Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The transition from logins to cryptographic passkeys is getting messy

wired.com

Post reply on HN
Print view View original

11–20 of 154 posts

Re: The transition from logins to cryptographic passkeys is getting messy

#11

Post by hackernewds »

xracy wrote: post #6

Part of the problem is that right now the most convenient use of things like yubikeys is that the most convenient use of them is just leave them in your computer wherever they may be. That makes them a pretty hard sell for any workplace environment, but also makes them a significant security risk on-par with writing your passwords on a post-it note for anyone looking to burgle... Seems like 2FA is the future...

The weakest link in security system will always be the humans expected to keep them secure

Re: The transition from logins to cryptographic passkeys is getting messy

#12

Post by KyeRussell »

izacus wrote: post #3
michaelt wrote: post #2

> Another big challenge with establishing consistency and continuity will be the long transition to passkeys alone. If I wanted passwordless login, why wouldn't I just hit the big 'sign in with facebook' button practically every website has these days?

Because passkey is owned by you (as in - whichever software vault you're using) and not Facebook. It's no different than stored random 32 character passwords in a password manager... it's pretty much the same really, just that you don't have to copy/paste it in a form.

I think that this question is being posed from the perspective of a civilian.

Re: The transition from logins to cryptographic passkeys is getting messy

#13

Post by md_ »

xracy wrote: post #6

Part of the problem is that right now the most convenient use of things like yubikeys is that the most convenient use of them is just leave them in your computer wherever they may be. That makes them a pretty hard sell for any workplace environment, but also makes them a significant security risk on-par with writing your passwords on a post-it note for anyone looking to burgle... Seems like 2FA is the future...

This is an extraordinarily bad take. :)

- The biggest threat almost all users face is in the form of remote attackers: password phishing, database leaks + password reuse, tricking users into installing malware, etc. Local attackers are so far down the list of concerns that, really, using unique passwords and storing them on Post-Its is, for most people, an improvement in security!

- Leaving a Yubikey in the computer is, in fact, the normal, intended mode of operation--that's why Yubico makes low-profile keys that you can just leave in your USB port. Yes, an attacker can just steal the key, but the key alone is insufficient to authenticate in most uses; almost all relying parties using keys that don't support user verification will also require a password.

- The article was about passkeys, not FIDO security keys. Subtle difference, but, importantly, passwordless authn using passkeys requires the authenticator to support "user verification" mode (like a PIN/screenlock/biometric).

Re: The transition from logins to cryptographic passkeys is getting messy

#14

Post by traceroute66 »

xracy wrote: post #6

Part of the problem is that right now the most convenient use of things like yubikeys is that the most convenient use of them is just leave them in your computer wherever they may be. That makes them a pretty hard sell for any workplace environment, but also makes them a significant security risk on-par with writing your passwords on a post-it note for anyone looking to burgle... Seems like 2FA is the future...

> also makes them a significant security risk on-par with writing your passwords on a post-it note for anyone looking to burgle...

May I humbly suggest you RTFM before posting FUD.

You can set a PIN on the Yubikey (or on the Yubikey Bio's, your fingerprint).

Further, the PIN will block after three failed attempts, requiring the PUK to reset the PIN.

Key loggers are of course defeated by the Yubikey's touch requirement (which you can make mandatory for all actions irrespective of time between actions, i.e. a no temporary cache policy).

Hence your "security risk" is non-existent.

Re: The transition from logins to cryptographic passkeys is getting messy

#15

Post by nly »

Just give me password auth back.

I work in a lab that requires fingerprint login (TrustKey FIDO keys) with no fallback.

Every 6-8 weeks I need to have my keys reset with new prints, which is a process that involves meeting a member of the security team in a room for 20 minutes so my key and the backup key (kept in a safe by the firm) can both be reset.

Everyday, without fail, I sit there like a chimp taking on average 2 minutes to unlock my workstation. This happens maybe 5 times per day.

Re: The transition from logins to cryptographic passkeys is getting messy

#16

Post by nly »

coldtea wrote: post #7
michaelt wrote: post #2

> Another big challenge with establishing consistency and continuity will be the long transition to passkeys alone. If I wanted passwordless login, why wouldn't I just hit the big 'sign in with facebook' button practically every website has these days?

Wouldn't that give somebody having access to your FB account access to every website you used FB login for? At minimum you'd still need 2FA with that to avoid this.

It also gives Facebook themselves access to every service you can 'Login with Facebook' with

Re: The transition from logins to cryptographic passkeys is getting messy

#17

Post by rwmj »

nly wrote: post #15

Just give me password auth back. I work in a lab that requires fingerprint login (TrustKey FIDO keys) with no fallback. Every 6-8 weeks I need to have my keys reset with new prints, which is a process that involves meeting a member of the security team in a room for 20 minutes so my key and the backup key (kept in a safe by the firm) can both be reset. Everyday, without fail, I sit there like a chimp taking on averag…

How does that work for people with poor/unreadable fingerprints? We're 3% of the general population apparently.

Re: The transition from logins to cryptographic passkeys is getting messy

#18

Post by pinkcan »

nly wrote: post #15

Just give me password auth back. I work in a lab that requires fingerprint login (TrustKey FIDO keys) with no fallback. Every 6-8 weeks I need to have my keys reset with new prints, which is a process that involves meeting a member of the security team in a room for 20 minutes so my key and the backup key (kept in a safe by the firm) can both be reset. Everyday, without fail, I sit there like a chimp taking on averag…

It's a ceremony, it's ego stroking.

Re: The transition from logins to cryptographic passkeys is getting messy

#19

Post by freeone3000 »

nly wrote: post #15

Just give me password auth back. I work in a lab that requires fingerprint login (TrustKey FIDO keys) with no fallback. Every 6-8 weeks I need to have my keys reset with new prints, which is a process that involves meeting a member of the security team in a room for 20 minutes so my key and the backup key (kept in a safe by the firm) can both be reset. Everyday, without fail, I sit there like a chimp taking on averag…

Do they expect your fingerprints to have changed?

Re: The transition from logins to cryptographic passkeys is getting messy

#20

Post by izacus »

KyeRussell wrote: post #12
izacus wrote: post #3

Earlier quoted context omitted.

Because passkey is owned by you (as in - whichever software vault you're using) and not Facebook. It's no different than stored random 32 character passwords in a password manager... it's pretty much the same really, just that you don't have to copy/paste it in a form.

I think that this question is being posed from the perspective of a civilian.

What's a "civilian" in your context?
Post reply on HN