Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passkeys.io – A Passkey Authentication Demo

passkeys.io

Post reply on HN
Print view View original

71–80 of 121 posts

Re: Passkeys.io – A Passkey Authentication Demo

#71

Post by dwaite »

drdaeman wrote: post #28
ArchOversight wrote: post #23

Earlier quoted context omitted.

Using a physical key in Windows now requires you to enter the pin to unlock your Yubikey (or set a pin) before you can use it to register. This is an issue we've run into a lot at $work where users will forget their FIDO2 pin cause its only used during registration, and never after that, and when they reset the pin it destroys all their previous known 2FA (which is expected). This is a new requirement from Microsoft.

I'm aware about this requirement, and it makes sense. Obviously, I want the authenticator device protected, so I must know the device PIN or password to unlock it. It's exactly the same for Windows Hello built-in authenticator, they require a PIN (or face, or whatever other means you have configured) for the computer itself. Same for iPhones, you need a PIN or password to unlock it. It's merely a matter of frequency…

> I'm curious if resetting a PIN or password on Windows or macOS or iPhone OS would retain the Passkey identities. I suspect it would...

Depends on the process for changing the PIN/password. The desktops may have an option to log in with the cloud account, which can have separate recovery processes.

If I lose my PIN to my iPhone though, pretty much my only option is a device reset. The difference with Passkeys is that they are bound to an iCloud account, not the hardware - so I get them back on device restore.

Some of the security key enterprise and government customers also don't necessarily want credential backup/restore. Handling the account recovery and key registration process in their environment has more quantifiable risk than having it as an external process.

Re: Passkeys.io – A Passkey Authentication Demo

#72

Post by psanford »

michaelt wrote: post #61
drdaeman wrote: post #28

Earlier quoted context omitted.

I'm aware about this requirement, and it makes sense. Obviously, I want the authenticator device protected, so I must know the device PIN or password to unlock it. It's exactly the same for Windows Hello built-in authenticator, they require a PIN (or face, or whatever other means you have configured) for the computer itself. Same for iPhones, you need a PIN or password to unlock it. It's merely a matter of frequency…

> I'm aware about this requirement, and it makes sense. See, pins for yubikeys don't make much sense to me. If you have to enter a PIN and press the button on a token, that doesn't seem very different to entering a password and pressing the button a token which U2F has offered for years.

Entering a PIN is known as "user verification." The point is to prove not just that you posses the key but also that you know a secret about the key. This is better than passwords for a number of reasons. The pin doesn't need to be secure in the way that passwords need to be secure. The pin is only sent between your browser and your FIDO2 device. If you some how learned my pin you couldn't do anything with that unless you also stole my yubikey. And you can't brute force the pin. Guess the wrong pin more than 10 times on my yubikey and the key will erase itself.

Pins make a lot of sense when you start using a yubikey as your primary form of authentication (instead of as a second factor). Note that there are other ways to perform 'user verification' besides a pin. For example, biometrics are specified in the FIDO2 spec, and implemented by yubikey in their Yubikey Bio product.

Re: Passkeys.io – A Passkey Authentication Demo

#73

Post by psanford »

masterof0 wrote: post #49

Does anyone knows if 'passweys' will be implemented in open source password managers like BitWarden or KeyPassX, etc. ? Or do we need to rely on Apple/Microsoft/Google for this to work?

The specification is fully open and most of the components have already been implemented in various open source libraries. The nice thing about passkeys is that they are just a FIDO2 implementation with a few extensions. That means any site that supports passkeys will also support other FIDO2 implementations, including the existing open source FIDO2 projects.

Re: Passkeys.io – A Passkey Authentication Demo

#74

Post by dwaite »

michaelt wrote: post #61
drdaeman wrote: post #28

Earlier quoted context omitted.

I'm aware about this requirement, and it makes sense. Obviously, I want the authenticator device protected, so I must know the device PIN or password to unlock it. It's exactly the same for Windows Hello built-in authenticator, they require a PIN (or face, or whatever other means you have configured) for the computer itself. Same for iPhones, you need a PIN or password to unlock it. It's merely a matter of frequency…

> I'm aware about this requirement, and it makes sense. See, pins for yubikeys don't make much sense to me. If you have to enter a PIN and press the button on a token, that doesn't seem very different to entering a password and pressing the button a token which U2F has offered for years.

There are yubikeys with biometric readers.

The reason they are referred to as PINs rather than passwords is that they are locally set and entered, without being shared with external network systems. Since they are being used to augment the physical security properties of the hardware device, the PIN can also be far simpler than a typical password - someone has to steal your hardware before they can contemplate forcing the PIN.

This additional user verification over the physical factor is used for two purposes:

1. The site can request user verification as part of accepting this system as a one-stop replacement for their current two-factor authentication systems.

2. Enumerating what credentials are on a key is often PIN-protected, so that someone who has temporary access to your security key (such as at a border checkpoint) can't inspect which sites you have logins against without your knowledge/consent.

This second one is the more annoying of the two - I might have the system request my PIN just so it can tell whether that particular security key is a viable source of credentials for a particular site.

Re: Passkeys.io – A Passkey Authentication Demo

#75

Post by sreevisakh »

psanford wrote: post #66
sreevisakh wrote: post #64

I don't think I understand passkeys. The best I could make out is that it uses an asymmetric key pair for authentication. How is this different from self-signed TLS client certificates (like the ones used in Gemini protocol) or CertFP used in IRCv3?

The difference is that: 1) this is accessible and usable by anyone running a modern operating system+browser. mTLS client certs need to be provisioned which is one of the major reasons why it is only used in enterprise settings. And 2) passkeys and WebAuthn are privacy preserving features. You can't track users across different websites with FIDO2 devices (mTLS does not preserve your privacy at all). This was one of…

Client certs as implemented on Gemini and IRC are self-signed. They are enrolled on the service after they're created. They don't need enterprise level capabilities. In fact, even the creation of these certificates are automated on many clients (eg: Lagrange Gemini browser, soju IRC bouncer). You don't even think of them as certificates. They're considered as identities.

And regarding the privacy. You can deploy as many certificates/identities as you want on multiple accounts and sites. It's not possible to track them across sites or even across accounts, since there is no CA involved.

Re: Passkeys.io – A Passkey Authentication Demo

#76

Post by sebk »

dandanua wrote: post #36
thewataccount wrote: post #20

I'm a bit confused with WebAuthn/Passkeys/Fido If I have a single hardware key/tpm/yubikey/iphone/etc - can you create multiple users on one site? And can they tell that you're the same user? Or are you now locked to just a single user for your phone/macbook/yubikey/whatnot? Also if multiple services colluded (or integrated with say GA) - can they (or at least GA) all tell that you're using the same hardware key acro…

You can use multiple usernames. As for privacy, services can require additional info from your key (WebAuthn shows an additional confirmation button). This info includes the manufacturer and probably some other info (not sure about that). Otherwise it should be impossible to tell if a single key is used for multiple usernames.

Attestation information requires that at least 100k security devices share the same attestation key, so device information can't really be used to track a given user. The proposed devicePubKey extension that helps RPs reason about which device is authenticating with a given Passkey scenario also requires domain-specific DPKs, meaning multiple identities using the same authenticator are indistinguishable as far as WebAuthn is concerned.

Of course, other signals like origin IP or browser fingerprinting can be used to correlate identities.

Re: Passkeys.io – A Passkey Authentication Demo

#77

Post by stavros »

Operyl wrote: post #24
Brajeshwar wrote: post #22

Any idea how are Password Managers, such as 1Password/Bitwarden/Keepass, thinking of integrating or competing or co-living with Passkeys? I can live with something like 1Password but my wife and kids will be more suited and happier with Passkeys.

Bitwarden already support regular WebAuthn for 2FA[0] to log in. They have an active request for Passkey support[1]. It seems like they want to include these inside of their own service too, as the storage provider. [0] https://bitwarden.com/help/setup-two-step-login-fido/ [1] https://community.bitwarden.com/t/unlock-bitwarden-with-2fa-...

They support WebAuthn to log in to Bitwarden, which is very different from supporting WebAuthn to authenticate to sites.

Re: Passkeys.io – A Passkey Authentication Demo

#80

Post by stavros »

lsowen wrote: post #38
odo1242 wrote: post #35

I would really like this tech if they supported third party services to store passkeys in.

Wouldn't that completely eliminate the security benefits of passkey?

No, because it already uses a third party service, it just doesn't let you pick the one you want to use. I want to have the option to use a FIDO2 key, for example.
Post reply on HN