Passkeys.io – A Passkey Authentication Demo • Hacker News Board

Re: Passkeys.io – A Passkey Authentication Demo

#91

Post by dwaite » Tue, Oct 25, 2022, 6:35 PM UTC

Zamicol wrote: post #79

taf2 wrote: post #7

I love this in chrome at least I ran into all sorts of issues trying to get WebAuthn to work with touchid and my yubikey... anyone have plain JS example that works?

I second this. I would love to see a raw demo that doesn't hide the internals.

webauthn.io has recently been revamped to support more of the 'passkeys' behavior, such as conditional UI (the password manager/form-fill-like behavior added in certain browsers).

webauthn.me has a developer tab that lets you really get your hands dirty.

Re: Passkeys.io – A Passkey Authentication Demo

#92

Post by dwaite » Tue, Oct 25, 2022, 6:36 PM UTC

odo1242 wrote: post #35

I would really like this tech if they supported third party services to store passkeys in.

1Password and Dashlane have announced support via web extensions. I also really hope we have future platform-level support, so that third party "passkey managers" will work outside of the browser (such as on mobile, within all native apps).

Re: Passkeys.io – A Passkey Authentication Demo

#93

Post by dwaite » Tue, Oct 25, 2022, 6:41 PM UTC

stavros wrote: post #3

This completely fails on Linux (doesn't even pop up the dialog for my FIDO2 key), even though WebAuthn on e.g. https://www.pastery.net works fine (and works fine with Passkeys on my Android phone).

Firefox is unfortunately a behind on support for this technology. I believe at least one password manager (Dashlane) has shipped a web extension that would polyfill the missing bits on Firefox.

Unfortunately, passkeys.io as a demo falls back to a legacy "no passkey support" behavior for Firefox, without making it clear (as a demo site) that this is happening.

Re: Passkeys.io – A Passkey Authentication Demo

#94

Post by dwaite » Tue, Oct 25, 2022, 6:46 PM UTC

homero wrote: post #55

I wish chrome showed me what keys are issued. There's no way to see a list

The platform is often managing things, sometimes with Chrome and the platform splitting responsibilities when the Chrome team adds support for additional options.

So the ability to see or manage passkeys will unfortunately vary by platform, and Chrome's support there will thus also vary. We can only hope this gets more consistent over time.

For passkeys in Google Password Manager, I expect they will (at least eventually) show up right alongside passwords. This is also how it works in the Apple ecosystem.

Re: Passkeys.io – A Passkey Authentication Demo

#95

Post by dwaite » Tue, Oct 25, 2022, 6:51 PM UTC

fbn79 wrote: post #4

What if your device cannot connect to internet? OTP can work even if device is offline.

If your device has limited network connectivity, it can create new passkeys or use a passkey it already has for interacting with a service. However, it won't be able to synchronize new credentials with any cloud service in multi-device scenarios.

Or in other words, it works the same as a password manager today.

There is a slight wrinkle that some platforms may eventually offer to use an internet service during registration for any required device attestations (e.g. no, this is really coming from mobile phone brand X). Your registration process can't require such things if you are dealing with non-internet-connected devices.

Re: Passkeys.io – A Passkey Authentication Demo

#96

Post by iou » Tue, Oct 25, 2022, 6:56 PM UTC

thewataccount wrote: post #20

I'm a bit confused with WebAuthn/Passkeys/Fido If I have a single hardware key/tpm/yubikey/iphone/etc - can you create multiple users on one site? And can they tell that you're the same user? Or are you now locked to just a single user for your phone/macbook/yubikey/whatnot? Also if multiple services colluded (or integrated with say GA) - can they (or at least GA) all tell that you're using the same hardware key acro…

Take a listen to https://securitycryptographywhatever.buzzsprout.com/1822302/... the Q&A helped explain a lot

Re: Passkeys.io – A Passkey Authentication Demo

#97

Post by jonas-w » Tue, Oct 25, 2022, 6:56 PM UTC

Why does it use Apple specific terms like "Touch ID" or "Face ID" or is this now the standard way to talk about fingerprint sensors and face recognition?

Re: Passkeys.io – A Passkey Authentication Demo

#98

Post by homero » Tue, Oct 25, 2022, 7:00 PM UTC

dwaite wrote: post #94

homero wrote: post #55

I wish chrome showed me what keys are issued. There's no way to see a list

The platform is often managing things, sometimes with Chrome and the platform splitting responsibilities when the Chrome team adds support for additional options. So the ability to see or manage passkeys will unfortunately vary by platform, and Chrome's support there will thus also vary. We can only hope this gets more consistent over time. For passkeys in Google Password Manager, I expect they will (at least eventua…

Chrome on Android should show easily but it doesn't

Re: Passkeys.io – A Passkey Authentication Demo

#99

Post by astrosi » Tue, Oct 25, 2022, 7:13 PM UTC

How would you go about handing a lost device with this? A passkey reset email which would have a link that you could use to register a new device?

Re: Passkeys.io – A Passkey Authentication Demo

#100

Post by smcleod » Tue, Oct 25, 2022, 8:26 PM UTC

Just tried this on iOS 16.1 and when I go to sign in with the passkey it loads a pop up menu with a QR code that I need to scan - but it's on my phone so what am I supposed to scan it with?