Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passkeys.io – A Passkey Authentication Demo

passkeys.io

Post reply on HN
Print view View original

81–90 of 121 posts

Re: Passkeys.io – A Passkey Authentication Demo

#81

Post by sebk »

Brajeshwar wrote: post #22

Any idea how are Password Managers, such as 1Password/Bitwarden/Keepass, thinking of integrating or competing or co-living with Passkeys? I can live with something like 1Password but my wife and kids will be more suited and happier with Passkeys.

They could implement a virtual authenticator, emulating a TPM or security key and running entirely in software. Of course, this nullifies several advantages of FIDO.

Alternatively, and likely a much better option longer term, they'll need operating system support that provides them with APIs to establish trust between authenticators and export passkeys wrapped with keys corresponding to trusted devices, not unlike how these OSs provide APIs for integrating password managers today. A growing number of password manager vendors have joined the FIDO alliance, hopefully to help move this along. Establishing trust between devices in a Sync Fabric is also something that needs careful consideration if not a standard, since it's a huge target for phishing.

In either of these cases Passkeys from different vendors aren't interoperable.

Re: Passkeys.io – A Passkey Authentication Demo

#82

Post by greggman3 »

jbverschoor wrote: post #50

A few things I don't understand: 1) How can I share the fingerprint keys between chrome and safari? 2) How do I share keys between different types of devices? (mac, ios, android, windows) 3) What happens if my devices are gone? 4) What happens if I want to change my login (email to a new email for example)? 5) Is account recovery handled simply by a reset-email? 6) It seems a validation step of the email is missing?

Watch the video linked below by psanford

1) How can I share the fingerprint keys between chrome and safari?

You don't need to. That's not how it works. Chrome and Safari and every device will have a different key for the same service (see video)

2) How do I share keys between different types of devices? (mac, ios, android, windows)

You don't. You authenticate and a new key is created on each device, possibly on each piece of software (Firefox, Chrome, Safari, App). To be more clear, when and if you decide to use a service from a new device or new browser you'll be asked if you want to login via passkey. If you have a passkey on another device you can (see video) use that to login from the other device (similar to how google asks viat the gmail app of you were trying to log into some other device or Apple asks across your device). After you authenticate you can then create a new passkey for this device/software you're using. This new passkey is separate from the previous passkey. You effectively have 2 passkeys now, one to login with one device/software, one to with a different device/sofware. (See video)

3) What happens if my devices are gone?

You follow whatever recovery procedures the service has.

4) What happens if I want to change my login (email to a new email for example)?

Unrelated. Your email is not shared with passkey. So login and set a new email

5) Is account recovery handled simply by a reset-email?

That's up to the site/service just like it is without passkey

6) It seems a validation step of the email is missing?

That's up to the service as well. They could require an email but that's unrelated to passkey

Re: Passkeys.io – A Passkey Authentication Demo

#83

Post by Operyl »

stavros wrote: post #77
Operyl wrote: post #24

Earlier quoted context omitted.

Bitwarden already support regular WebAuthn for 2FA[0] to log in. They have an active request for Passkey support[1]. It seems like they want to include these inside of their own service too, as the storage provider. [0] https://bitwarden.com/help/setup-two-step-login-fido/ [1] https://community.bitwarden.com/t/unlock-bitwarden-with-2fa-...

They support WebAuthn to log in to Bitwarden, which is very different from supporting WebAuthn to authenticate to sites.

That’s exactly what I said, “to log in”. They’ve also stated in many places over time their interest to be the holder of keys for these things too, including as a reply to the parent of my comment :).

Re: Passkeys.io – A Passkey Authentication Demo

#84

Post by [deleted] »

0x457 wrote: post #69
jbverschoor wrote: post #50

A few things I don't understand: 1) How can I share the fingerprint keys between chrome and safari? 2) How do I share keys between different types of devices? (mac, ios, android, windows) 3) What happens if my devices are gone? 4) What happens if I want to change my login (email to a new email for example)? 5) Is account recovery handled simply by a reset-email? 6) It seems a validation step of the email is missing?

> 1) How can I share the fingerprint keys between chrome and safari? If you're talking about TouchID then - keys aren't stored in a browser, they stored in whatever powers Touch ID (secure enclave?). So any browser that supports Webauthn will be able to reuse it. > 2) How do I share keys between different types of devices? (mac, ios, android, windows) Yes. I have multiple hardware keys that I use on: iPadOS, Android,…

[deleted]

Re: Passkeys.io – A Passkey Authentication Demo

#85

Post by dwaite »

lwhsiao wrote: post #6

> passkeys are way more secure and are easier to use than both passwords and all current 2-factor authentication methods Perhaps I'm naive, but how are passkeys "way more secure" than "all current 2-factor authentication methods"? Don't many security keys (e.g. Yubikey) also require that you are in possession of the physical yubikey? I'm using that as a 2-factor authentication method. Why is a passkey more secure? Up…

Yubikey is included - as a passkey.

They are more secure because they are different per-site and are public-key-based rather than secret-based, so they can't be captured and replayed later, a website compromise doesn't lead to further compromises, and they are phishing-resistant (e.g. paypa1.com can't request PayPal.com credentials).

Passkeys are meant to refer to primary-factor authentication, as opposed to using something like a yubikey as a replacement for SMS OTP or TOTP. The ability to discover available first-factor options for a web domain was something new in FIDO 2 over the older U2F-based keys - I'd expect any security key sold in the last three years to have at least limited support for discoverable credentials.

By default when someone talks about passkeys they mean multi-device, where you back them up (most likely to the cloud) and can sync/restore them to other devices. But modern Yubikeys (and current Windows Hello) support single-device passkeys.

Or to put it a different way - passkeys are meant to be a concept for something equivalent but better than passwords, not a proper spec in themselves. Hence the lowercase 'p'.

Re: Passkeys.io – A Passkey Authentication Demo

#86

Post by psanford »

Zamicol wrote: post #78

This demo would be far more useful if it displayed the public key that was used. As a developer, this appears more like a superficial sales pitch than a technically informing demo.

Try https://webauthn.me/debugger. It will show you all the gritty details.

Re: Passkeys.io – A Passkey Authentication Demo

#87

Post by jbverschoor »

ylk wrote: post #70
cameronh90 wrote: post #60

Earlier quoted context omitted.

> Account recovery isn't really necessary, Unless you want to switch from Safari to Chrome, I guess?

The keys aren’t stored in the browser. The browser just forwards to the hardware. Switching from one password/-key manager to another is going to be more of an issue. But you should be able to add an additional passkey once logged in to an account, just like how you can have multiple hardware 2fa keys now. Then you could manually migrate accounts that way, which is painful, of course, but you wouldn’t be completely l…

I use both chrome and safari, and hate they don't use the same password store anymore (chrome used to just use keychain). But on iOS, you can at least fill in passwords using chrome as well

Re: Passkeys.io – A Passkey Authentication Demo

#88

Post by stavros »

Operyl wrote: post #83
stavros wrote: post #77

Earlier quoted context omitted.

They support WebAuthn to log in to Bitwarden, which is very different from supporting WebAuthn to authenticate to sites.

That’s exactly what I said, “to log in”. They’ve also stated in many places over time their interest to be the holder of keys for these things too, including as a reply to the parent of my comment :).

I know, I'm clarifying that "support WebAuthn to log in" means "to Bitwarden". I'm really looking forward to them being a soft FIDO2 client.

Re: Passkeys.io – A Passkey Authentication Demo

#89

Post by dwaite »

azinman2 wrote: post #11

I guess I’m not understanding passkeys. On my iPhone it’s asking generating a QR code to scan with another device. Is this assuming another device already has credentials? What if this is my only device?

You register a device (authenticator), which generates and registers a new public key. You show up with that again in the future, which answers a challenge by using the private key. So it's just saying "I'm the same device as you've seen in the past".

The system QR code behavior is for when your registered credential lives on another device. It sounds like you might have not registered anything yet, so you don't have any account or credentials with which to sign in.

Re: Passkeys.io – A Passkey Authentication Demo

#90

Post by dwaite »

charles_f wrote: post #10

Very nice, a good step towards the future. Just tried on multi-device scenario with android and my mac and that worked fine. I'm wondering though, how the biometric data gets associated with my email address.

The use-case is to create a new key pair when you register an "authenticator" device, and then sign a challenge later to authenticate (prove it is the existing known authenticator).

It is up to the site to decide if it wants to accept that authenticator, e.g. if it meets the necessary security requirements. For most sites, they'll accept anything based on user preference.

The site only ever knows the 'kind' of authenticator though (possibly through a cryptographic attestation). The authentication process only releases/uses the public key, not any supplemental information. The site would never see any PIN or biometric information that was gathered locally to release the use of the key.

The site (usually) can't even tell whether it was a PIN or biometric used - just that that 'kind' of authenticator has a particular behavior and particular security reputation/policy/certifications.

Post reply on HN