Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passkeys.io – A Passkey Authentication Demo

passkeys.io

Post reply on HN
Print view View original

61–70 of 121 posts

Re: Passkeys.io – A Passkey Authentication Demo

#61

Post by michaelt »

drdaeman wrote: post #28
ArchOversight wrote: post #23

Earlier quoted context omitted.

Using a physical key in Windows now requires you to enter the pin to unlock your Yubikey (or set a pin) before you can use it to register. This is an issue we've run into a lot at $work where users will forget their FIDO2 pin cause its only used during registration, and never after that, and when they reset the pin it destroys all their previous known 2FA (which is expected). This is a new requirement from Microsoft.

I'm aware about this requirement, and it makes sense. Obviously, I want the authenticator device protected, so I must know the device PIN or password to unlock it. It's exactly the same for Windows Hello built-in authenticator, they require a PIN (or face, or whatever other means you have configured) for the computer itself. Same for iPhones, you need a PIN or password to unlock it. It's merely a matter of frequency…

> I'm aware about this requirement, and it makes sense.

See, pins for yubikeys don't make much sense to me. If you have to enter a PIN and press the button on a token, that doesn't seem very different to entering a password and pressing the button a token which U2F has offered for years.

Re: Passkeys.io – A Passkey Authentication Demo

#63

Post by sreevisakh »

leetbulb wrote: post #34
thealistra wrote: post #32

Jus a note for the creator. Not all email adresses support the +n thing. Just gmail based

More than Gmail supports this.

I can confirm it works on MailInaBox. So it should probably work on any installation that uses Postfix and/or Dovecot.

Re: Passkeys.io – A Passkey Authentication Demo

#65

Post by psanford »

bryfb wrote: post #62

Is passkeys just a webauthn implementation? https://webauthn.io is a similar demo I think.

Passkeys are an implementation of FIDO2 so yes, any sites that have implemented webauthn will support passkeys.

It might be useful to think of passkeys as a usability extension to webauthn. You no longer need to buy dedicated security devices but can use your existing laptop and phone to login securely to your accounts. I expect my parents will start using passkeys on sites in the next 24 months. I would not have tried to get my parents to use Yubikeys.

Re: Passkeys.io – A Passkey Authentication Demo

#66

Post by psanford »

sreevisakh wrote: post #64

I don't think I understand passkeys. The best I could make out is that it uses an asymmetric key pair for authentication. How is this different from self-signed TLS client certificates (like the ones used in Gemini protocol) or CertFP used in IRCv3?

The difference is that: 1) this is accessible and usable by anyone running a modern operating system+browser. mTLS client certs need to be provisioned which is one of the major reasons why it is only used in enterprise settings. And 2) passkeys and WebAuthn are privacy preserving features. You can't track users across different websites with FIDO2 devices (mTLS does not preserve your privacy at all). This was one of the core principals that went into the design of FIDO(2) from the beginning.

Re: Passkeys.io – A Passkey Authentication Demo

#67

Post by barkerja »

cameronh90 wrote: post #60
barkerja wrote: post #58

Earlier quoted context omitted.

1. I don't believe you can, but I could be wrong. 2. Apple does this using Keychain (iCloud), but that's limited to Safari in iOS/iPadOS/macOS. 3. I assume would be treated as any other MFA option; if you lose your auth code generator with no backups, you're SOL. With Apple, you can setup what they call a contact recovery, which lets a trusted contact be a point of recovery for your account. 4. I don't believe this i…

> Account recovery isn't really necessary, Unless you want to switch from Safari to Chrome, I guess?

I would assume so, but I'm not 100% sure. I personally haven't yet messed with Passkeys much aside from use on a couple of sites that have implemented them.

My working assumption is if you wanted to use a new browser, you'd have to attempt to log into the service with the new browser. When the Passkey flow prompts you with a QR code to scan, you'd have to use your iPhone/iPad to scan that QR code to allow entry. What happens after that, I have no clue.

Re: Passkeys.io – A Passkey Authentication Demo

#68

Post by psanford »

cameronh90 wrote: post #60
barkerja wrote: post #58

Earlier quoted context omitted.

1. I don't believe you can, but I could be wrong. 2. Apple does this using Keychain (iCloud), but that's limited to Safari in iOS/iPadOS/macOS. 3. I assume would be treated as any other MFA option; if you lose your auth code generator with no backups, you're SOL. With Apple, you can setup what they call a contact recovery, which lets a trusted contact be a point of recovery for your account. 4. I don't believe this i…

> Account recovery isn't really necessary, Unless you want to switch from Safari to Chrome, I guess?

Part of the design is that every site will support multiple passkeys tied to an individual account. So it will be normal to use one browser to bootstrap registering another browser with a new passkey into your account. This video[1] by the FIDO alliance shows what that process will look like with a bunch of different OS and browser combos.

[1]: https://www.youtube.com/watch?v=SWocv4BhCNg

Re: Passkeys.io – A Passkey Authentication Demo

#69

Post by 0x457 »

jbverschoor wrote: post #50

A few things I don't understand: 1) How can I share the fingerprint keys between chrome and safari? 2) How do I share keys between different types of devices? (mac, ios, android, windows) 3) What happens if my devices are gone? 4) What happens if I want to change my login (email to a new email for example)? 5) Is account recovery handled simply by a reset-email? 6) It seems a validation step of the email is missing?

> 1) How can I share the fingerprint keys between chrome and safari?

If you're talking about TouchID then - keys aren't stored in a browser, they stored in whatever powers Touch ID (secure enclave?). So any browser that supports Webauthn will be able to reuse it.

> 2) How do I share keys between different types of devices? (mac, ios, android, windows)

Yes. I have multiple hardware keys that I use on: iPadOS, Android, Mac, Windows, Linux. Key exposes itself as HID, so it "just works"

> 3) What happens if my devices are gone?

Then you have to perform account recovery, just like when you forget your password

> 4) What happens if I want to change my login (email to a new email for example)?

Email isn't stored on the key. So changing email to a new email if entirely dependent on service you're logging in, just like in case of a password.

> 5) Is account recovery handled simply by a reset-email?

This is unrelated to passkeys and webauthn. This is a replacement for authentication, not account management, so yes, it's handled the same in a way that is entirely up to service how to handle it.

> 6) It seems a validation step of the email is missing?

I think at this point you can answer this question yourself?

Re: Passkeys.io – A Passkey Authentication Demo

#70

Post by ylk »

cameronh90 wrote: post #60
barkerja wrote: post #58

Earlier quoted context omitted.

1. I don't believe you can, but I could be wrong. 2. Apple does this using Keychain (iCloud), but that's limited to Safari in iOS/iPadOS/macOS. 3. I assume would be treated as any other MFA option; if you lose your auth code generator with no backups, you're SOL. With Apple, you can setup what they call a contact recovery, which lets a trusted contact be a point of recovery for your account. 4. I don't believe this i…

> Account recovery isn't really necessary, Unless you want to switch from Safari to Chrome, I guess?

The keys aren’t stored in the browser. The browser just forwards to the hardware.

Switching from one password/-key manager to another is going to be more of an issue.

But you should be able to add an additional passkey once logged in to an account, just like how you can have multiple hardware 2fa keys now. Then you could manually migrate accounts that way, which is painful, of course, but you wouldn’t be completely locked in.

Post reply on HN