Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The transition from logins to cryptographic passkeys is getting messy

wired.com

Post reply on HN
Print view View original

41–50 of 154 posts

Re: The transition from logins to cryptographic passkeys is getting messy

#41

Post by CatWChainsaw »

nly wrote: post #15

Just give me password auth back. I work in a lab that requires fingerprint login (TrustKey FIDO keys) with no fallback. Every 6-8 weeks I need to have my keys reset with new prints, which is a process that involves meeting a member of the security team in a room for 20 minutes so my key and the backup key (kept in a safe by the firm) can both be reset. Everyday, without fail, I sit there like a chimp taking on averag…

None of these newer solutions do anything but convince me that passwords are the democracy of authentication - the least bad of several bad options. But hey, things are going to become so secure that nobody can get into anything anymore, so I guess that's a win. :)

Re: The transition from logins to cryptographic passkeys is getting messy

#42

Post by MereInterest »

swiftcoder wrote: post #26
freeone3000 wrote: post #19

Earlier quoted context omitted.

Do they expect your fingerprints to have changed?

Unfortunately, fingerprints do change. Cut your thumb slicing tomatoes? Have fun logging in for the next few days. Took up a fun new hobby, like, say, blacksmithing, or ceramic sculpture? Say permanent goodbye to your fingerprints ever scanning correctly again...

Any time I use shellac as a wood finish, I get a layer of shellac on top of all my fingers. There’s no way the fingerprint scanning would work after that.

Re: The transition from logins to cryptographic passkeys is getting messy

#43

Post by semi-extrinsic »

swiftcoder wrote: post #26
freeone3000 wrote: post #19

Earlier quoted context omitted.

Do they expect your fingerprints to have changed?

Unfortunately, fingerprints do change. Cut your thumb slicing tomatoes? Have fun logging in for the next few days. Took up a fun new hobby, like, say, blacksmithing, or ceramic sculpture? Say permanent goodbye to your fingerprints ever scanning correctly again...

Any kind of work in the garage has a 30% chance of messing up my thumb fingerprint, so I have to use passwords/PINs for a few days.

Re: The transition from logins to cryptographic passkeys is getting messy

#44

Post by estebank »

traceroute66 wrote: post #32
throwaway290 wrote: post #22

Earlier quoted context omitted.

Complete noob, stupid question re keyloggers: when YubiKey inserts its token doesn't it go through the same mechanism as keyboard entry? if so keyloggers would work as before

> Complete noob, stupid question re keyloggers: when YubiKey inserts its token doesn't it go through the same mechanism as keyboard entry? It only uses the keyboard in the OTP mode[1] (which you don't have to use, and you can even configure to completely disable). I guess OTP mode is probably the one you were thinking of ? To be honest other than the Yubico demo website, I've never come across a resource in the wild…

> To be honest other than the Yubico demo website, I've never come across a resource in the wild that uses Yubikey OTP mode login anyway. :)

I've seen it used in terminal applications.

Re: The transition from logins to cryptographic passkeys is getting messy

#45

Post by thecopy »

freeone3000 wrote: post #19
nly wrote: post #15

Just give me password auth back. I work in a lab that requires fingerprint login (TrustKey FIDO keys) with no fallback. Every 6-8 weeks I need to have my keys reset with new prints, which is a process that involves meeting a member of the security team in a room for 20 minutes so my key and the backup key (kept in a safe by the firm) can both be reset. Everyday, without fail, I sit there like a chimp taking on averag…

Do they expect your fingerprints to have changed?

As a climber: Yes. My MacBook TouchID stops working on days i climb.

Re: The transition from logins to cryptographic passkeys is getting messy

#46

Post by wkat4242 »

xracy wrote: post #6

Part of the problem is that right now the most convenient use of things like yubikeys is that the most convenient use of them is just leave them in your computer wherever they may be. That makes them a pretty hard sell for any workplace environment, but also makes them a significant security risk on-par with writing your passwords on a post-it note for anyone looking to burgle... Seems like 2FA is the future...

It's not the same kind of risk. You need to enter a pin for most uses (limited number of attempts) and touch it to avoid remote exploitation.

Using a keylogger and then stealing the key will work but it requires a lot more than stealing a password

Re: The transition from logins to cryptographic passkeys is getting messy

#47

Post by justsomehnguy »

_448 wrote: post #29

Oh, what could go wrong! Why is there no discussion on users losing their private keys? Ask all those cryptocurrency users who lost their private keys. Now don't tell that there are crypto wallets/vaults that manage private keys; there are many ways key can be lost even when using wallets/vaults. We engineers live in a different world, disconnected from the regular users who have no clue what public-private keys are!

> We engineers live in a different world

No.

Some of us, engineers, live in a world where 512b RSA is mandatory to order a pizza. Most of us are sane.

Re: The transition from logins to cryptographic passkeys is getting messy

#48

Post by [deleted] »

brazzy wrote: post #35
rwmj wrote: post #17

Earlier quoted context omitted.

How does that work for people with poor/unreadable fingerprints? We're 3% of the general population apparently.

A sane setup would provide an alternative to unlock the passkey, with a PIN. Yes, you're back to entering a password, but you don't have most of the weaknesses and pitfalls of password-based logins in distributed systems (phishing,credential stuffing,keyloggers probably a few others).

[deleted]

Re: The transition from logins to cryptographic passkeys is getting messy

#49

Post by nmca »

jeroenhd wrote: post #33
_448 wrote: post #29

Oh, what could go wrong! Why is there no discussion on users losing their private keys? Ask all those cryptocurrency users who lost their private keys. Now don't tell that there are crypto wallets/vaults that manage private keys; there are many ways key can be lost even when using wallets/vaults. We engineers live in a different world, disconnected from the regular users who have no clue what public-private keys are!

The standard mantra for physical key-based 2FA has always been "register two keys and keep one in a safe", which seems doable for important accounts (like banks and government stuff) but no way am I going to get a key out of my safe when I want to order a replacement part on JoesDiscountDishwasherParts.biz. I really wish there was a way to register your backup key through your primary key. Luckily, FIDO2 can fix a lo…

Wait - the way this works is you have a backup key, if you lose your primary you replace it using your backup. NB this is only needed when you move to a new device with a new secure enclave too, so at no point is this pizza situation likely.

Re: The transition from logins to cryptographic passkeys is getting messy

#50

Post by techwiz137 »

_448 wrote: post #29

Oh, what could go wrong! Why is there no discussion on users losing their private keys? Ask all those cryptocurrency users who lost their private keys. Now don't tell that there are crypto wallets/vaults that manage private keys; there are many ways key can be lost even when using wallets/vaults. We engineers live in a different world, disconnected from the regular users who have no clue what public-private keys are!

I noticed that you seem to have some negative views towards cryptocurrency users and not their ability to store and keep their private keys safe.
Post reply on HN