Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple’s Killing the Password. Here’s Everything You Need to Know

wired.com

Post reply on HN
Print view View original

41–50 of 99 posts

Re: Apple’s Killing the Password. Here’s Everything You Need to Know

#41

Post by cm2187 »

herbst wrote: post #32
hayst4ck wrote: post #3

> Passkeys work in Apple’s Safari web browser as well as on its devices. I sure wish apple would be a little bit better of a citizen when it comes to interoperability. Safari only features (which is what I'm assuming this will be based on apples history and the quote) are upsetting. uBlock is the single most important piece of software on my computer and my devotion to it exceeds any and all possible other features.…

Google recently asked me to connect via Bluetooth to authorize my laptop with my phone. Just that Bluetooth was completely disabled from my laptop and it did not offer any other option. For some reason the login on Gmail still offered the 'press ok on your phone' method. No idea what I should have done otherwise.

That would make it impossible to login to anything personal through a locked down device, like a corporate computer.

I like the SQRL approach better where the QR code you scan is a url that the phone will connect to directly to do challenge response. That works with any existing browser and computer, whatever the OS or level of locking.

[edit] reading other comments, I realised it is necessary to prevent a mitm attack, the iphone needs to have a way somehow to verify the domain from which the QR code has been served.

Re: Apple’s Killing the Password. Here’s Everything You Need to Know

#42

Post by sofixa »

red_admiral wrote: post #34
sunaurus wrote: post #25

Does anybody understand how passkeys protect against phishing more than OTP codes do? With OTP codes, an attacker can just ask the user to share their code ("please share your 2fa code to authenticate yourself"), surely with passkeys the same attacker could just ask the user to scan the login QR code ("please scan this QR code to authenticate yourself"). Edit: I looked into it a bit more, it seems like it only works…

FIDO authentication, of which webauthn is the successor, works like this: your secret is a signing key for a digital signature cryptosystem. When you authenticate, it signs a message containing various things including the hostname of the site being authenticated to, and because this is under the control of the browser, a phishing site can't fake it easily (also the browser will throw a fit if you're not on https). T…

> then the authentication token they send to the real google will have the correct signature, but the wrong domain name.

So a domain hijacking attack is the only possibility? (and made drastically harder for serious websites with Certificate pinning)

Re: Apple’s Killing the Password. Here’s Everything You Need to Know

#43

Post by [deleted] »

hayst4ck wrote: post #3

> Passkeys work in Apple’s Safari web browser as well as on its devices. I sure wish apple would be a little bit better of a citizen when it comes to interoperability. Safari only features (which is what I'm assuming this will be based on apples history and the quote) are upsetting. uBlock is the single most important piece of software on my computer and my devotion to it exceeds any and all possible other features.…

[deleted]

Re: Apple’s Killing the Password. Here’s Everything You Need to Know

#44

Post by cm2187 »

threeseed wrote: post #30
izacus wrote: post #26

Earlier quoted context omitted.

In words of Tim Cook on the last event: "Just buy an iPhone (or a Mac and an iPad)". Making your experience bad on non-Apple devices is part of the design, not accident.

I worked at Apple and no one is deliberately making the experience bad on non-Apple devices. They just have a million things they want to do, limited resources and so they simply don't prioritise it.

The developers of iTunes for windows certainly do. I wrote developers because I assume there is more than one, but I guess that number may be 1 or 0.

Re: Apple’s Killing the Password. Here’s Everything You Need to Know

#45

Post by cm2187 »

zxcvgm wrote: post #16
mort96 wrote: post #4

One thing I never understood about this passkeys thing is: how will the passkeys database be kept in sync between your iPhone, your Windows desktop, your Linux laptop and your Android tablet? I've tried to research the topic a bit but everything I've been able to find has been about exporting and importing between ecosystems, but most people don't use only a single company's products.

The passkeys are only synced across Apple devices, via iCloud keychain. Trying to sign in on another device (e.g. Windows laptop, Android phone) will require scanning a QR code. The devices then establish a secure channel using FIDO caBLE v2 (introduced by Google/Chrome, I believe) to perform the authentication. This ensures the passkeys never leave your Apple device, but can still be used on other devices. You can s…

Is there a way to export the private key? What if I want to switch to Android? I lose all my accounts?

Re: Apple’s Killing the Password. Here’s Everything You Need to Know

#46

Post by mort96 »

threeseed wrote: post #29
mort96 wrote: post #21

Earlier quoted context omitted.

Aha, so you get a significantly worse experience if you're not 100% in the Apple ecosystem, and you can't sign in at all if you don't have your Apple device on you. I'll keep using passwords, thanks.

If you are using passwords that you can remember without your phone then I assume it's pretty basic and insecure.

Presenting this as a choice between using Apple's closed solution or using easy-to-remember passwords is disingenuous. Please don't participate in the discussion if you're going to be this bad faith.

Re: Apple’s Killing the Password. Here’s Everything You Need to Know

#47

Post by cm2187 »

mort96 wrote: post #4

One thing I never understood about this passkeys thing is: how will the passkeys database be kept in sync between your iPhone, your Windows desktop, your Linux laptop and your Android tablet? I've tried to research the topic a bit but everything I've been able to find has been about exporting and importing between ecosystems, but most people don't use only a single company's products.

What does the passkey database contain? Only the master private key? Or does a private key or token gets generated for every new account I sign up to?

Re: Apple’s Killing the Password. Here’s Everything You Need to Know

#48

Post by threeseed »

sofixa wrote: post #40
threeseed wrote: post #30

Earlier quoted context omitted.

I worked at Apple and no one is deliberately making the experience bad on non-Apple devices. They just have a million things they want to do, limited resources and so they simply don't prioritise it.

Using "limited resources" while talking about Apple is surely a joke, right?

You should read the Mythical Man-Month.

You can't just add unlimited developers to a project and expect it to be productive or sustainable.

No different at Meta, Spotify, Netflix etc.

Re: Apple’s Killing the Password. Here’s Everything You Need to Know

#49

Post by [deleted] »

threeseed wrote: post #29
mort96 wrote: post #21

Earlier quoted context omitted.

Aha, so you get a significantly worse experience if you're not 100% in the Apple ecosystem, and you can't sign in at all if you don't have your Apple device on you. I'll keep using passwords, thanks.

If you are using passwords that you can remember without your phone then I assume it's pretty basic and insecure.

[deleted]
Post reply on HN