Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The transition from logins to cryptographic passkeys is getting messy

wired.com

Post reply on HN
Print view View original

61–70 of 154 posts

Re: The transition from logins to cryptographic passkeys is getting messy

#61

Post by dvzk »

_448 wrote: post #29

Oh, what could go wrong! Why is there no discussion on users losing their private keys? Ask all those cryptocurrency users who lost their private keys. Now don't tell that there are crypto wallets/vaults that manage private keys; there are many ways key can be lost even when using wallets/vaults. We engineers live in a different world, disconnected from the regular users who have no clue what public-private keys are!

Cryptocurrencies are a spectacularly bad counterexample. If password-derived private keys had ever become commonplace, the ensuing theft would have absolutely dwarfed the losses from lost wallet keys. I'm not sure if there's even a comparable instance of successful widespread public-key cryptography adoption.

Re: The transition from logins to cryptographic passkeys is getting messy

#62

Post by zarzavat »

cornholio wrote: post #52
_448 wrote: post #29

Oh, what could go wrong! Why is there no discussion on users losing their private keys? Ask all those cryptocurrency users who lost their private keys. Now don't tell that there are crypto wallets/vaults that manage private keys; there are many ways key can be lost even when using wallets/vaults. We engineers live in a different world, disconnected from the regular users who have no clue what public-private keys are!

A web password is effectively a private secret, that can be used, for example, to derive a ECC keypair, but this secret is passed around in plain text between your device and the target site or service. It might be encrypted on the wire, but it must be known by both. So any system that replaces web auth passwords is, worst case, just as bad as a password from a key-ownership perspective. Such a system also has the po…

The question is how do you recover it when you lose it?

For a password I just click the “I forgot my password” link, I get an email with a link to click, and my account is recovered within minutes. I have recovered 15 year old accounts this way.

If you can’t do that with passkeys, then the system is doomed to failure because people lose their credentials and devices all the time.

Re: The transition from logins to cryptographic passkeys is getting messy

#63

Post by rhaway84773 »

loloquwowndueo wrote: post #58
NikolaNovak wrote: post #55

Earlier quoted context omitted.

I am in IT but not this side and I must admit I do not grok this move... At all. I don't understand the risk to Benefit story. It seems (possibly incorrectly) to put all my eggs into one basket - whether phone (which annoys the heck out of me as it is NOT my primary device) or some cloudy account I'm supposed to trust with my life. It also seems to impose geographical dependencies (I want to check my email at my frie…

The device is not mandated to be a phone. A hardware passkey is also an option. You carry the keys to your home everywhere, don’t you? And you take good care of them? Why would carrying a webauthn-compliant hardware key be any different?

Where can I find a digital locksmith?

Re: The transition from logins to cryptographic passkeys is getting messy

#64

Post by 007asdflkjsfd »

MereInterest wrote: post #42
swiftcoder wrote: post #26

Earlier quoted context omitted.

Unfortunately, fingerprints do change. Cut your thumb slicing tomatoes? Have fun logging in for the next few days. Took up a fun new hobby, like, say, blacksmithing, or ceramic sculpture? Say permanent goodbye to your fingerprints ever scanning correctly again...

Any time I use shellac as a wood finish, I get a layer of shellac on top of all my fingers. There’s no way the fingerprint scanning would work after that.

happily for you, you have the problem AND the solution!

next time, (besides using gloves for once) drop a blob of shellac on a shallow container with flexible sides (silicone or any flimsy bottle cap). After a few hours, take off gloves and thumbprint for several minutes with very light pressure on the blob of shellac. after another few hours, tie some nylon ties to the side of the container and tighten every now and then so that the end result is a convex plane with your finger prints. you want it slight convex but still mostly plane.

Done. now wait for that to dry. apply some harder finishing synthetic laqueur to preserve it longer. just keep that in your pocket and you will be able to unlock most phones.

note that some phones (correctly) do not mirror your prints, thought most do for some reason... for those you will have to first cast you prints and then cast the reusable token. which make getting a convex token in the end easier tho... but for the dozen of devices i've tested, they all mirror just fine.

... and that's reason #1239090 why using biometrics as passwords are a really stupid idea. it's only good for convenience shortcuts, so fine on phones, bad on anything else.

Re: The transition from logins to cryptographic passkeys is getting messy

#65

Post by postalrat »

swiftcoder wrote: post #27
izacus wrote: post #3

Earlier quoted context omitted.

Because passkey is owned by you (as in - whichever software vault you're using) and not Facebook. It's no different than stored random 32 character passwords in a password manager... it's pretty much the same really, just that you don't have to copy/paste it in a form.

> whichever software vault you're using Do consumers perceive a significant difference between "login with Facebook" and "login with LastPass"? In both cases I'm delegating my security credentials to a cloud service I have limitted influence over.

Passkeys don't require any cloud provider.

Re: The transition from logins to cryptographic passkeys is getting messy

#66

Post by ghaff »

loloquwowndueo wrote: post #58
NikolaNovak wrote: post #55

Earlier quoted context omitted.

I am in IT but not this side and I must admit I do not grok this move... At all. I don't understand the risk to Benefit story. It seems (possibly incorrectly) to put all my eggs into one basket - whether phone (which annoys the heck out of me as it is NOT my primary device) or some cloudy account I'm supposed to trust with my life. It also seems to impose geographical dependencies (I want to check my email at my frie…

The device is not mandated to be a phone. A hardware passkey is also an option. You carry the keys to your home everywhere, don’t you? And you take good care of them? Why would carrying a webauthn-compliant hardware key be any different?

>You carry the keys to your home everywhere, don’t you?

Nope. If I don't need my car keys I don't carry my keys. I do tend to carry a small wallet and my phone but also carrying a separate hardware token routinely would actually be a pain for me.

Re: The transition from logins to cryptographic passkeys is getting messy

#67

Post by AlexandrB »

jeroenhd wrote: post #37
michaelt wrote: post #2

> Another big challenge with establishing consistency and continuity will be the long transition to passkeys alone. If I wanted passwordless login, why wouldn't I just hit the big 'sign in with facebook' button practically every website has these days?

I deleted my Facebook account. I lost access to several accounts that way, luckily none of them were important. At least this time I chose to close my account. Next time it can be Facebook/Google/Microsoft/Twitter/Apple who decide that you're a robot/fraud/whatever after receiving a bunch of automated reports. If Google ever bans me, I'm screwed in many different yet interesting ways.

What's really scary is how account access can be lost in retaliation for exercising your rights as a customer (e.g. chargebacks, "too many" returns, lawsuits, etc).

As FAANG expand into more parts of our lives there are more and more things you're legally allowed to do but shouldn't do if you want to maintain access to all your shit. The TOSs of these vendors can become a de-facto legal regime that limits your rights in new and exciting ways.

Re: The transition from logins to cryptographic passkeys is getting messy

#68

Post by [deleted] »

jeroenhd wrote: post #33
_448 wrote: post #29

Oh, what could go wrong! Why is there no discussion on users losing their private keys? Ask all those cryptocurrency users who lost their private keys. Now don't tell that there are crypto wallets/vaults that manage private keys; there are many ways key can be lost even when using wallets/vaults. We engineers live in a different world, disconnected from the regular users who have no clue what public-private keys are!

The standard mantra for physical key-based 2FA has always been "register two keys and keep one in a safe", which seems doable for important accounts (like banks and government stuff) but no way am I going to get a key out of my safe when I want to order a replacement part on JoesDiscountDishwasherParts.biz. I really wish there was a way to register your backup key through your primary key. Luckily, FIDO2 can fix a lo…

[deleted]

Re: The transition from logins to cryptographic passkeys is getting messy

#69

Post by 007asdflkjsfd »

Name one system that accepts passkeys and allows you to setup two of them. as is the recommended best practice everywhere.

even OTP tokens generators goes to great lengths to give a false sense o security that their seed is unique simply by hiding it from the user UI. Google authenticator will happily save the seed and seed tokens in their cloud and allow you to restore. all while still hiding it from the user.

if you have twenty accounts on your OTP, and get a new phone, you have to log in on each site/product. Disable and re-enable 2fa. That's some 2~5min each.

back to passkeys... do you think this will last when google is getting tons of spam on gmail because microsoft is not careful on their spam bot protection? likely google will just shutdown the integration and demand you use google or apple for gmail. This will happen all over all the time.

Re: The transition from logins to cryptographic passkeys is getting messy

#70

Post by cornholio »

zarzavat wrote: post #62
cornholio wrote: post #52

Earlier quoted context omitted.

A web password is effectively a private secret, that can be used, for example, to derive a ECC keypair, but this secret is passed around in plain text between your device and the target site or service. It might be encrypted on the wire, but it must be known by both. So any system that replaces web auth passwords is, worst case, just as bad as a password from a key-ownership perspective. Such a system also has the po…

The question is how do you recover it when you lose it? For a password I just click the “I forgot my password” link, I get an email with a link to click, and my account is recovered within minutes. I have recovered 15 year old accounts this way. If you can’t do that with passkeys, then the system is doomed to failure because people lose their credentials and devices all the time .

Surely a system where you have a single point of trust and key backup is better than the current mess of using a single password on multiple sites, like most people do.

And no, the solution to that is not security education, people don't change and a system that expects behavioral changes without enforcing them is simply an insecure design. The truth of the matter is that passwords are insecure and problematic for the vast majority of non-technical people.

Post reply on HN