Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple Passkey

developer.apple.com

Post reply on HN
Print view View original

311–320 of 421 posts

Re: Apple Passkey

#311

Post by BuckRogers »

urthor wrote: post #306
BuckRogers wrote: post #277

Earlier quoted context omitted.

Sometimes I wonder how bright nana or papa really is as a result. If you won't dig into even an iPhone's settings to learn what's available, what it can do, good luck to you. That curiosity and willingness to play around, accompanied with Google searches when they don't know what something does, is critical in making it in the world today. Or if you remain a rube, and they will, you'll get scammed someday because you…

What a ridiculous thing to say. Nana and Papa are not locksmiths. Nana and Papa still deserve to have a front door to their house that can't be lockpicked. Normal people, who have other interests in life than configuring technology, should have secure devices and data from criminals. And they shouldn't have to configure 5 different obscure password managers to do so. Society shouldn't allow criminals to take advantag…

Expecting people to give the minimum of a damn is embarrassing to point out? It's true either way. Sometimes a certain level of complexity can't be abstracted over. This is no longer a fun toy in life. You may have your bank account credentials stolen if you don't wake up and pay attention to what you're looking at.

To avoid being lockpicked you only need two-factor. It's that simple. You need some form of password manager, even if it's paper and pencil, until a megacorp handles it all for you. That'll require a universal standard to be adopted, which won't be here soon.

The rest of your assertions are assuming a premise that I never stated. Feigning offense on the internet has really gone over the top. Of course people should have secure devices.

Re: Apple Passkey

#313

Post by makeitdouble »

donarb wrote: post #261
alerighi wrote: post #219

I don't get what it's all about this passwordless. I make my browser (Firefox) generate strong password and store them in its password manager, this is synchronized with end to end encryption to all my devices, I have only to remember a master password. It's kind of the same but it works with every website. It is not complicated, doesn't require certificates that you may loose, and that sort of things.

It eliminates phishing since there is no password to share and the authorization is locked to a specific domain.

Flip side of the coin: this system now manages what domain you can log to, and when it gets it wrong you're probably toast or go through a backup option (is there any if yhey maximize for security ?)

I used Apple keychain for a while, and it wasn't good at recognizing which site needed which password, not even including account switching when you want to use a different one. If it hasn't significantly improved, it will be a pretty frustrating experience for user heavily relying on it (and not just using the same 5 sites the same way everyday)

Re: Apple Passkey

#314

Post by urthor »

BuckRogers wrote: post #311
urthor wrote: post #306

Earlier quoted context omitted.

What a ridiculous thing to say. Nana and Papa are not locksmiths. Nana and Papa still deserve to have a front door to their house that can't be lockpicked. Normal people, who have other interests in life than configuring technology, should have secure devices and data from criminals. And they shouldn't have to configure 5 different obscure password managers to do so. Society shouldn't allow criminals to take advantag…

Expecting people to give the minimum of a damn is embarrassing to point out? It's true either way. Sometimes a certain level of complexity can't be abstracted over. This is no longer a fun toy in life. You may have your bank account credentials stolen if you don't wake up and pay attention to what you're looking at. To avoid being lockpicked you only need two-factor. It's that simple. You need some form of password m…

I expect people to do their best, within their capabilities.

Nana and Papa are not technologically literate enough to perform the kinds of configurations you suggest. In depth custom password manager configuration isn't for them.

They are not at fault for that.

We simply cannot expect all of humanity to be that technologically literate. There are many, many roles in life that don't involve electronic devices that are immensely valuable.

I think that's what I'm deeply offended by. It's not feigned.

But I apologize I don't mean to imply you are talking in bad faith. That's out of line.

My view is.

Engineers cannot expect untrained, ordinary, people in the real world to operate and install complex software.

We have a responsibility to provide them with secure devices they can use.

Privacy and security from bad actors is a moral right.

Re: Apple Passkey

#315

Post by jjav »

jupp0r wrote: post #231
jjav wrote: post #223

Earlier quoted context omitted.

> as a means to avoid locking 2FA to hardware Tying 2FA to hardware is for most of the common use cases a bad idea. Instead always use TOTP and keep the seed in a secure storage with multiple backups. If on top of that you like to keep it on your phone to generate the code that way, fine. But at that point you can destroy the phone and it doesn't matter, you'll still have access. > While I don't like passwords and un…

Only if by "never reuse" you mean "never ever log in after the initial login". The problem that WebAuthn/FIDO solves is that even if you read my encrypted communication, you won't be able to use it to gain access to my identity.

If you've managed to insert your malicious code in a place where you can bypass TLS, secrecy of the password isn't my main concern anymore, as all is lost. It's not a threat model I worry about in most circumstances (sure there's always exceptions).

Re: Apple Passkey

#316

Post by nicky0 »

jerf wrote: post #136
yieldcrv wrote: post #125

Earlier quoted context omitted.

Because Google Chrome on iOS pops up asking to remember a password Safari on iOS suggests a password even if I'm trying to paste on in from my password manager OSX can be the same way They all sync and I never bothered to disable them because I never thought about it, but sometimes I'm in a rush with a service I think I'll never use again and use the suggested solution in one of the browsers

Unfortunately, and I hate to "victim blame" (though you say you are not yet a victim), I think you have to take some responsibility and use a password manager with deliberation. IMHO the browsers all make this worse by giving you something that seems to work and your first notice that it doesn't anymore is when it stops, which is a terrible way for a security feature to work, but obviously they have incentives to loc…

They obvously already know all this, and already have a password manager.

Re: Apple Passkey

#317

Post by Spiritus »

al_borland wrote: post #250
hoorible wrote: post #202

Earlier quoted context omitted.

Apple’s implementation uses SMS as a backup. Thinking is probably that if you only have one device, it’s usually your phone; so you would have been able get your 2FA code via text. It’s not easily discoverable though, so easy for you to miss it.

So if I have a single device, a phone, and it gets stolen... what is the path to get my data back? And in the interum, if the theif swaps my SIM into another phone they now have my 2FA via SMS? This all seems very messy when bad things happen.

Get an e-sim

Re: Apple Passkey

#318

Post by microtonal »

jackson1442 wrote: post #194
samwillis wrote: post #11

Earlier quoted context omitted.

Yes, it looks like it’s been around for a couple of months, after a somewhat quiet announcement. It’s the first I had heard of it though.

Since Fall 2019 actually! (at least that's when I first used it)

I think you are confusing this with U2F support using the secure element, which has been added much earlier (I have also been using it for years already). The difference between that and Passkey is that Passkey syncs private keys between Apple devices through iCloud Keychain. The older U2F support is per-device.

Re: Apple Passkey

#319

Post by microtonal »

toomuchtodo wrote: post #233
microtonal wrote: post #10

Beta support for Passkey is already in the current macOS/iOS releases: https://developer.apple.com/documentation/authenticationserv... I am already using Passkeys on some websites.

Is there a list of web properties that support passkeys?

I think it's supposed to work on websites that support Webauthn/FIDO2. For example, I have been using experimental Passkey support in Safari as a second factor for GitHub.

Re: Apple Passkey

#320

Post by dwaite »

userbinator wrote: post #243
zxcvgm wrote: post #46

This is based on the open standards WebAuthn and FIDO2, where the credentials (“passkeys”) are synced via iCloud Keychain. Currently you need remember to register at least 2 security keys, in case one is lost/misplaced. The syncing of passkeys in iCloud solves this backup problem. https://fidoalliance.org/apple-google-and-microsoft-commit-t...

It's strange and rather unfortunate to see this constant reinvention of authentication methods. Asymmetric encryption as used in things like SSH keys and TLS client authentication have been around for decades, are very much standard, and the only changes to those have been stronger algorithms and longer keys. Smartcards as hardware secure elements have also been around for a long time. I'm not sure how much of a cons…

Perhaps not reinvention but rather repackaging. Web Authentication (on which this is based) is (just) asymmetric encryption in an authentication challenge/response protocol.

It is at an API level, rather than the transport level like SSH and TLS, because applications often often have more complex requirements than these provide. In particular, SSH and mutual TLS typically expect traffic to be authenticated at the transport level on use, and for the credential to exist and be evaluated at first interaction. Websites typically have registration and self-service management functions, as well as anonymous access.

There is also nothing especially new about the use of hardware secure elements, nor was anything new claimed.

I will say as someone who implemented website smartcard-based authentication a decade ago - the experience was typically very poor, because the software stack had not been built for that use case, and often relied on third-party components which were simply sub-par.

There's a lot to be said for reusing technology, but there's also a lot to be said for creating the best possible experience. The MTLS experience that has existed has not gotten any notable consumer adoption for very valid reasons.

Post reply on HN