey

#268

Post by potatoz2 »

ghughes wrote: post #240
tinus_hn wrote: post #229

Earlier quoted context omitted.

It’s not the same because you have to actually tell the websites your password, while with this, like with certificates, you only have to prove that you have access to the private key. So, if the server is hacked they don’t get a dump of encrypted passwords and if the hack persists they can’t sniff your password. Because the server never gets your password.

But this is irrelevant if you use a password manager.

Not entirely. If I MITM your connection to a website that uses a password, I have access until the breach is detected. If I MITM a public/private key log in, I only have access to the session (which can be made arbitrarily short if logging in is painless/automatic).

Re: Apple Passkey

#269

Post by comex »

cpressland wrote: post #256

Could Passkeys ever be used for SSH? I purchased a Yubikey to use as an ed25519-sk key but found the implementation to be too drastic of a change to my workflow to be comfortable with. TouchID / FaceID for SSH would be a totally palatable solution however.

Interesting question. Though, if you don't specifically need syncing, there are already apps for storing SSH keys in the Secure Enclave, such as Secretive:

https://github.com/maxgoedjen/secretive

Re: Apple Passkey

#270

Post by smaudet »

bigiain wrote: post #235
jjav wrote: post #223

Earlier quoted context omitted.

> as a means to avoid locking 2FA to hardware Tying 2FA to hardware is for most of the common use cases a bad idea. Instead always use TOTP and keep the seed in a secure storage with multiple backups. If on top of that you like to keep it on your phone to generate the code that way, fine. But at that point you can destroy the phone and it doesn't matter, you'll still have access. > While I don't like passwords and un…

> Tying 2FA to hardware is for most of the common use cases a bad idea. For me, I don't consider that to be true. I have a Yubikey on my keyring, and a backup Yubikey in my safe. Losing my keys is an extremely rare thing (I've never actually lost my keys, closest I've come in the last 30 years is temporarily misplacing them or locking them inside). I'm happy enough to deal with losing my digital access (via 2FA) tea[…

To echo the sibling commenter, perhaps this rule applies:

When dealing with hardware, hardware access tokens should be required. When dealing with software, software access tokens should be required.

That way, you never have hardware compromised by remote tokens, and you never lose access to your software because you lost some hardware.

E.g., hardware tokens to login to a laptop, but only a software token (password) to get on a flight.

Of course there are a lot of use-cases inbetween with varying needs (escrow boxes with digital locks, intelligence services who need to verify the identity of their agents when entering/exiting premises), but I posit those come with requirements outside of the "ordinary".

Post reply on HN