Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple Passkey

developer.apple.com

Post reply on HN
Print view View original

331–340 of 421 posts

Re: Apple Passkey

#331

Post by dyml »

ashtonbaker wrote: post #303
dyml wrote: post #165

This is wonderful news! If anyone is interested in experimenting we built an API that makes it very simple to add WebAuthn (passkeys) to your existing web app. It’s available at https://passwordless.dev Note: We also maintain the open source fido2-net-lib, the API just lowers the friction for devs.

This is really cool! And well-timed - I have a project coming up this would be perfect for. The only thing I wonder is, if a user didn’t have biometrics on their device, how would they authenticate? Would I have to maintain a backup system for these users?

Biometrics are not needed, however device support is not 100%.

If the user is not running a model OS they could still be supported by using what is known as a security key (yubico) etc.

The Passwordless API can also help with out of band authentication (using a iOS device to sign in on unsupported old laptop)

Re: Apple Passkey

#332

Post by raxxorraxor »

jupp0r wrote: post #231
jjav wrote: post #223

Earlier quoted context omitted.

> as a means to avoid locking 2FA to hardware Tying 2FA to hardware is for most of the common use cases a bad idea. Instead always use TOTP and keep the seed in a secure storage with multiple backups. If on top of that you like to keep it on your phone to generate the code that way, fine. But at that point you can destroy the phone and it doesn't matter, you'll still have access. > While I don't like passwords and un…

Only if by "never reuse" you mean "never ever log in after the initial login". The problem that WebAuthn/FIDO solves is that even if you read my encrypted communication, you won't be able to use it to gain access to my identity.

A software implementation of WebAuthn requires a TPM module and to be honest I think privacy and user identification are more of a security problem on the web than being phished for passwords. The problem I see with Fido2 is that they consider a far too narrow corridor of threats.

Sure, for devices that need to authenticate themselves it is a decent or maybe the best solution. For me as a user? I am not convinced. It cannot compete with passwords.

Re: Apple Passkey

#333

Post by astrange »

userbinator wrote: post #243
zxcvgm wrote: post #46

This is based on the open standards WebAuthn and FIDO2, where the credentials (“passkeys”) are synced via iCloud Keychain. Currently you need remember to register at least 2 security keys, in case one is lost/misplaced. The syncing of passkeys in iCloud solves this backup problem. https://fidoalliance.org/apple-google-and-microsoft-commit-t...

It's strange and rather unfortunate to see this constant reinvention of authentication methods. Asymmetric encryption as used in things like SSH keys and TLS client authentication have been around for decades, are very much standard, and the only changes to those have been stronger algorithms and longer keys. Smartcards as hardware secure elements have also been around for a long time. I'm not sure how much of a cons…

There was already a passwordless authentication mechanism in browsers called SSL client certificates. Approximately nothing uses it because it’s hard to use.

Re: Apple Passkey

#334

Post by gingericha »

Maybe only tangentially related, but does anyone user Apple Keychain as their primary password manager? Is that even a viable option if you're completely within the Apple ecosystem?

Re: Apple Passkey

#335

Post by weberer »

>As the authenticator, your Apple device generates a unique public-private key pair for every account it creates on a service. The authenticator retains the private key and shares its public key with the server, known as the relying party.

Its about time something like this really took off. Hopefully it will get rid of dumb hacks like text message verification that a lot of companies use. Plus database leaks will no longer be a big deal since they can't really do anything with just a public key.

Re: Apple Passkey

#336

Post by drivebycomment »

41b696ef1113 wrote: post #294
clysm wrote: post #230

Earlier quoted context omitted.

> always use TOTP TOTP can be phished or man-in-the-middle'd and isn't as secure.

Fair, but I am a nobody that is unlikely to be specifically targeted. I am willing to swing the balance towards convenience/backup safety vs utmost security.

A common misconception. After credential stuffing (which 2nf factor protects you from), your biggest threat (for people with 2nd factor) is phishing and keystoke logger, which does not require any targeted attack.

OTP is way less convenient than fido keys, so it's both convenience and security. The only downside is the cost, and the effort required for registering multiple keys which is easily compensated for by the ease of use during authentication than OTP.

Re: Apple Passkey

#337

Post by ptman »

tialaramex wrote: post #207
psanford wrote: post #112

Earlier quoted context omitted.

FIDO usb devices just use the HID protocol so they work fine on linux. Chrome and Firefox both support them. I wrote a FIDO implementation that protects the signing key using the system's TPM specifically for linux: https://github.com/psanford/tpm-fido There is no reason why you couldn't implement a similar syncing strategy in a tool like this if you wanted to.

> just use the HID protocol This is literally true, and covers what was important in context, but warrants a little extra explanation. Since these devices are specifically for humans to interface with (they typically have a button or contact sensor, though some have keypads or a fingerprint reader) they are logically Human Interface Device class USB devices, but they do not speak the HID Keyboard or Pointing Device s…

some yubikey modes of operation do emulate keyboards and paste a string of characters in text fields or terminals

Re: Apple Passkey

#338

Post by mrsuprawsm »

gingericha wrote: post #334

Maybe only tangentially related, but does anyone user Apple Keychain as their primary password manager? Is that even a viable option if you're completely within the Apple ecosystem?

It's definitely a viable option, and probably the simplest/easiest password manager to use if you're only using Apple devices (of course, that is by design).

Re: Apple Passkey

#339

Post by ulimn »

gingericha wrote: post #334

Maybe only tangentially related, but does anyone user Apple Keychain as their primary password manager? Is that even a viable option if you're completely within the Apple ecosystem?

I mainly use Bitwarden for my passwords, but for things I usually open in Safari (for example food ordering sites which accept Apple Pay) I also save the password in Keychain so it's easier / faster to log in (in case Bitwarden is locked and I would have to unlock it (Face ID) with the app instead of the extension).

Re: Apple Passkey

#340

Post by highwaylights »

zxcvgm wrote: post #46

This is based on the open standards WebAuthn and FIDO2, where the credentials (“passkeys”) are synced via iCloud Keychain. Currently you need remember to register at least 2 security keys, in case one is lost/misplaced. The syncing of passkeys in iCloud solves this backup problem. https://fidoalliance.org/apple-google-and-microsoft-commit-t...

Ok.. but hear me out here.

What if the only computer (or even the only Apple computer) a user has is an iphone, and someone swipes it?

Surely in that case you're now locked out of literally everything, no?

Please explain to me why this is stupid because I'm certain someone thought of this very early on.

Post reply on HN